text: As part of our Enterprise Risk Management ("ERM") process, we identify risks and assign responsibility for managing each risk to the appropriate level of management. Cybersecurity is a risk identified in our ERM process. Management has implemented a comprehensive cybersecurity risk management strategy in line with industry standards and regulatory requirements. This strategy includes: • conducting an independent cybersecurity maturity assessment to evaluate the health of our overall cyber programs and developing a solid roadmap to continuously improve our defensive posture; • performing regular risk assessments, where we identify potential vulnerabilities and evaluate the likelihood of various cyber threats; • implementing security controls including email and browser protection, audit log monitoring, malware defenses, controlled use of administrative privileges, encryption protocols, and multi-factor authentication; and • implementing progressively challenging employee training and awareness programs, including simulated phishing campaigns, to reduce the risk of human error in the recognition and reporting of potential threats.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: Additionally, we maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate management and/or executives. We have created and maintain a Crisis Management Plan as part of our overall Incident Response Plan which provides for the escalation path and management of an incident by the appropriate designated executives. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of the information technology management team are embedded by design. The Crisis Management Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN

secItem: Item 1C


text: a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board.

companyName: BLACKSTAR ENTERPRISE GROUP, INC.


text: As of the date of this Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: 4Front Ventures Corp.


text: The Company is in the process of developing an information security program to address risks from cybersecurity threats. Management plans to engage a reputable third party with the appropriate expertise in IT and cybersecurity to develop these programs.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: Starbucks has implemented a cybersecurity program that leverages industry-standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to assess, identify, and manage cybersecurity risk. Our cybersecurity program is integrated with the Enterprise Risk Management ("ERM") framework and governance processes utilized by management and our Board to oversee our various top enterprise risks. Our internal audit function periodically evaluates our cybersecurity program and selected aspects of it.

companyName: STARBUCKS CORP

ticker: SBUX


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board. The "heat map" includes risks related to cybersecurity threats to L3Harris and our customers, suppliers, vendors, subcontractors or other third parties, and the possibility of a data breach of our confidential, personal and proprietary information through a cybersecurity incident impacting L3Harris or any third party. We could be negatively impacted by a security breach, through cyber-attack, cyber intrusion, insider threats, supply chain incidents, or otherwise, or other significant disruption of our IT networks and related systems or of those we operate for certain of our customers. See "Item 1A - Risk Factors" in this Report for further discussion of specific risks related to cybersecurity threats.

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: As an externally managed company, we rely on our Manager and its affiliates' information systems in connection with our day-to-day operations. Consequently, we also rely on the processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by TPG. TPG has established an Enterprise Risk Committee ("ERC") to manage overall risk across the organization including cybersecurity risks identified by TPG's cybersecurity team; the ERC includes representatives from relevant functions and is led by TPG's Chief Executive Officer. TPG has also established an Operational Risk Committee ("ORC") which is responsible for applying the policy decisions of the ERC. Operational responsibility for ensuring the adequacy and effectiveness of our Manager's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO"), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually. TPG's cybersecurity team also regularly coordinates with other key stakeholders within the organization, including compliance, human resources, internal audit and legal. The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program. TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period. TPG has informed us that the CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP). TPG's cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees. TPG's cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.

companyName: TPG Mortgage Investment Trust, Inc.

ticker: MITT


text: We have a cybersecurity risk management committee comprised of senior leadership, including our CIO. The committee evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company's cybersecurity risk management committee is also responsible for informing the Audit Committee on cybersecurity risks. The committee provides briefings to the Audit Committee on at least a quarterly basis, performs a comprehensive annual review of cybersecurity risks and threats, and assesses and adjusts the Company's processes to prevent, detect, mitigate, and remediate any such risks and threats.

companyName: Liberty Energy Inc.

ticker: LBRT


text: We rely on third-party service providers to execute certain business processes, maintain certain information systems and infrastructure, evaluate defenses, and implement recommendations. We periodically have external information security assessments performed by third parties to analyze our internal assessment results and to stay informed of information security risks. Additionally, we maintain a supplier validation process, which involves approval by our cybersecurity group for significant suppliers that will have access to any of our databases or technology. We also maintain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: SHYFT GROUP, INC.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives period reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. The full Board members receives presentations on cybersecurity topics from Connetic as part of the Board's continuing education on topics that impact public companies.

companyName: Peakstone Realty Trust

ticker: PKST


text: The Company has an enterprise risk management ("ERM") program, for which the Board has oversight responsibility. Under the ERM program, senior leaders from across the Company's global footprint annually evaluate risks according to likelihood, significance and velocity to identify and prioritize the most significant risks facing the Company. "IT and Cybersecurity risk" has been identified as part of the ERM program as a significant risk, and the CFO is assigned to this risk area to ensure the development of mitigation plans, monitor progress against those plans, and maintain and measure against a set of key risk indicators.

companyName: BRINKS CO

ticker: BCO


text: The potential impact of risks from cybersecurity threats on the Fund are assessed on an ongoing basis, and how such risks could materially affect the Fund's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Fund did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Fund, including its day-to-day operations, financial condition, and business strategies. In conjunction with Fidelity's Enterprise Cybersecurity organization, the Fund participates in regular testing of applicable incident response processes to ensure appropriate escalation, mitigation, communication and reporting processes are in place.

companyName: Fidelity Private Credit Co LLC


text: We have implemented processes for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management program. Our cybersecurity program is informed by the National Institute of Standards and Technology Cybersecurity Framework as well as other globally recognized standards. We use a layered defense model, incorporating a wide range of technologies and practices in an effort to prevent, detect and mitigate threats. These measures include intrusion detection and prevention systems, multi-factor authentication, encryption and endpoint protection tools. We also implement threat detection and response solutions. To address emerging threats, we employ automated monitoring, vulnerability scans and patch management processes. Regular assessments, such as penetration tests, security audits and table-top exercises, are conducted to identify vulnerabilities and promote incident response and risk mitigation. We also provide privacy and information security trainings for our employees on a recurring basis. From time to time, we engage assessors, consultants and other third parties to assist with assessing, identifying and managing cybersecurity risks, including assisting us to conduct some of the foregoing assessments. Our cybersecurity risk management processes also are informed by intelligence received from recognized cybersecurity industry experts and other third-party sources, and as appropriate we engage outside counsel to advise on regulatory compliance and other cybersecurity risk management efforts.

companyName: Walt Disney Co

ticker: DIS


text: We are subject to cyber incidents and will continue to be exposed to cyber incidents in the normal course of our business. Although, such risks have not materially affected us, including our business strategy, financial condition, results of operations, or cash flows. The extensive approach we take to cybersecurity may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A – Risk Factors for a discussion of cybersecurity risks.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: We regularly assess our programs and control environment, leveraging externally conducted cyber tests and evaluations along with internally managed cyber risk assessments and testing. Additionally, the Company collaborates with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:

companyName: WABASH NATIONAL Corp

ticker: WNC


text: We operate through our subsidiaries and receive services through our intercorporate services agreement ("ISA") with Contran (see Note 17 to our Consolidated Financial Statements). We recognize the importance of proactively assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational disruptions, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on both operational and compliance foundations. The operational component focuses on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. The compliance component establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is fully integrated into our enterprise-wide risk management framework.

companyName: VALHI INC /DE/

ticker: VHI


text: For additional information regarding how cybersecurity threats are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."

companyName: Cable One, Inc.

ticker: CABO


text: We have an incident response plan that includes scenario-based playbooks for addressing cybersecurity incidents and associated crisis communication procedures designed to facilitate coordination across the Company and with our partners, customers, the public and others.

companyName: LEAR CORP

ticker: LEA


text: A role of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our management is responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk function in coordination with the oversight and periodic review of the audit committee. In the event of a cybersecurity incident impacting us, management will report to our board of directors and provide updates on management's incident response plan for addressing and mitigating any risks associated with such an incident.

companyName: Peraso Inc.

ticker: PRSO


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, through its service providers, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Steele Creek Capital Corp


text: In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks faced by us are discussed in Part I, Item 1A, "Risk Factors," under the headings "If our information systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences" and "Our business and operations would suffer in the event of system failures, cyber-attacks or a deficiency in our cybersecurity."

companyName: PALISADE BIO, INC.

ticker: PALI


text: We recognize the importance of being able to assess, effectively respond to, and manage material cybersecurity threats and incidents that may compromise the confidentiality, integrity or availability of our information systems, data, or network resources. To address these concerns, we have developed and implemented company-wide policies and procedures to help raise awareness of, identify, assess, and manage cybersecurity threats. Our Information Security organization has primary responsibility for the implementation of our cybersecurity policies and procedures and the management of our responses to information technology and security risks, including risks related to cybersecurity threats.

companyName: Vista Outdoor Inc.


text: Third-Party Cyber Risk Management. Some of our information systems and networks are developed, supplied, or managed by third-party service providers. Our third-party cyber risk management process analyzes and seeks to control risks associated with outsourcing products or services, such as "supply chain" style cyberattacks, and identifies preventative and detective controls to mitigate third-party vendor and service provider cybersecurity risks that could adversely impact our business and operations.

companyName: Philip Morris International Inc.

ticker: PM


text: To date, although the Company has been subject to cyber-attacks, the risks and impacts from cybersecurity threats have not materially affected the Company. We have significantly increased our cybersecurity investments over the last several years and have implemented cybersecurity safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company. Notwithstanding our increased cybersecurity investments and preparedness activities, sophisticated and targeted computer crime perpetrated by threat actors internal or external to the Company poses a risk to the security of our systems, facilities, and networks and to the confidentiality, availability, and integrity of our data, including but not limited to intellectual property and confidential and personal data. This could result in a violation of applicable privacy and other laws, legal and financial exposure, negative impacts on our customers' willingness to transact business with us, and a loss of confidence in our security measures, which could have an adverse effect on our results of operations and our reputation. Refer to the risk factor titled "We are subject to cybersecurity risks and may incur increasing costs in an effort to minimize those risks" in Item 1A of this Form 10-K for further detail regarding cybersecurity risks that could affect the Company's operations. We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: FOSTER L B CO

ticker: FSTR


text: A third-party security firm provides training to our employees, helping our information technology team to maintain a state-of-the-art cybersecurity system and staying up to date on the latest threats and counter measures available. The third-party security firm places a high priority on employee threat education through automated internal phishing tests. Our information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Eaton follows the U.S. National Institute of Standards and Technology (NIST) Cyber Security Framework to structure protocols for identifying, assessing and managing cybersecurity risks. In accordance with NIST guidance, Eaton maintains documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. These policies and standards include both preventive measures and reactive processes. Preventive measures include, but are not limited to, protective and detective cybersecurity systems, security monitoring, threat hunting and mandatory, enterprise-wide employee training. Eaton's reactive processes are captured primarily by a cyber incident response plan (the IRP), which is comprised of an evolving set of procedures developed by cross-functional experts, and external consultants, who draw upon technical proficiency and learnings from past experiences. All of these procedures and practices are tailored to Eaton's technology environment and are refined iteratively. Further, Eaton has an information risk management program that includes a vendor risk assessment process, whereby Eaton systematically oversees and identifies risks from cybersecurity threats related to its use of third-party service providers.

companyName: Eaton Corp plc

ticker: ETN


text: Our IT governance ensures alignment between the Company's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Company's risk appetite.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition ("SCADA") system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate our systems) and test that awareness using knowledge assessments and simulations. The training is administered to employees on a rolling basis, and we use a third-party provider for the content periodically update the training to incorporate new cybersecurity-related developments.

companyName: CTS CORP

ticker: CTS


text: The Risk Committee and the entire Board review and approve the Company's information security policies and certain other relevant policies on at least an annual basis. Our ISO, who has over twenty-five years of experience in the system, network, and cybersecurity space, is responsible for overseeing and managing the Information Security Program alongside our Chief Information Officer. The Chief Information Officer serves on the Enterprise Risk Management Committee, which is chaired by our Chief Risk Officer. They are supported by our team of technology professionals, who are responsible for information technology security monitoring and for managing the controls designed to identify, detect, protect against, respond to and recover from cybersecurity threats and cybersecurity incidents.

companyName: First Internet Bancorp

ticker: INBK


text: We rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: Our Board of Directors (the "Board") addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of the Board (the "Audit Committee") is responsible for overseeing our cybersecurity risk management processes, including our assessment and mitigation of material risks from cybersecurity threats. The Audit Committee receives regular reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). In addition, on at least an annual basis, the Board receives reports, summaries or presentations related to cybersecurity threats, risk, mitigation and related processes.


text: We do not believe that there are currently any risks from cybersecurity threats of which we are aware that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition. We did experience a network security incident in 2019, which was disclosed previously, from which we have incorporated lessons learned and improved our risk management program. Despite our security measures, however, there is no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For additional information regarding the risks to the Company associated with cybersecurity incidents, see "If our management information systems, including our digital platform or our customer contact center, experience disruptions, it could disrupt our business and reduce our net sales" included in Part I, Item 1A (Risk Factors) of this Annual Report.

companyName: LL Flooring Holdings, Inc.


text: We continue to make investments in new cybersecurity technologies to protect our facilities, users, and stakeholders, and to protect the personally identifiable information we maintain.

companyName: HF Sinclair Corp

ticker: DINO


text: Risk Management and Strategy Rhinebeck Bank recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a financial services company, cyber threats are ever present and growing, and the potential exists for a cybersecurity incident disrupting business operations and compromising sensitive data. Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and the potential of cyber threats. Our objective for managing cybersecurity risk is to avoid or minimize the impact of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the Federal Financial Institutions Examination Council Cybersecurity Guidelines, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: First Guaranty Bank's Chief Information Security Officer ("CISO") is primarily responsible for the development, monitoring, and implementation of the Information Security Program. The CISO, through direct interaction with the Chief Information Officer ("CIO"), works to manage cybersecurity risks and provide updates to the Bank Board. The CISO and CIO for First Guaranty Bank have over 30 years of combined cyber security experience and wealth of expertise. The CISO reports quarterly on cybersecurity metrics, key initiatives, and emerging risks that could affect the organization. In accordance with the Graham Leach Bliley Act, the Information Security Program was designed to include administrative, logical, and physical safeguards appropriate for the size and complexity of the organization. First Guaranty's Information Security program recognizes and is in alignment the Federal Financial Institutions Examination Council (FFIEC) standard for cybersecurity risk management and best practices.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: We rely on the cybersecurity policies and procedures implemented by BDT & MSD. BDT & MSD have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of controls, processes, systems, and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting our data. Pursuant to BDT & MSD's Information Security Policy, the BDT &MSD Chief Technology Officer ("CTO") is responsible for the oversight and implementation of the Information Security Policy. At times BDT & MSD may also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: MSD Investment Corp.


text: The SVPF and Director of IT, who has over thirty years of experience in information technology and has both a computer science and information science degree, are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors. We support our information security program with external resources including cybersecurity software providers and advisors as needed.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH


text: We have established an incident response team which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed to perform an impact analysis of security incidents which may have a material affect on the Company, The Audit Committee has responsibility for oversight of information and cybersecurity risks and assessment of cyber threats and defenses, and it oversees management to ensure that the processes designed, implemented, and maintained with respect to such risks are functioning as intended and adapted when necessary to respond to changes in our strategy, as well as emerging risks. Given the importance of information security and cybersecurity to our stakeholders, our Enterprise Risk Management Committee and our Audit Committee review quarterly reports from our CISO regarding the Company's cybersecurity strategies for mitigating known risks, newly identified risks, existing projects, and key performance insights and engage in discussions with management based on such reports and other recent developments.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: Our management team meets with our information technology service provider periodically to discuss then-current cybersecurity issues, which may include efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including threat intelligence and other information obtained from governmental, public or private sources, and external service providers engaged by us; and alerts and reports produced by security tools deployed in the information technology environment including a spear-phishing report.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. Similar to other companies, we have experienced cybersecurity incidents, including temporary service interruptions of third-party suppliers. As of the date of this report, however, known cybersecurity incidents, individually or in aggregate, have not had a material impact on our company. Over the last three years, net expenses incurred from any information security breaches, including any penalties and settlements, are not material relative to our total revenue. For additional discussion on cybersecurity risks we face, see Item 1.A Risk Factors — A breakdown or breach of our information technology systems could subject us to liability or interrupt the operation of our business.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: The Board works with our senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company's cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk. If a significant cybersecurity incident occurs, it will be reported promptly to the Board near the time of discovery.

companyName: MEDIFAST INC

ticker: MED


text: Material Cybersecurity Risks, Threats, and Incidents Our cybersecurity program has been designed to mitigate risks from cyber-attacks. However, even with a strong internal control environment designed to mitigate risks, Hanover is keenly aware that risks cannot be entirely eliminated. Notwithstanding our cybersecurity program's effectiveness, the threat posed by cyber-attacks remains substantial. Additionally, we maintain cybersecurity insurance designed to further reduce residual risk. Nevertheless, due to the continuously shifting and evolving threat landscape and global geopolitical events, a portion of cyber risk remains inherently beyond full mitigation.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: From onboarding and at least annually thereafter, the Company educates and trains its workforce on cybersecurity leading practices using a variety of methods. The Company regularly performs internal and external penetration testing and vulnerability scanning with the support of well-established third-party providers. Any identified deficiencies or vulnerabilities are reviewed by the IT staff and management and remediation steps are taken based on the criticality of the results.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We regularly review the effectiveness of our cybersecurity controls, promptly addressing any identified risk areas and subject our information technology systems to testing performed by external parties on an annual basis. Our employees are required to successfully complete training on topics relating to our cybersecurity, data privacy and information security policies and procedures. Training is administered and tracked through online training modules. In addition, we perform periodic testing to evaluate the effectiveness of our training programs and to help prevent loss associated with the disclosure of electronic information. We also leverage third-party service providers and solutions across our operations to review, test, and assess our security systems and controls, as well as assist in the mitigation of any potential cyber risks. We recently obtained our second ISO 27001 certification.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: As part of our risk management process and compliance with our ISO 27001 cybersecurity certification requirements, we conduct penetration testing, security audits, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems, to undertake data protection and cybersecurity training and compliance programs as part of the employee onboarding process, as well as annually thereafter. In addition to our in-house cybersecurity capabilities, we engage consultants and other third parties as necessary to assist with assessing, identifying, and managing cybersecurity risks. With respect to incident response, we have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides governance and guidance in responding to cybersecurity incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the CIRP aligns with the ISO 27001 standard. The CIRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: FLOWSERVE CORP

ticker: FLS


text: Additional third parties, contracted with by our third-party service providers, also play a role in the Partnership's overall cybersecurity. Our third-party service providers engage with a range of additional third-party service providers and external experts, including cybersecurity assessors, consultants, and auditors, to evaluate and test their risk management systems. These services include, but are not limited to, penetration testing, independent audits, and consulting on best practices to address new challenges, and also include testing both the design and operational effectiveness of our security controls. These engagements enable our service providers to leverage specialized knowledge and insights, ensuring cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Our business relies on computer systems to provide customer information, process customer transactions, communicate, and provide other general information necessary to manage our business. We also rely on a payment card industry- compliant third party to protect our customers' credit card information.

companyName: Waste Connections, Inc.

ticker: WCN


text: Oversight responsibility for information security matters is shared by the Board (primarily through the Audit Committee) and senior management. The Audit Committee oversees the Company's cybersecurity and information security program and receives quarterly updates from senior management on cybersecurity and information security matters. The EDA or key members of our management team update the Audit Committee periodically on the cybersecurity landscape, including the status of cybersecurity threats and the Company's contracts and initiatives related to cybersecurity.

companyName: ESSA Pharma Inc.

ticker: EPIX


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, there is no assurance that cybersecurity threats will not have a material impact on us, including our business strategy, results of operations or financial condition in the future. See Part I – Item 1A – Risk Factors – "We regularly experience cyberattacks and expect they will continue in the future. We may not be able to adequately protect our information systems, including the data we collect, which could subject us to, among other things, liability and damage to our reputation. Our efforts to implement robust security measures and comply with applicable data protection laws are costly and time-consuming and they cannot provide absolute security against cyberattacks, security breaches or unauthorized access."

companyName: WEX Inc.

ticker: WEX


text: As part of our cybersecurity program, we have implemented various strategies and processes to manage cybersecurity risks, which include: • providing training and guidance to our employees on cybersecurity threats and emerging trends, including phishing simulations to increase awareness of potential critical security threats; • obtaining independent and objective assessments by our internal audit department; • annual review of Service Organization Controls ("SOC") reports from our critical third-party vendors based upon a determination of their relative importance and risk level; • implementing preventative and detective security tools; and • using both internal resources and third-party security firms to provide ongoing monitoring of both internal systems as well as activity within third-party environments.

companyName: Five Point Holdings, LLC

ticker: FPH


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Zhuoxun Hongtu Inc.


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," the AGM board of directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the CISO of Athene Holding Ltd., a subsidiary of AGM, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, as well as, as appropriate, with our executive officers and other representatives of the Manager and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our board of directors, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing during the financial year ended December 31, 2024. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such an incident may have a material effect, including on our operations, business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section titled " Risk Factors " in Governance

companyName: Rocky Mountains Group Ltd


text: We employ a risk-based approach to cybersecurity which aligns with corporate strategy, risk management and governance, and adaptable information technology ("IT") infrastructure. Our cybersecurity program consists of policies, procedures, systems, controls and technology designed to help prevent, identify, detect and mitigate cybersecurity risk and is based on the National Institute of Standards and Technology ("NIST") Cybersecurity framework.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The Board of Directors now has formal oversight of risks from cybersecurity threats. At the end of 2024, it is important to note that, as discussed in Part III of this filing, our Board of Directors was comprised solely of Messrs. Danzik, Kitchen and Westbrook. As such, pursuant to the information provided below, all risks from cybersecurity threats our immediately shared with the Board of Directors.

companyName: flooidCX Corp.


text: Senior management team are highly engaged and hands on with all areas of the business operations and are in close contact and communication with the Head of IT and act quickly to implement controls, policy and change within the business where it is communicated by the IT team.

companyName: Pacific Green Technologies Inc.

ticker: PGTK


text: We routinely assess material cybersecurity risks, including potential unauthorized occurrences on, or conducted through, our information systems that may compromise the confidentiality, integrity or availability of those systems or information maintained in them. We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments when there is a material change in our business practices that we believe could affect information systems that are vulnerable to cybersecurity threats. These risk assessments include identifying reasonably foreseeable internal and external risks and the potential harm if the risks were to materialize. We conduct these risk assessments directly and also periodically engage third-party providers to support these processes.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: In order to mitigate data or security incidents that may originate from third-party vendors or suppliers, we conduct both privacy and information security assessments to properly identify, prioritize, assess and remediate any third-party risks, and require information security and privacy addenda to our contracts where applicable.

companyName: Bark, Inc.

ticker: BARK


text: We have also established an Incident Response Team (the "IRT"), which is composed of individuals from our various IT and managerial functions and consults with members of internal departments, as needed, to identify and assess security incidents, including the impact and severity of such incidents. Upon the identification of a security incident, the IRT performs an impact analysis and then determines the appropriate course of action, which may include escalation to the ISSC. Upon consultation with the ISSC and consideration of the relevant risks, the IRT will determine whether the incident should be communicated to the Audit Committee of the Board of Directors.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: As an externally managed company, the Company relies on our Manager's information systems in connection with the Company's day-to-day operations. Consequently, the Company also relies on our Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats undertaken by our Manager. All of the Company's executive officers are executive officers, directors and employees of Bimini.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Our management team is primarily responsible for assessing and managing material risks to the Company from cybersecurity threats. We have a cross-functional cybersecurity team led by our cybersecurity manager and comprised of personnel from our information technology group, including the head of IT, and senior leadership. We have established a robust framework for preventing, identifying, evaluating, and mitigating cybersecurity risks.

companyName: NEOGEN CORP

ticker: NEOG


text: The AIR Operating Partnership's technology team, under the leadership of our Senior Vice President of Technology and Chief Technology Officer, who has over 30 years of technology management experience, defines an annual work plan designed to maintain strong cybersecurity maturity, set improvement objectives of key controls and systems, including feedback from third-party assessments, and identify and implement on-going investments to replace or upgrade systems or technologies and proactively maintain strong security. As part of our annual planning, management conducts regular tabletop testing of our incident response plan to increase awareness, establish key decision-making criteria, ensure effective communication among key stakeholders, and comply with our disclosure obligations. We also partner with third-party experts to assess the effectiveness of our cybersecurity prevention and response systems and processes (e.g., periodic penetration testing and assessments of IT general controls). We also engage vendors to enhance cybersecurity safeguards and improve incident response and updates or replaces systems and applications as appropriate to improve data processing and storage management and enhance security. To further protect our information systems, we structure and monitor our relationships with third-party service providers and periodically conduct due diligence on their cybersecurity architecture and process design.

companyName: Apartment Income REIT, L.P.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition Cybersecurity Governance Board considers cybersecurity risks as part of its risk oversight function of cybersecurity and other information technology risks.

companyName: DIH HOLDING US, INC.


text: The Director Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director Cyber Security leads a team of Cybersecurity Engineers and manages vendor relationships and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering committee, which is comprised of senior executives are kept updated on any material incidents, Cybersecurity initiatives and strategic roadmap.

companyName: Cornerstone Building Brands, Inc.


text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.

companyName: VOC Energy Trust

ticker: VOC


text: Role of Management Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Technology Officer, who is supported by our leaders in Information Technology, Information Security, and IT Security Compliance. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, our Chief Technology Officer and Senior Vice President, Technology - Enterprise IT and Engineering regularly report to our Audit and Finance Committee about cybersecurity threat risks, among other cybersecurity related matters.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, risks from cybersecurity threats. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including service providers, franchisees and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct due diligence on third-party vendors by performing risk assessments and evaluating their compliance with relevant regulations, such as the Service Organization Control reports (SOC1 and SOC2). We also seek to obtain contractual assurance that our vendors will maintain adequate controls, such as adequate security against data breaches.

companyName: POTBELLY CORP

ticker: PBPB


text: Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information. We maintain International Organization for Standardization ("ISO") 27001 certification for most of our business units and core applications and facilities, and, where applicable, align to other industry standards or frameworks, including Cloud Security Alliance's Cloud Controls Matrix ("CSA CCM"), Payment Card Industry Data Security Standard ("PCI DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), and HITRUST Common Security Framework ("HITRUST CSF").

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: The ability to mitigate cybersecurity risks is dependent upon an effective risk assessment process that identifies, measures, controls, and monitors material risks stemming from cybersecurity threats. These threats include any potential unauthorized activities occurring through the Company's information systems that could adversely affect the confidentiality, integrity, or availability of the Company's information systems or the data contained therein. The Company's Information Security Program includes a comprehensive information security risk assessment process that incorporates the following elements: • Identifying threats, measuring risk, defining information security requirements, and implementing controls to reduce risk. • Identifying reasonably foreseeable internal and external threats that may lead to unauthorized disclosure, misuse, alteration, or destruction of sensitive information or information systems. • Assessing the likelihood and potential damage posed by these threats, considering the degree of information sensitivity and the Company's operations, inclusive of substantive changes to people, processes and technology. • Aligning the Information Security Program with the Company's enterprise-wide risk management program, which identifies, measures, mitigates, and monitors risk. • Evaluating the adequacy of policies, procedures, information systems, and other arrangements designed to control identified risks. • Providing input for internal and external auditors and independent third-party engagements, including in relation to third party operated penetration tests. • Exercising risk oversight to conduct appropriate, risk-based due diligence and monitoring to understand risks associated with our third-party vendors and outsourced services.

companyName: WAFD INC

ticker: WAFD


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our current Chief Information Officer (the "CIO"), the Deputy Chief Information Office (the "Deputy CIO") and the Chief Information Security Officer (the "CISO") have primary oversight of material risks from cybersecurity threats. The CIO has decades of professional experience across various engineering, business and management roles. Our Deputy CIO has over 30 years of experience leading implementation of various IT infrastructure and systems, and our CISO has over 20 years of specific cybersecurity experience and is responsible for maintaining compliance with applicable security requirements. They have a combined tenure of over three decades with the Company in various progressive management roles in information systems and technology and information security. They conduct regular meetings with the Audit Committee and the Board to communicate updates on cybersecurity risks, incidents, and mitigation efforts. The CISO and our security staff provide ongoing support to internal operations and oversight to our systems that offer services to our clients within our enterprise network. Our security staff is also augmented through an industry-recognized security operations center where systems are continuously monitored.

companyName: ICF International, Inc.

ticker: ICFI


text: Cybersecurity Governance Cybersecurity, as an important part of the Company's risk management processes, is a critical area of focus for the Company's Board of Directors (the "Board"), which is responsible for oversight of the Company's cybersecurity risk, including the effectiveness of cybersecurity risk management policies and protocols. As part of the Board's oversight, the Board receives periodic reports from the Company's Vice President of Information Technology and other members of the Company's executive management team. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the cybersecurity program, and the emerging threat landscape.

companyName: CROWN CRAFTS INC

ticker: CRWS


text: We operate in the emissions measurement sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. We design and assess our program based on the PCI-DSS, GDPR, and OWASP cybersecurity frameworks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the frameworks as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property.

companyName: Spectaire Holdings Inc.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Cybersecurity Governance Board's Oversight of Risks from Cybersecurity Threats The Board oversees our ERM program, including the review of cybersecurity and IT risks. The Board is also regularly briefed by the Global CIO, with the support of the Global CISO, on our cybersecurity risk management framework and completed, ongoing and planned actions relating managing to cybersecurity risks. These reports also include updates on the status of projects to strengthen our information security systems, recent assessments of the information security program and the emerging threat landscape.

companyName: BRINKS CO

ticker: BCO


text: Morgan Stanley and Company Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by Morgan Stanley's Head of Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact Morgan Stanley and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

companyName: North Haven Net REIT


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, including the CROC. The Incident Response Plan is coordinated through the Director of Information Security and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: HOME BANCORP, INC.

ticker: HBCP


text: The goal of the Information Security Program is to prevent cybersecurity incidents. The Information Security Program aligns to the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The Information Security Policy is designed to address compliance by Pathward and its personnel with applicable laws and regulations. Information security controls are designed to follow the Center for Internet Security ("CIS") controls framework. Policies and program standards that align with CIS and Payment Card Industry Data Security Standard ("PCI-DSS") are also in place.

companyName: PATHWARD FINANCIAL, INC.

ticker: CASH


text: We contract with external firms to assess our cybersecurity controls. We have processes in place to identify and evaluate risks associated with third party vendors and suppliers. In addition, we have systems in place to maintain business continuity and disaster recovery. To date, we have not experienced any material cybersecurity incidents.

companyName: AGENUS INC

ticker: AGEN


text: When we implement significant changes to our information systems, we conduct risk-based security and privacy impact assessments and deploy technical safeguards that are designed to reasonably protect our technology and information systems from cybersecurity threats. We actively monitor and proactively research potential cybersecurity threats to our information systems, and we use what we learned to evolve our security controls over time to mitigate risks posed by such threats.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: However, the Company consistently evaluates risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests these systems according to its cybersecurity policies, standards, processes, and practices. These measures are integrated into the Company's overall risk management system to protect its information systems from cybersecurity threats. The Company also has the option to engage a third-party contractor if a cyber threat arises.

companyName: AG Acquisition Group III, Inc.


text: o our Risk Management and Compliance Committee (the "Risk Committee"), which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk;

companyName: EASTMAN KODAK CO

ticker: KODK


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our cybersecurity risk management approach is informed in part by multiple standards and regulations for cybersecurity and data privacy, including the following: • National Institute of Standards and Technology (NIST) Cybersecurity Framework • NIST 800-171 and Cybersecurity Maturity Model Certification (NIST 800-171 CMMC) • Payment Card Industry Data Security Standard • California Privacy Rights Act • Health Insurance Portability and Accountability Act • Defense Federal Acquisition Regulations Supplement (DFARS)

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Identifying and assessing cybersecurity threats: The Company regularly evaluates its systems and data for potential vulnerabilities and analyzes the evolving cyber threat landscape, to ensure it proactively addresses risks before they materialize. The Company employs monitoring tools that can detect and help respond to cybersecurity threats in real-time.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: Our CISO regularly engages with other members of our executive management team to discuss cyber risk, including the Chief Technology Officer, the Chief Information Officer, and Chief Compliance Officer, among others, as well as the audit committee of our Board. Our executive management team has the appropriate expertise, background, and depth of experience to manage risk arising from cybersecurity threats. Executive management has also participated in cybersecurity tabletop exercises to test our cyber response playbooks.

companyName: Teladoc Health, Inc.

ticker: TDOC


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: The Company's CISO is a Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM), and is certified in Risk and Information Systems Control (CRISC). The CISO reports to the Quality Compliance Management Risk Committee twice per year and also reports to the Board twice per year.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: We continue to work to enhance our capabilities in cloud security and assurance testing, security operations and automation, product security, and enterprise risk management. To combat the evolving cybersecurity risk landscape and the enhanced level of sophistication of cybersecurity threats, management has prioritized five areas of our information security program: global standards and operations, a risk-aware workforce, product security, detection and response, and data governance management. In addition, we maintain cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Dayforce, Inc.

ticker: DAY


text: The Partnership's information technology, communication networks, system applications, accounting and financial reporting platforms and related systems, and those that are offered to residents and tenants, are integral to the operation of the business. The Partnership utilizes these systems, among others, for financial analysis, management, and reporting, for facilitation of operations, including for the initiation, generation, and completion of resident leasing, for internal communications, and for various other aspects of the business.

companyName: NEW ENGLAND REALTY ASSOCIATES LIMITED PARTNERSHIP

ticker: NEN


text: Company has no t encountered any cybersecurity risks or incidents that have materially impacted our business strategy, operational results, or financial condition. We remain dedicated to maintaining a strong cybersecurity position by continually analyzing and improving our security procedures to reduce potential risks. This approach to cybersecurity is critical for protecting sensitive information and guaranteeing the reliability of our business operations.

companyName: Rivulet Entertainment, Inc.

ticker: RIVF


text: Our Management and the Board of Directors provide significant oversight of risks from cybersecurity threats and are informed about and closely monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In May 2022, in furtherance of ensuring appropriate oversight of our cybersecurity and information technology readiness, the Board adopted an amended charter of the Audit Committee which added cybersecurity and information technology readiness as part of the committee's purpose. In addition, the Audit Committee was renamed to the "Audit and Risk Committee" to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer, who reports directly to our Chief Executive Officer, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: We seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Our management team has adopted policies, standards, processes, and practices and implemented controls and procedures that allow us to assess, identify and manage material risks from cybersecurity threats enabling our board of directors to actively oversee the strategic direction, objectives, and effectiveness of our cybersecurity risk management framework. Our processes are integrated into our overall enterprise risk management program, as implemented by management and as overseen by our board of directors. Our board of directors has an important role in risk oversight.

companyName: RESMED INC

ticker: RMD


text: Material Cybersecurity Risks, Threats & Incidents We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents. Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.

companyName: Mondelez International, Inc.

ticker: MDLZ


text: The Bank maintains an Information Security and Cybersecurity Program to support the management of cybersecurity risk as a component of the Bank's Enterprise Risk Management ("ERM") framework. The information security and cybersecurity program is designed to manage risks relating to cybersecurity threats and leverages controls, best practices recommendations, and standards from the Federal Financial Institutions Examination Council ("FFIEC") and the National institute of Standards and Technology ("NIST") Cybersecurity Framework, and standards set by relevant legal and regulatory authorities.

companyName: RBB Bancorp

ticker: RBB


text: Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Financial Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: Information security is a key part of the Company's Enterprise Risk Management ("ERM") program, which is designed to identify and evaluate potentially material risks, the potential impact of these risks on the enterprise, as well as steps to control and mitigate those risks. The Company has established an ERM Committee that meets regularly to evaluate risks and coordinate a consistent approach to risk mitigation across the enterprise, including risks related to cybersecurity. The ERM Committee is comprised of certain members of our cross-functional executive leadership team.

companyName: Weatherford International plc

ticker: WFRD


text: The Company's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.

companyName: Commonwealth Credit Partners BDC I, Inc.


text: Despite robust security measures, we acknowledge the possibility of cyber threats breaching its defenses. To this end, we have policies and plans, that ensures a swift and effective response to cybersecurity incidents. This includes a structured procedure for incident detection, analysis, containment, and recovery, underscored by the Software Engineer for material incident evaluation and communication.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: Should any cybersecurity threat or incident be detected, our IT executives would timely report such threat or incident to the management executive committee and provide regular communications and updates to the executive committee throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and, as necessary, participates in joint meetings with the Audit Committee to discuss these matters.

companyName: Wingstop Inc.

ticker: WING


text: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, "Risk Factors." We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future. Although we maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manner. See "Risks Related to Our Business-Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients."

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party service providers in the normal course of business, including those who have access to our customer and employee data or our systems. Additionally, we assess cybersecurity considerations in the selection and oversight of our third-party service providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: Harbor Custom Development, Inc.


text: Given the complexity and evolving nature of the cybersecurity threat landscape, Hubbell has a dedicated team of internal and external cybersecurity professionals led by Hubbell's Chief Information Security Officer ("CISO") that regularly monitor alerts and meet to discuss threat levels, trends, and remediation. We engage a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity program. The engagement of third parties includes regular audits, threat assessments, and information system penetration tests. We also actively engage with key vendors, industry participants, legal counsel, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures. Hubbell further recognizes risks associated with the use of third-party service providers and has processes to identify material risks related to third parties. We conduct security assessments of third-party providers prior to their engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards. Our monitoring includes periodic assessments by the CISO and a team of cybersecurity professionals. Our cybersecurity risk management program is aligned to the National Institute of Standards and Technology Cyber Security Framework (NIST CSF).

companyName: HUBBELL INC

ticker: HUBB


text: Board of Directors maintains oversight responsibility of risks from cybersecurity threats. This oversight is facilitated primarily through the Audit Committee (the "Committee"), which is responsible for oversight of our information system risk, including cybersecurity threats. The Committee oversees the risk management program designed to implement adequate controls to mitigate cybersecurity risks.

companyName: MAYS J W INC

ticker: MAYS


text: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and has over 20 years of information technology and cybersecurity experience in multiple industries, including financial services and defense. The team comprises security engineers, detection specialists, and business cybersecurity experts. When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.

companyName: TRIMBLE INC.

ticker: TRMB


text: The Chief Information Security Officer ("CISO") heads the cybersecurity program which includes personnel based in several of our global locations. Our CISO brings over 25 years of experience, which includes both consulting and practitioner roles, and maintains the following certifications: Certified Information System Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), and Certified Information Security Manager (CISM). Our CISO reports to our Chief Information Officer, who meets with our Board at least annually to discuss cybersecurity risk and related topics.

companyName: AECOM

ticker: ACM


text: The Sponsor's management, including the Sponsor's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The Sponsor's CCO approves all changes to the cybersecurity policy. The Sponsor relies on its full-service compliance partner to stay updated on all SEC rules and regulations and to recommend changes in the compliance policies when necessary. Management of the Sponsor is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Trust, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Sponsor. The Head of Legal and CCO would receive notifications of a cybersecurity incident that impacts a service provider of the Trust.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor in Item 1A. Risk Factors in this report, titled " We rely on information technology in our operations, and security breaches and other disruptions in our systems could compromise our information and expose us to liability, which would cause our business and reputation to suffer."

companyName: Next Bridge Hydrocarbons, Inc.


text: Cybersecurity Risk Management Personnel Primary responsibility for assessing, monitoring, mitigating and managing our cybersecurity risks rests with our information security organization, currently led by our CTIO. The CTIO has over 25 years of experience leading technology teams in retail and in many highly regulated industries including Healthcare, Pharmaceuticals and Financial Services. Our CTIO supports a skilled information security organization that brings expertise in vulnerability management, incident response, penetration testing, regulatory compliance and other critical information security domains. Our information security team maintains certifications from recognized external security authorities such as ISC2, CompTIA, ISACA, GIAC, SANS, PCI and OffSec. The security program is assessed annually by a reputable third party to provide guidance for continuous improvement.

companyName: NORDSTROM INC


text: In the three most recently completed fiscal years and as of the date of this Annual Report on Form 10-K, we have not experienced any material cybersecurity incidents. Additionally, we do not believe any previous cybersecurity incidents we may have experienced are reasonably likely to materially affect us. This includes cybersecurity incidents resulting in penalties and settlements, of which there were none.

companyName: Vericel Corp

ticker: VCEL


text: Responses to cyberattacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyberattack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyberattack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law and regulation.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Refer to "A cyber-attack or failure of one or more key information technology systems, operational technology systems, networks, processes, associated sites or service providers could have a material adverse impact on our business and reputation" in Item 1A. "Risk Factors" for information regarding material risks from cybersecurity threats that affect us.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors under the heading "Risks Related to Privacy, Data Protection and Cybersecurity," which is incorporated herein by reference.

companyName: Cricut, Inc.

ticker: CRCT


text: We implement ongoing employee cybersecurity awareness programs across the Company. The programs include cybersecurity best practices, phishing simulation exercises and targeted communication campaigns. Mandatory annual cyber awareness employee training developed by a third-party specialist is conducted to enhance management's ability to detect and respond to cyber threats. The online training includes a system for scoring and reporting on the program's efficacy to enable improvements to be made to subsequent training modules.

companyName: Guardion Health Sciences, Inc.


text: The Audit Committee of the Board of Directors is briefed on cybersecurity risks at least once each calendar year and also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. The SVP of IT Security reports quarterly to the Audit Committee and such report addresses overall assessment of the Company's compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, recommendations for changes and/or updates to policies and procedures.

companyName: LifeStance Health Group, Inc.

ticker: LFST


text: Company currently manages its cybersecurity risk through a variety of practices applicable to all users of its information technology and assets, including our officers, directors, contractors, and vendors. These practices include the use of passwords protocols, third party firewalls, antivirus protections, and secure cloud-based data storage. The Company also promotes general security awareness through basic user access controls and regular internal monitoring.

companyName: Cluster Group Holdings Ltd Co

ticker: CLUS


text: The Fund's Senior Management team is regularly informed regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Fund, and/or other comparable SEC regulated investment funds and their managers, including through the receipt of notifications from service providers and reliance on communications with operations, risk management, legal, information technology, and/or compliance personnel of the Investment Adviser.

companyName: John Hancock Comvest Private Income Fund


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, at least annually and more frequently as necessary due to business changes or external changes, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: We also maintain business continuity and disaster recovery plans to ensure operational resilience in the event of a significant cybersecurity incident. These plans are regularly tested and updated based on lessons learned from exercises and actual incidents.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: Cybersecurity and risks related to our information technology and other computer resources are an important focus of our Board of Directors' risk oversight. The Board has created a Cybersecurity Sub Committee of our Audit Committee for oversight of cybersecurity and other information technology risks. Our Cybersecurity Sub Committee of our Audit Committee receives materials on a frequent basis to address the identification and status of information technology cybersecurity risks, and management, including our Chief Technology Officer (CTO), provides periodic updates to our Cybersecurity Sub Committee. The Sub Committee reports to the full Board regarding its activities. The full Board also receives briefings from management on our cyber risk management program.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: Our process for identifying, assessing and managing material risks from cybersecurity threats is part of our broader risk management system and processes. We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our offerings, infrastructure and corporate resources. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits and risk assessments. We also maintain a variety of incident response plans, playbooks and processes that are utilized if and when incidents are detected.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: The Company's information security program is risk-based; the Company and its business units perform business impact assessments and risk assessments on a regular basis to calibrate areas of focus. Cybersecurity risks are evaluated as a part of the broader risk management activities at the Company.

companyName: Graham Holdings Co

ticker: GHC


text: To expedite security policy changes, active threat monitoring, infrastructure enhancements, device management, and endpoint security, the CTO has engaged additional third-party IT consultants.

companyName: Earth Science Tech, Inc.

ticker: ETST


text: Role of Management Through our services agreement with LMC discussed in Item 1, "Business" of this Annual Report on Form 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and at QVC.

companyName: QVC Group, Inc.

ticker: QVCGA


text: Cybersecurity Threat Risks We have not experienced a cybersecurity incident or data breach that has had a material impact on our operations or financial standing.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Our Adviser and Administrator have implemented ongoing processes that are designed to continually identify, assess, manage, monitor and mitigate the dynamic and evolving material risks to us from cybersecurity threats. Our Adviser's and Administrator's resource management, information technology ("IT"), and compliance departments work in conjunction with an independent third-party information technology service provider ("ISP") engaged by our Adviser to manage our information technology strategy. The ISP regularly performs cyber assessments and assist our Adviser and Administrator in monitoring our cyber and information security programs. The ISP proposes recommendations for improvements to our Adviser's Head of Resource Management, Director of IT, and Chief Compliance Officer ("CCO"), which then are considered by other relevant officers of our Adviser and Administrator before implementation.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD