text: We evaluate, and adjust as determined appropriate, our cybersecurity strategies and measures based on the above-noted threat monitoring sources, learnings from periodic incident response tabletop exercises in which members of senior management participate; penetration tests and scanning exercises; and an annual cybersecurity and/or cloud security risk assessment conducted with help from outside experts informed by the National Institute of Standards and Technology Cybersecurity framework. Our IT function also undertakes a specific risk review, assisted in part by independent consultants and other third parties, that is integrated into the overall annual enterprise risk management assessment the board of directors' audit and compliance committee oversees. Our internal audit department incorporates the results from this risk review, and cybersecurity-related enhancements identified through the review, in designing and conducting its IT function audits, in some cases with a third-party firm's assistance.

companyName: KB HOME

ticker: KBH


text: The World Gold Council has an incident response plan ("IRP") which (1) identifies the incident response team and the roles and responsibilities of the team members, (2) details the incident response lifecycle, including preparation, detection, response and recovery, and (3) outlines the internal and external communications plan. The IRP requires any cybersecurity incidents which could impact GLDM to be reported to the Principal Financial and Accounting Officer of the Sponsor.

companyName: World Gold Trust

ticker: GLDM

secItem: Item 1C


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees the Company's risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over fifteen years of experience in activity managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as CCO to the Company since its inception in 2023 and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: KKR FS Income Trust Select


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting and monitoring and detection tools to allow security researchers to assist us in identifying vulnerabilities in our environment before they are exploited by malicious threat actors. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits, and conducting threat and vulnerability assessments. Depending on the environment, we implement and maintain various processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information system and data, including risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our accounting and financial reporting functions, encryption of data, network security controls, access controls, physical security, asset management, systems monitoring, vendor risk management program, employee training, and penetration testing.

companyName: Surrozen, Inc./DE

ticker: SRZN


text: We believe that the risks from cybersecurity threats, including as a result of any previous cybersecurity events, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business, results of operations, cash flows and financial condition.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: We have designed procedures to implement our cybersecurity policy, minimize cybersecurity threats to our clients and conduct reviews to monitor and ensure our policy is observed, properly implemented and amended or updated as necessary, including cybersecurity oversight, periodic risk assessments and external consultant reviews, access restrictions, ongoing training, governance policies and procedures, authentication protocols, secure access measures, and policies for elevating suspicious activities.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider. We use a number of means to assess cyber risks related to our third-party service providers, including conducting due diligence in connection with onboarding new vendors. We also seek to include appropriate security terms in our contracts, where applicable as part of our oversight of third-party providers.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results. As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: Education and Awareness We promote a culture of security awareness among our employees, and our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting the data of members, customers, suppliers, employees, and others, including through our Security Awareness Training Program delivered to new hires and on an annual basis. This training, which includes regular "phishing" exercises, is designed to enhance employee awareness of how to detect, respond to, and report potential cybersecurity threats as well as best behavioral practices to mitigate the risk of becoming subject to a cybersecurity incident.

companyName: Premier, Inc.


text: Our Board of Directors has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CTO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board of Directors. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: Information security risk is systematically reported to our Board of Directors by the Information Technology and Risk Departments through quarterly management reports, ensuring a structured and effective flow of cybersecurity risk information to the Board of Directors. Various committees and working groups are dedicated to monitoring and managing information security risks, including the Cybersecurity Incident Response Team and the Information Technology/Information Security Committee of the Board of Directors. These committees play a pivotal role in establishing and overseeing policies, programs, and guidance that define clear expectations for managing cybersecurity risk.

companyName: BCB BANCORP INC

ticker: BCBP


text: Together with the Board's standing committees, the Company's Board of Directors is responsible for ensuring that material risks, including material cybersecurity risks, are identified and managed appropriately. The Board and its committees regularly review material operational, financial, cybersecurity, compensation and compliance risks with management. For example, the Audit Committee oversees the Company's consultation with outside parties with an expertise in cybersecurity that we engage and retain to review and assess our information security program. The Board also receives regular updates concerning our information security and cyber risk strategy, cyber defense initiatives, cyber event preparedness, and cybersecurity risk assessments.

companyName: RiceBran Technologies

ticker: RIBT


text: Our Board is primarily responsible for overseeing the assessment and management of our risk exposure, including the balance between risk and opportunity and the totality of risk exposure across the organization. The Audit Committee oversees the company's cybersecurity risks and exposures. We operate our security program under a global Information Security Charter approved by the Audit Committee, and the Audit Committee receives security updates and information about cybersecurity risks from the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") at least quarterly. Our Board generally reviews the company's overall risk management program at least annually, including the corporate insurance program which includes our cybersecurity insurance policy. We maintain an Information Security Steering Committee which is composed of key senior leaders who oversee the corporate information security program and our cybersecurity posture. Cybersecurity threats with the possibility of heightened criticality are escalated to a management team comprised of C-level executives and legal department representatives.

companyName: OneSpan Inc.

ticker: OSPN


text: Our Board, with the assistance of our Audit Committee, oversees our cybersecurity efforts performed by senior management, which is responsible for the identification and assessment of materials risk from cybersecurity incidents. In particular, our CISO is responsible for leading the management and assessment of material cybersecurity threats, and works closely with our head of IT, head of IT Operations and General Counsel. Our CISO has over 20 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies and managing information systems and protecting computer networks against cyber intrusions. Also, our IT Operations team meets regularly with the InfoSec and the head of Internal Audit.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: We have established structured processes and mechanisms, including incident reporting and escalation, a comprehensive incident response plan, and communication plans, in the event a vulnerability is exploited or an attack is successful. These communication plans consist of internal reporting and communication, including to the Chief Information Officer and the Chief Information Security Officer, as well as external reporting, including notifying the proper agencies, management, and the Board of Directors. The Chief Information Officer and the Chief Information Security Officer report the risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management. The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on material developments in these areas. For more information on our information technology investments and their effects on our results of operations, refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations – Overview," and for more information regarding risks related to our information technology, refer to "Risk Factors – Risks Related to Our Technology Infrastructure."

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Notwithstanding the Company's cybersecurity-related policies, procedures, and governance framework, the ever-present threat of a cyber-attack, data breach, or other security incident is pervasive. The increasingly sophisticated nature of the tactics used to circumvent IT security safeguards makes cybersecurity threats increasingly difficult to detect and respond to. While the Company does not believe its business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that the Company will not be materially affected by such threats or incidents in the future. Accordingly, the Company will continue to monitor cybersecurity risks and strive to invest in and strengthen its cybersecurity infrastructure.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: We have implemented and maintain a cybersecurity program in alignment with NIST standards and industry best practices. This cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats to (i) our information systems and data, which include critical computer networks, third-party hosted services, communications systems, hardware, and software, and (ii) critical data, including our intellectual property, confidential information that is proprietary, strategic, or competitive in nature, and our customers' data. Core policies within the program include an information security policy, business continuity and disaster recovery policy, incident response policy, cyber supply chain risk management policy, and software development lifecycle policy.

companyName: Everything Blockchain, Inc.

ticker: EBZT


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We conduct initial due diligence on the cybersecurity profile of our vendors as they are onboarded and provide continuous monitoring of critical third-party infrastructure and monitor any known breaches of those third-party systems. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also provide regular, mandatory training for our personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to communicate our evolving information security policies, standards, processes and practices.

companyName: BILL Holdings, Inc.

ticker: BILL


text: The Company is committed to, and recognizes the importance of, information security, cyber readiness, and data privacy protections to our business and reputation, which includes assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program uses processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks.

companyName: VINCE HOLDING CORP.

ticker: VNCE


text: The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: DocGo Inc.

ticker: DCGO


text: we maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: We have not experienced a cybersecurity threat, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition.

companyName: BARNES GROUP INC


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information security team works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Veritone, Inc.

ticker: VERI


text: The UScellular information security program is based on a defense-in-depth approach and aligns with the National Institute of Standards and Technology (NIST) cybersecurity framework. Security control and maturity assessments are conducted periodically leveraging this standard. UScellular also leverages internal and external auditors and consultants to perform independent assessments and tests of security controls. The assessment results are used to drive continuous improvement in the UScellular cybersecurity control environment, as well as to manage potential data security risks of third-party service providers.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: Management Oversight Our CISO is accountable for managing our enterprise information security department and overseeing our information security program. The CISO reports directly to the Chief Risk Officer. The CISO's responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to senior leadership and the Risk Committee and/or Board in a timely manner. The CISO has over 20 years of experience in cybersecurity across the U.S Government, Department of Defense contracting, and financial services industry. Prior to joining the Company, the CISO served as the Deputy CISO for a major domestic financial services institution.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: During the fiscal years ended April 30, 2025 and 2024, we did not identify any cybersecurity incidents that had a material impact on our operations, liquidity, or financial condition. We did observe routine scanning, phishing attempts, and minor technical vulnerabilities, all of which were mitigated without operational disruption or data loss.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: To enhance our current cybersecurity posture, we continue to invest in advanced threat detection technologies, provide cybersecurity training based on the latest trends and guidance to the employees, collaborate with industry partners and regulatory bodies to stay informed about emerging threats, reinforce our cybersecurity incident response plan to align with industry-specific regulations and legal obligations, integrate threat intelligence feeds for automatic detection of any misconfigurations, security threats, and foster a collaborative, cross-functional, and accelerated approach to incident response.

companyName: INNODATA INC

ticker: INOD


text: Our Board of Directors (the "Board") considers cybersecurity risk as critical to the enterprise and manages the cybersecurity risk oversight function through the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: We assess the ability of our key third-party service providers to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: IGM Biosciences, Inc.


text: Our CIO has served in various roles in information technology and information security for over 27 years, including in technology leadership roles such as Chief Information Officer, Vice President Business Technology, Vice President Business Information Services, Senior Director of Mountain Technology, Director of Resort Application Development, and Director of Order Management Systems leadership roles for large public companies. Our CIO holds a B.B.A. in Management Information Systems and Accounting from University of Oklahoma.

companyName: VAIL RESORTS INC

ticker: MTN


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our SVP, Information Technology, as well as our Risk Committee, which includes our Chief Financial Officer, EVP, Business Affairs and General Counsel and Chief Risk Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Hudson Pacific Properties, Inc.

ticker: HPP


text: In addition, a breach may require notification to governmental agencies, the media, or individuals pursuant to applicable data privacy and security laws. We would also be exposed to a risk of loss, negative publicity, harm to our reputation, governmental investigation and/or enforcement actions, claims or litigation and potential liability, which could materially adversely affect our business, results of operations and financial condition.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Monitor Cybersecurity Incidents The Director of Infrastructure is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director of Infrastructure implements and oversees processes for the regulatory monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Digital Brand Media & Marketing Group, Inc.

ticker: DBMM


text: Management Responsibilities Our cybersecurity program is managed by our Information Security Officer (ISO). Our ISO has over six years of cybersecurity experience working in publicly traded companies, with expertise leading risk remediation efforts in vulnerability management, network security, security awareness, threat monitoring, data security and cloud security.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: Our Chief Executive Officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. To strengthen our cybersecurity posture, we engage with external consultants for regular risk assessments, penetration testing, and vulnerability analyses, allowing for proactive identification and mitigation of potential threats. We also rigorously verify the cybersecurity practices of our third-party service providers, vendors, and partners, conducting due diligence before establishing relationships and ongoing monitoring to verify compliance with our cybersecurity standards.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, is responsible for assessing and managing material risks from cybersecurity threats. Lafayette Square's information security policy includes an incident response plan which specifies procedures for elevating, remediating, monitoring and communicating about Cybersecurity Incidents. A dedicated team of executive level leaders at the Adviser (the "Incident Response Team") including the Chief Risk Officer, Chief People Officer, Chief Compliance Officer and led by the Chief Technology Officer ensure Cybersecurity Incident containment, eradication, recovery and notification that is integrated in Lafayette Square's overall risk management. If a Cybersecurity Incident is detected, whether by way of penetration testing, a vulnerability scan conducted by the SOC, or otherwise, it will be reported to the Chief Technology Officer and Chief Compliance Officer who mobilize the Incident Response Team. The Incident Response Team will prepare the communications including alerting the Board of any material risks and any additional required reporting. The Chief Technology Officer is designated as the leader of the Incident Response Team and is designated to interface with key stakeholders including the Board.

companyName: Lafayette Square USA, Inc.


text: Risk Management and Strategy Overview Protecting the information systems, assets, data, and communication infrastructure is critical to the Company's operations. Consequently, cybersecurity is prioritized through the implementation of a comprehensive cybersecurity risk management program that is managed by the executive team leadership in conjunction with the IT Department and falls within the boundaries of the overall organization risk management program.

companyName: i-80 Gold Corp.

ticker: IAUX


text: Everi's Security department, Chief Information Security Officer (CISO), and Chief Information Officer (CIO), with oversight from the CEO, lead the cybersecurity detection and risk reduction and mitigation efforts for the Company. These efforts include, but are not limited to the following: • Monitoring logs and alerts for security issues, events, and breaches; • Preparing and regularly testing Everi's preparedness for attacks, incidents, and breaches, including the use of table-top exercises of simulated cyber incidents with the executive team; • Developing policies and procedures to identify, classify, and define protection and management objectives, and define acceptable use of Company information assets; • Deploying monitoring and data collection tools to monitor the security of devices and processes; • Monitoring and reviewing physical and logical access to Everi data and properties to meet applicable security and regulatory requirements; • Developing and maintaining a vulnerability identification and management program; • Developing and maintaining a security awareness and training program; and • Obtaining System and Organizational Controls Two certifications for products Given the complexity and evolving nature of cybersecurity threats, Everi engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to maintain and enhance our cybersecurity strategies and processes. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Everi Holdings Inc.


text: The Security Director and the Senior Director Infrastructure & IT Operations have primary responsibility for informing the Audit Committee on cybersecurity risks. They provide periodic briefings to the Audit Committee, which may include topics such as updates regarding the cybersecurity threat landscape, the status of ongoing cybersecurity-related initiatives and strategies, and regulatory requirements.

companyName: IROBOT CORP

ticker: IRBTQ


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. Moreover, we remain committed to investing in the development and improvement of our security processes and controls, as well as maintaining our technology infrastructure. These processes include a plan for notifying, informing, consulting, analyzing, and communicating any risks or incidents to a range of internal stakeholders, including executive management and the Board of Directors, as well as external stakeholders, as deemed necessary and appropriate based on the circumstances. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Financial Officer with the responsibility of managing the cybersecurity risk assessment and mitigation process.

companyName: InMed Pharmaceuticals Inc.

ticker: INM


text: We and Oaktree face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition or results of operations. We and Oaktree have experienced, and will continue to experience, cyber incidents in the normal course of its business. However, we are not currently aware of any current or past cyberattacks or other incidents that, individually or in the aggregate, have materially affected, or are reasonably likely to materially affect, our business, financial condition or results of operations. See "Risk Factors – Risks Relating to Our Business and Structure – We may face a breach of our cyber security, which could result in adverse consequences to our operations and exposure of confidential information."

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: While our board of directors has overall responsibility for risk oversight, our Audit Committee assists our board of directors in monitoring cybersecurity risks by receiving regular reports from our CIO, as needed, that cover information such as NIST review outcomes, and actions to address findings and vulnerabilities.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Material Risks & Integrated Overall Risk Management are developing processes, that seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: On at least a quarterly basis, the CISO delivers a detailed report to the full Board — including Board member Erin Nealy Cox — on data protection and cybersecurity matters. Topics covered by these reports include, but are not limited to, risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company's ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives. Ms. Nealy Cox is an independent member of our Board, a cybersecurity expert and a former federal prosecutor with deep expertise in information security issues and board governance. She is a partner at Kirkland & Ellis LLP in its Government, Regulatory and Internal Investigations Group, and was executive managing director at Stroz Friedberg, a cybersecurity and investigation consulting firm, where she ultimately led the firm's incident response business, from 2003-2016. In 2017, she served briefly as senior advisor to McKinsey & Company in the firm's cybersecurity and risk practice.

companyName: Sally Beauty Holdings, Inc.

ticker: SBH


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: The CISO coordinates with senior management, including members of the IRT, to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents or threats in accordance with the Company's incident response procedure. Through ongoing communications between the CISO, IRT and other members of senior management (including the CEO), senior management stays informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports significant threats and incidents to the Audit Committee, when appropriate.

companyName: V2X, Inc.

ticker: VVX


text: Our cybersecurity framework is designed to protect our customers, employees, investors, and our intellectual property. Before purchasing third-party technology or other solutions that could expose the Company's assets and electronic information, our Information Security team completes security reviews on the vendors. Contracts are also negotiated to ensure language is included to address cybersecurity risk limitation and remediation. We also conduct ongoing reviews of cybersecurity risks associated with our third-party service providers. As part of the Company's Vendor Management Program, annual reviews are conducted for certain third-party vendors. Members of our Information Security team work with department managers and application owners to review System and Organization Controls ("SOC") 1 or SOC 2 reports. In the event a third-party vendor is unable to provide either a SOC 1 or SOC 2 report, this group conducts additional reviews to assess the cybersecurity preparedness of the specific vendor. This assessment of the risks associated with the use of third-party service providers is part of our overall vendor management and cybersecurity risk management framework.

companyName: UNION BANKSHARES INC

ticker: UNB


text: In addition, our third-party cybersecurity team play a key role in reviewing and assessing our controls and procedures, including conducting the event of an incident, our third-party cybersecurity team have a designated response team and written response plan in place with predefined escalation and response procedures. We also have processes in place to monitor the cybersecurity risk exposure and security practices of key service providers to assess their cyber preparedness.

companyName: Cyber App Solutions Corp.


text: While we have not experienced any cybersecurity incidents to date, the scope and impact of any future incidents cannot be predicted and there can be no assurance that our cybersecurity risk management program will be effective in preventing material cybersecurity incidents in the future. For additional information, see "Item 1A. Risk Factors—Risks Related to Our Business and Operations—We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Additionally, our failure to comply with applicable privacy, data security or protection or cyber security laws could adversely affect our business" in this Annual Report on Form 10-K.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: Our Chief Financial Officer provides briefings to our Board of Directors and the Audit Committee regarding the Company's cybersecurity risks and activities, including cybersecurity systems testing, activities of third parties, and the like.

companyName: AXT INC

ticker: AXTI


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third party reviews. We rely on industry leading third party service providers to provide the systems required to effectively run our clinical trials and require these third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: Our cybersecurity risk management program includes: • identifying cybersecurity risks that could impact our facilities, third-party vendors/partners, operations, critical systems, information, and broader enterprise information technology environment. Risks are informed by threat intelligence, current and historical adversarial activity, and industry specify threats; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • an Information Security and Cybersecurity policy which establishes administrative, physical, and technical controls and procedures to protect data and systems; • individuals, including employees and external third party service providers, who are responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, monitor, respond or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: TERAWULF INC.

ticker: WULF


text: The executive team members overseeing our cybersecurity program are Magesh Srinivasan, Executive Vice President, Network Operations, and Jake Perlman, Executive Vice President, Software Development & IT. Our Security Operations Center and Security Compliance teams (including Software Development and IT and Network Security Operations) are unified under our Chief Information Security Officer, Greg Temm, to provide a centralized view of our risk posture to prevent vulnerabilities and more effectively manage cybersecurity threats across the enterprise.

companyName: CHARTER COMMUNICATIONS, INC. /MO/

ticker: CHTR


text: Based on an assessment using the previously described risk mitigation strategy, we do not believe there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. See "Our internal computer systems and those of our collaborators, contractors, consultants and other third parties are vulnerable to cyber attacks, cyber intrusions and security breaches, which could not only materially disrupt our business operations and result in the loss of confidential information, but could also damage the integrity of our clinical trials, impact our regulatory filings, compromise our ability to protect our intellectual property, and subject us to regulatory actions that could result in significant fines or other penalties" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: ARVINAS, INC.

ticker: ARVN


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. As part of our overall risk mitigation strategy, the Company maintains cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity incidents or other related breaches. Please refer to Part I, Item 1A "Risk Factors — Risks Related to Our Business" for additional information about our cybersecurity risks.

companyName: Calumet Specialty Products Partners, L.P.


text: Those processes include automated and manual testing of our systems for vulnerabilities as well as monitoring and responding to suspicious activity. We use established cybersecurity risk frameworks to identify, measure and prioritize cybersecurity risks and develop corresponding cybersecurity controls and safeguards, and we have implemented a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents. Leveraging both internal and external resources, we conduct regular reviews and tests, including penetration testing as well as tabletop and red team exercises, to evaluate the effectiveness of our cybersecurity program, enhance our cybersecurity measures, and inform our planning. We periodically engage external auditors and consultants to assess our cybersecurity programs. We also maintain a risk-based approach to identifying and overseeing risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Affirm Holdings, Inc.

ticker: AFRM


text: Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material. The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, Chief Information Security Officer, Chief Accounting Officer and Director of SEC Reporting. Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud. Blackbaud, Inc.

companyName: BLACKBAUD INC

ticker: BLKB


text: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which receives periodic updates from the Company's ERM function, the Company's Executive Director of Information Security & Compliance, other members of management and relevant management committees and councils.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: Our Head of Information Security and Compliance and the InfoSec team are primarily responsible for assessing and managing our material risks from cybersecurity threats. Our Head of Information Security and Compliance has over two decades of experience leading cybersecurity, data privacy and risk management programs for large, multi-national organizations and Fortune 500 companies, and CISSP and CRISC certifications. Our InfoSec management team is comprised of qualified cybersecurity professionals whose collective expertise includes penetration testing, cyber threat intelligence, data privacy, information security, and risk and compliance in the healthcare, financial, and technology industries, with certifications such as CISA, CRISC, CISSP, CCSP, CIPP, GIAC, and OSCP.

companyName: AppLovin Corp

ticker: APP


text: Our cybersecurity risk management processes include, but are not limited to: independent maturity assessments designed to help identify significant cybersecurity risks to our IT environment and systems;

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Impact of Risks from Cybersecurity Threats While we have not been materially impacted by cyber incidents, we have been subject to other intentional cyber incidents from third parties over the last several years, including denial of service attacks which attempt to interrupt service to customers and malicious software attacks on computer systems which attempt to allow unauthorized entrance. We also face risks related to cyber attacks and other security breaches in connection with card transactions that typically involve the transmission of sensitive information regarding our customers through various third parties. Some of these parties have in the past been the target of security breaches and cyber attacks, and because the transactions involve third parties and environments that we do not control or secure, future security breaches or cyber attacks affecting any of these third parties could impact us through no fault of our own, and in some cases we may have exposure and suffer losses for breaches or attacks relating to them. We also rely on numerous other third party service providers to conduct other aspects of our business operations and face similar risks relating to them. While we conduct security assessments on our higher risk third party service providers, we cannot be sure that their information security protocols are sufficient to withstand a cyber attack or other security breach. There can be no assurance that cyber incidents will not occur and they could occur more frequently and on a more significant scale.

companyName: HILLS BANCORPORATION

ticker: HBIA


text: The Company also has several tools and processes in place to actively prevent, detect and manage cybersecurity incidents. This includes: • Vulnerability Management – continuous scanning of the technology environment to identify and remediate potential vulnerabilities. • Attack Surface Management – actively monitor and prevent external attack attempts. • Security Monitoring and Operations – collection and aggregation of security alerts that are reviewed, analyzed and managed by the security operations team. • Threat Intelligence – gathering and analyzing information about current and emerging cyber threats. • Incident Response – incorporating detection and recovery processes, defining roles and responsibilities across the Company, establishing communication protocols and escalation procedures, including performing tabletop exercises. • Disaster Recovery and Business Continuity Plans – covering both technology and business areas globally with annual exercises to validate processes. • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting periodic phishing simulations to test their awareness. We are continuously enhancing our cybersecurity framework in response to the ongoing incidents and threats that we face.

companyName: TAPESTRY, INC.

ticker: TPR


text: The CTO is responsible for managing our information security team to ensure they are assessing and managing cybersecurity risks in accordance with our processes and procedures. Our CTO has approximately 25 years' experience managing enterprise information technology systems.

companyName: SAGA COMMUNICATIONS INC

ticker: SGA


text: After receiving notice of a cybersecurity incident, the IRTC is responsible for investigating the threat to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire IRT is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct of legal and forensic investigations and work with other third-parties who might be engaged to assist in any response and associated publicity.

companyName: CapStar Financial Holdings, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including the CSI Management Team. Certain members of the CSI Management Team are information technology and security professionals, and we also rely on third-party security analysts who have certain certifications related to cybersecurity.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: At this time, the Company does not have formal processes in place for assessing, identifying, and managing material risks from cybersecurity threats. Our approach to cybersecurity is currently informal and primarily reactive, involving basic security measures such as: Basic Security Software: We use standard antivirus and anti-malware software for protection against common threats. Policies: Simple password policies are in place to protect access to our systems.

companyName: Global Innovative Platforms Inc.

ticker: GIPL


text: Our board of directors, in coordination with our audit committee, oversees our management of cybersecurity risk, with the audit committee reviewing and discussing with management matters related to our Cybersecurity Program, including as it relates to financial reporting. The board of directors and audit committee receive periodic reports about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into our enterprise risk management assessment and reported to our Board as needed. We also share the key results of third-party assessments with our board of directors and audit committee.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: Our data breach management policy classifies potential incidents by risk levels, and we typically prioritize our incident mitigation and impact evaluation efforts based on those risk classifications, while focusing on maintaining the resiliency of our systems. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks.

companyName: Bally's Corp

ticker: BALY


text: BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third party service providers. BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors. BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and or the applicable service provider.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, sensitive financial information and personal identifiable information ("Information Systems and Data").

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse its systems or information. The structure of the Company's information security program is designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. In addition, the Company leverages certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. The Chief Information Security Officer and Chief Information Officer, who reports directly to the Director of Corporate Strategy, along with key members of their teams, regularly collaborate with peer banks and industry groups to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: PROSPERITY BANCSHARES INC

ticker: PB


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our security measures, or those maintained on our behalf by CROs, service providers or other third parties, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our or others' information technology, software, services, networks, communications or data is compromised, limited or fails, this could result in significant fines or other liability, interrupt our development programs, harm our reputation, or otherwise adversely affect our business."

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Processes for assessing, identifying and managing material risks from cybersecurity threats The Cybersecurity Program takes into account industry best practices and addresses risks from cybersecurity threats to Morgan Stanley's network, infrastructure, computing environment and the third parties that Morgan Stanley, and its affiliates rely on. Morgan Stanley periodically assesses the design of its cybersecurity controls against the Cyber Risk Institute Cyber Profile, which is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework for Improving Critical Infrastructure Cybersecurity, as well as global cybersecurity regulations, and develops improvements to those controls in response to that assessment. The Cybersecurity Program also includes cybersecurity and information security policies, procedures and technologies that are designed to address regulatory requirements and to protect clients', employees' and Morgan Stanley's own data against unauthorized disclosure, modification and misuse. These policies, procedures and technologies cover a broad range of areas, including: identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.

companyName: Ceres Tactical Commodity L.P.


text: The goals of our enterprise cybersecurity program align with the National Institute of Standards and Technology (NIST) standards, among others. The program includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing system operations. We, or contracted third parties, monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees to complete data security training, and we regularly conduct simulated phishing and cyber-related communications. Incident Response.

companyName: PRECISION OPTICS CORPORATION, INC.

ticker: POCI


text: Our information security team works closely with key stakeholders, including regulators, government agencies, peer institutions, industry groups, and develops and invests in talent and innovative technology to manage cybersecurity risk.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: Our Chief Financial Officer and other members of management have undergone various briefings from our cybersecurity advisory firm to prepare them to effectively assess and manage material risks from cybersecurity threats. Additionally, members of the third-party service providers have cybersecurity experience and/or certifications.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our network systems or infrastructure due to a cybersecurity threat or incident could adversely affect our operations, serviced, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our customers' and partners' proprietary information, which may include personally identifiable information. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction and harm to our relationships with corporate partners. We are currently in the process of implementing a more formalized cybersecurity program.

companyName: Hoth Therapeutics, Inc.

ticker: HOTH


text: We routinely provide education, such as simulated phishing campaigns, to our employees to mitigate material risks from cybersecurity threats. This education includes cybersecurity training for new employees and training modules sent monthly to all employees. We also use various authentication technologies and third-party monitoring to mitigate material risks from cybersecurity threats. We annually retain a third-party vendor to test our information systems security and we annually review information systems security protocols of our vendors that interact with our financial data. We maintain insurance coverage that may, subject to policy terms and conditions, including deductibles, cover particular aspects of cybersecurity risk, such as data breaches, ransomware, social engineering and computer system fraud. However, it is possible such coverage may not fully insure all future costs or losses associated with all types of cybersecurity incidents such as ransomware.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We regularly engage third party assessors and other firms to perform a variety of control testing and other reviews that are required by applicable regulatory requirements (including payment network rules) and industry standards. We also rely on these third party firms for educational opportunities and materials intended to keep our team members, including our CISO, up to date on the latest industry developments and best practices.

companyName: Repay Holdings Corp

ticker: RPAY


text: Processes and systems for identifying and reporting cybersecurity and privacy risks (including emerging cybersecurity and privacy risks) and cybersecurity and privacy risk management deficiencies, and implementation of actions to address these deficiencies; and Processes and systems to integrate cybersecurity and privacy risk management and associated controls with management goals;

companyName: Cano Health, Inc.


text: We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodicly engage third parties to assess the effectiveness of our cybersecurity practices.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: Education and Awareness We have implemented a security awareness and training program designed to educate employees on the importance of information security and to help them identify and respond to potential security incidents. The program includes annual required cybersecurity training for professional employees, role-based cybersecurity training, and a phishing awareness program for all employees.

companyName: nVent Electric plc

ticker: NVT


text: Our Senior Director of Information Technology is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Longboard Pharmaceuticals, Inc.


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Vice President, Corporate Controller.

companyName: NexImmune, Inc.

ticker: NEXI


text: Cross-Functional Collaboration and Coordination: We foster collaboration among various departments, including our information security function, legal team, management, and third-party service providers, to effectively identify, assess, and manage cybersecurity risks.

companyName: Whitestone REIT

ticker: WSR


text: Because of the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage their specialized knowledge and insights, ensuring our cybersecurity strategies and processes are appropriate. Our collaboration with these third parties includes ongoing system penetration testing, regular audits, threat assessments, and consultation on security enhancements.

companyName: HMN FINANCIAL INC


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct the assessment, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.

companyName: BORGWARNER INC

ticker: BWA


text: Risks from cybersecurity threats are assessed with existing controls and residual risk is monitored. We have not experienced any material cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. We cannot provide full assurance that our cybersecurity risk management processes described will be fully implemented, complied with or effective in protecting our systems and information. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See "Part I - Item 1A. Risk Factors – Risks Related to Our Business" in this report for a discussion of risks related to cybersecurity.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: We require all employees to complete quarterly cybersecurity-related training and awareness programs. We review the cybersecurity practices of our vendors who provide goods and/or services that could impact our plant control systems and require contractors with access to our plant control rooms to complete annual cybersecurity-related training. We also require enhanced diligence reviews on all contractors and employees who have access to our plant control systems.

companyName: OGLETHORPE POWER CORP


text: Private keys are generated by the Custodian in key generation ceremonies at secure locations using offline devices that have never been connected to a network. Private keys are generated according to detailed procedures using specialized offline devices and within these secure facilities to mitigate risk of hacks, errors, or other unintended external exposure. Key ceremony processes are highly controlled, require segregation of duties across multiple parties and are reviewed and witnessed by designated oversight personnel. Thorough validations and signoffs are performed to verify the integrity and security of key generation ceremonies.

companyName: UPEXI, INC.

ticker: UPXI


text: Our cybersecurity program is integrated into our overall risk management systems, business continuity and incident response plan. As part of our overall risk management program, we maintain an insurance portfolio with comprehensive cyber coverage. Our Director of Information Technology consults with third - party security advisors and provides input to each of these programs to ensure that material risks from cybersecurity threats are appropriately assessed, identified, and managed.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: Risk management is administered at a management level through a multi-disciplinary Enterprise Risk Committee comprised of members of management, including our CISO. The Enterprise Risk Committee identifies and monitors what we believe to be the key risks currently facing the organization, including cybersecurity risks. A comprehensive presentation regarding our enterprise risk management process and our key risks is presented to the full Board of Directors on an annual basis.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 38 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for five years and previously served as our director of infrastructure management for 12 years. Our CTO reports directly to the Company's Chief Innovation Officer and indirectly to the Company's President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 33 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: The HIT and HIS, in coordination with our management team, which includes our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and General Counsel, work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Through an ongoing process, the HIS monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the HIT, management team, and when appropriate, the Audit Committee.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and we provide ongoing education and training to our employees to understand and recognize cybersecurity risks.

companyName: Loop Media, Inc.

ticker: LTPVQ


text: We rely on a multidisciplinary team (including from our information security function, management, and third party service providers, as described further below) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: Our VP of IT, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, the VP of IT, and our Head of Information Security, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.

companyName: Velo3D, Inc.

ticker: VELO


text: The Company and its business units have not been materially affected by risks from cybersecurity threats, For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, see Item 1A Risk Factors. Governance.

companyName: Graham Holdings Co

ticker: GHC


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools and methodologies designed to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular vulnerability scans, penetration tests and third-party reviews. We rely on third-party service providers to provide the systems required to effectively run our clinical trials and endeavor to require third-party service providers that have access to personal, confidential or proprietary information to implement and maintain cybersecurity practices. Specific controls that are used in appropriate portions of our environment include endpoint threat detection and response, identity and access management, privileged access management, logging and monitoring involving the use of security information and event management, multi-factor authentication, firewalls and intrusion detection and prevention, and vulnerability and patch management. Our cybersecurity risk management processes are integrated into our enterprise risk management program.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: Our Audit Committee is responsible for overseeing risks from cybersecurity threats. At each meeting of the Audit Committee, our CIO provides a report on cybersecurity matters. The Audit Committee's cybersecurity-related oversight includes the following: • Receiving notice of, and providing guidance with respect to, material cybersecurity incidents; • Reviewing our cybersecurity threat landscape, risks and cybersecurity programs and policies; • Overseeing our management and mitigation of cybersecurity risks and potential breach incidents; • Reviewing our technology and information systems strategies and trends that may affect these strategies; • Reviewing reports and key metrics on the Company's cybersecurity and related risk management programs; • Reviewing the progress of major technology-related proposals, plans, projects and architecture decisions to ensure that these projects and decisions support our overall business strategy; and • Reviewing and providing oversight on the Company's crisis preparedness with respect to cybersecurity. During the year ended December 31, 2023, our Audit Committee met four times.

companyName: AVANOS MEDICAL, INC.

ticker: AVNS


text: Cybersecurity incidents, and the adverse publicity that may follow, can have a negative impact on our reputation and our relationship with our customers. For example, our reputation with consumers and other stakeholders and our customer relationships were damaged following the cybersecurity incident in 2017, resulting in a negative impact on our revenue for a period of time. If we experience another material cybersecurity incident or are otherwise unable to demonstrate the security of our systems and the data we maintain and retain the trust of our customers, consumers and data suppliers, we could experience a substantial negative impact on our business.

companyName: EQUIFAX INC

ticker: EFX


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks. However, if exposed to such a risk, we would assess any potential unauthorized attempts to access our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems.

companyName: TOKEN COMMUNITIES LTD.

ticker: TKCM


text: Our CIO, who has 15 years experience in technology, has primary responsibility for assessing and managing material cybersecurity risks, including overseeing and identifying cybersecurity risks associated with our use of third party cybersecurity consultancy firms, and are members of management's IT Steering Committee, which consists of management team members and certain employees who drive alignment on technology and security decisions across the Company. The IT Steering Committee meets monthly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. The IT Steering Committee also considers and makes recommendations to management, the Board of Directors and the Audit Committee on security policies and procedures, security service requirements, and cybersecurity risk mitigation strategies.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: Critical Security Controls security framework. CIS controls are designed based on real-world data about cyber-attacks, to ensure that the measures are effective against current threats. The framework provides a prioritized set of actions, which enables the Company to focus its efforts on the most effective defensive measures first. This prioritization helps in optimizing the use of resources for maximum impact on security. This strategy provides a structured and effective approach to cybersecurity, helping the Company to protect its assets, comply with regulations, manage risks, and improve its overall security posture.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including CFO and CEO. The CFO and CEO work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: AETHLON MEDICAL INC

ticker: AEMD


text: Response to Security Vulnerabilities In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor provided software fixes (patches); • Ensuring that changes to security configurations are documented, approved and tested; • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs; • Updating and monitoring vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities; • Conducting penetration testing and vulnerability assessments as warranted; • Review performance with service providers to ensure that security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider. Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis. Contractually obligating the provider to make us aware of significant cybersecurity related incidents. Coordinating independent security assessments with the provider utilizing our own resources.

companyName: JBG SMITH Properties

ticker: JBGS


text: Our Vice President, Information Technology leads our information security program and team, which is comprised of several members devoted to infrastructure and information systems security and management. Our Vice President, Information Technology has over 20 years of industry experience, including over 15 years at our Company, serving in roles throughout his career such as engineer, infrastructure manager, Director of Information Technology Infrastructure, and Global Director of IT.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: Our CISO meets at least quarterly with the Audit Committee of the Board of Directors to discuss management's ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation, and current developments in the cybersecurity landscape. In turn, the Chair of the Audit Committee provides a readout to the full Board of Directors that includes a summary of the CISO's presentation to enable discussion of cybersecurity risk management at the full board level.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: All new hires are required to complete mandatory cybersecurity awareness training upon joining the Company. Follow-on training is then assigned to all employees on a regular basis. Training assignments reinforce the Company's security and information technology acceptable use policies, while also helping employees identify and properly respond to cybersecurity threats. To help assess and maintain awareness, training is supplemented with simulated phishing e-mails that are sent on a regular basis.

companyName: Janus International Group, Inc.

ticker: JBI


text: The Company has not identified risks from known cybersecurity threats during the year ended December 31, 2023, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Hess Midstream LP

ticker: HESM


text: We conduct cybersecurity risk assessments annually, quarterly and upon certain triggering events. Such risk assessments take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., security incidents that have impacted other companies, industry trends, and recommendations from our IT vendors). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board of Directors and members of senior management.

companyName: VirnetX Holding Corp

ticker: VHC


text: Although the Company has not experienced a cybersecurity incident that materially affected or, to the Company's knowledge, is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, the Company has, from time to time, experienced threats to and breaches of its data and systems. The Company faces risks associated with security breaches through cyber attacks, cyber intrusions, or otherwise, as well as other significant disruptions of its information technology networks and related systems. These risks are described in more detail under Item 1A. Risk Factors.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: The Chief Security and Trust Officer provides regular reports on the status of cybersecurity risks, priorities, and focus areas to our executive leadership team. In addition, information on cybersecurity risks is further integrated into our broader enterprise risk management program through our internal audit function, which incorporates such information in regular audits of our cybersecurity and data protection controls and processes.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We set clear objectives for third-party service providers, and we assess cybersecurity practices and any history of security incidents before engaging any potential service providers. Our contracts explicitly include requirements relating to cybersecurity, including adherence to certain standards, to ensure compliance with our security protocols. Once engaged, we regularly monitor the cybersecurity posture of these providers through surveys and reports, audits, and performance reviews.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: We maintain an incident response plan that includes processes to triage, assess severity for, escalate, contain, investigate and remediate material cybersecurity incidents, as well as to comply with potentially applicable legal obligations. As part of the above processes, we periodically engage with assessors, consultants, auditors, and other third-parties, including by periodically annually having a third-party/an independent Qualified Security Assessor review our cybersecurity program to help identify areas for improvement and/or compliance. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.

companyName: Evolent Health, Inc.

ticker: EVH


text: We embrace a "defense in depth" approach to assess, identify, and manage cybersecurity threats. A defense in depth approach seeks to implement multiple layers of defenses in order to help reduce the risk that a single process or control failure might result in a material incident. We utilize a risk management framework to assess, manage, and report on material risks and threats. In light of the importance of cybersecurity matters, we have developed as part of this framework a risk domain specific to cybersecurity matters, including specifying applicable risk tolerances and metrics. The Executive Vice President, Chief Information Officer (CIO), who has served in information technology leadership roles with the Company since 2007 and has over 20 years of experience with matters related to cybersecurity, including as an executive leader and consultant, and Executive Vice President, Enterprise Risk Management (EVP, ERM), who has served in risk management leadership roles for the Company since 2015, have oversight over information technology and enterprise risk management matters, respectively, and receive monthly reports on cyber-related metrics and activities from their teams. In addition, we have implemented escalation procedures and protocols, including an incident response team that includes key members of management such as the CIO and EVP, ERM, to manage and coordinate responses to potentially significant cybersecurity incidents. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: External Assessments Our cybersecurity policies, standards, processes, and practices are regularly assessed by external auditors and regulatory examiners. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to its clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.

companyName: RENASANT CORP

ticker: RNST


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third parties, to review our cybersecurity program to help identify areas for continued focus, improvement and/or compliance.

companyName: Mechanics Bancorp

ticker: MCHB


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We, our tenants, and our property managers face risks associated with security breaches through cyber-attacks, cyber-intrusions, or otherwise, as well as other significant disruptions of information technology networks and related systems."

companyName: Chiron Real Estate Inc.

ticker: XRN


text: In a highly competitive, regulated industry, where we are responsible for managing and securing confidential information, such as clinical trial results, clinical subject data, patient support program information, collaboration data, trade secrets and other confidential, non-public information, such as company plans and strategies, we recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of such information. Accordingly, the foundation of our cybersecurity program consists of appropriate governance and controls designed to assess, identify, and manage cyber risks, and is considered to be an important part of the Company's broader enterprise risk management program.

companyName: SpringWorks Therapeutics, Inc.


text: Cybersecurity Risk Management and Strategy TMCC's cybersecurity program is designed to identify and assess internal and external cybersecurity threats to and within TMCC's business and operations and to take action aimed at protecting the Company, mitigating and managing cybersecurity risk, and in time of attack, to respond expeditiously to minimize the impact of the attack.

companyName: TOYOTA MOTOR CREDIT CORP


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our CIO, Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization and certain legal functions under the office of the General Counsel, which include subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our CIO has over 30 years of experience in IT and telecommunications and previously held CIO or other IT leadership roles at DISH Network (now EchoStar), CenturyLink, Level 3 Communications and TW Telecom prior to joining Qualcomm. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. This experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Management and Strategy a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have only begun to conduct comprehensive risk assessments, establish an incident response plan, and engage with external cybersecurity consultants for assessments or services. As of the date of this report, we have adopted an incident response plan which governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors. Our Chief Executive Officer has been designated as the lead in implementing our incident response plan.

companyName: MDWerks, Inc.

ticker: MDWK


text: • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. We perform due diligence on vendors, service providers and other third-party users of our systems at initial onboarding and periodically thereafter. We require that third-party service providers have the ability to implement and maintain reasonable and appropriate security measures, consistent with applicable laws, in connection with their work with us, and to promptly report any actual or suspected breach of their security measures that may affect our company. • Security Awareness and Training. Our security awareness program requires that employees and certain contractors complete comprehensive security training upon joining the company and annually thereafter. The training covers critical security topics to ensure our workforce stays informed about top-of-mind security areas, such as phishing. The training helps ensure that our personnel have the knowledge and skills required to protect our digital assets and critical data. In addition, we conduct awareness campaigns on cybersecurity threats as a means to equip our personnel with effective tools to address such threats and to communicate our evolving information security policies, standards, processes and practices.

companyName: TWILIO INC

ticker: TWLO


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Each member of our organization, from facility operators to board members, has a responsibility to safeguard our cybersecurity. Our Chief Information Security Officer (CISO) is responsible for our cybersecurity strategy and execution, while the Board and the Audit Committee are responsible for oversight of our cybersecurity risk.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB