text: The Board, in coordination with the Audit Committee, oversees our overall enterprise risk management ("ERM") process, including the management of risks arising from cybersecurity threats and information security. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. Beginning in 2024, the Audit Committee will be provided updates on our process, procedures, policies and any cybersecurity incidents at least quarterly. In the event of a material incident, or incident that may be determined to be material, the Audit Committee is informed as soon as reasonably practical and provided regular updates by the SIMT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee will have the opportunity to discuss our approach to cybersecurity risk management with the SIMT.

companyName: PubMatic, Inc.

ticker: PUBM


text: The Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Cybersecurity Framework, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these guidelines and frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: ASSOCIATED BANC-CORP

ticker: ASB

secItem: Item 1C


text: CorEnergy's information security program is managed by our President and Chief Financial Officer, whose information technology team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Chief Financial Officer provides periodic reports to our Board, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including the Company's business strategy, results of operations or financial condition.

companyName: CorEnergy Infrastructure Trust, Inc.


text: Executive Experience and Qualifications Our CEO has over thirty (30) years of risk management experience, and our COO with over twenty (20) years of experience including cybersecurity, possess deep expertise in their respective fields, evidenced by their academic qualifications and professional trajectories. This collective experience underpins our robust approach to managing cybersecurity risks. In addition, we have numerous employees with experience and qualifications related to cybersecurity. We have named a Chief Information Security Officer as part our cybersecurity program. Our executive officers are responsible for informing the Board and Governance Committee of any new material cyber events or risks.

companyName: WIDEPOINT CORP

ticker: WYY


text: Companies such as ours face a variety of risks, including financial reporting, legal, credit, liquidity, operational, health, safety and cybersecurity risks. The Board believes an effective risk management system will (1) identify the material risks that we face in a timely manner, (2) communicate necessary information with respect to material risks to senior executives and, as appropriate, to our directors (3) implement or oversee implementation of appropriate and responsive risk management and mitigation strategies consistent with our risk profile, and (4) integrate risk management into our decision-making.

companyName: GeoSolar Technologies, Inc.


text: Service Providers. The Company relies, in part, on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: The Company requires employees to complete periodic mandatory training on cybersecurity threats to equip the Company's personnel with tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our IT systems are accessible by our employees and certain third parties as necessary and appropriate to perform services for or otherwise do business with us. We strictly limit access to our IT systems, including that we use authentication controls and conduct real-time monitoring of access.

companyName: Sylvamo Corp

ticker: SLVM


text: Certifications and Audits We maintain the following ISO certifications related to our information systems: • ISO 22301:2019 (standard for implementing and managing an effective business continuity management system); • ISO/IEC 27001:2013 (security standard for information security management systems, covering our production, quality assurance and implementation environments); • ISO 27701:2019 (standard for establishing, implementing, maintaining and continually improving a privacy information management system); and • ISO 9001:2015 (standard for the implementation of quality management processes).

companyName: Paycom Software, Inc.

ticker: PAYC


text: We have instituted cybersecurity event detection systems, methods, and supporting processes to perform continuous monitoring, identify and classify events and anomalies, take appropriate actions when necessary, and report incidents to the appropriate parties. Our response and recovery capabilities are designed to, among other things, contain any impacts, analyze and mitigate events, track events to resolution, provide effective stakeholder communication, recover and resume operations, and evaluate and improve systems and methods.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks and is updated on any cybersecurity incidents as necessary. The Audit Committee reports on cybersecurity matters to the full Board on a regular basis. Additionally, the full Board regularly receives presentations from management and third-parties on cybersecurity topics as part of the Board's ongoing education on issues that affect public companies.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our Chief Business and Legal Officer and representatives from our security governance steering committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our Chief Business and Legal Officer and representatives from our security governance steering committee provide annual briefings to the board of directors on cybersecurity risks and activities.

companyName: Lexeo Therapeutics, Inc.

ticker: LXEO


text: Our Board of Directors and senior management are actively involved in overseeing our cybersecurity policies and practices and managing those responsible for coordinating and implementing cybersecurity initiatives across the organization.

companyName: INTERLINK ELECTRONICS INC

ticker: LINK


text: Monitor Cybersecurity Incidents The Senior Vice President of Information Technology ("SVP IT") is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The SVP IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we have a well-defined incident response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: We recognize the critical importance of maintaining the trust and confidence of patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SYNLOGIC, INC.

ticker: SYBX


text: The Company's current CIO, Robert Candelmo, has over 38 years of experience in information technology, with 20 of those years in senior leadership positions. Prior to becoming CIO in 2019, he served as the Company's Chief Technology Officer for approximately five years. Before joining the Company, Mr. Candelmo served as Senior Vice President of Enterprise Information Services for a large banking company. Mr. Candelmo has a Bachelor of Science in Computer Science.

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: Our processes also consider cybersecurity risks associated with our use of third-party service providers and business partners, including those in our supply chain and those who have access to our customer and employee data or our information systems. Identified third-party service provider and business partner risks are managed by our cybersecurity risk management program. In addition, cybersecurity and privacy considerations affect the selection and oversight of our third-party service providers and business partners, as well as third-party specific integration plans. Additionally, we generally require those third parties that could introduce significant cybersecurity or data privacy risk to us to agree by contract to comply with applicable data protection laws, and to manage their cybersecurity risks by implementing appropriate technical and organizational measures, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Given the importance of information security to our stakeholders, our Board or the committee of our Board of Directors responsible for assisting the Board of Directors with its oversight of cybersecurity risk receives regular reports from our CISO on cybersecurity-related matters, including the status of projects to strengthen our security systems and to improve our cyber threat readiness, as well as on the existing and emerging cyber threat landscape and our program for managing these security risks. In addition, our CISO has direct access to the chair of the committee of our Board of Directors overseeing cyber-related risks and is expected to keep that committee apprised of any significant developments that may emerge between scheduled meetings that may require the attention of the Board or relevant committee.

companyName: ETSY INC

ticker: ETSY


text: IT team employs advanced monitoring tools to identify and address vulnerabilities promptly. No material cybersecurity incidents were identified in 2024, and our incident response plan effectively addresses and mitigates risks. These processes include detailed documentation, root cause analysis, and continuous updates to our response strategy.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Digital and Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.

companyName: Johnson Controls International plc

ticker: JCI


text: The Audit Committee is informed of risks from cybersecurity threats through regular reports from our CIO and CISO. The Audit Committee actively engages with our CIO and CISO regarding these risks. Depending on the materiality of a risk, the Audit Committee, CIO or CISO may report on such risk to the full Board.

companyName: MKS INC

ticker: MKSI


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner Board Oversight and Management's Responsibilities Board Oversight

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: We recognize the importance of managing cybersecurity threats and risks related to our business, and we have adopted a multi-faceted and proactive strategy to identify, evaluate, address, respond and neutralize cybersecurity threats and attacks. We employ a combination of technical solutions, security policies and procedures, employee training programs, and regular security audits to enhance and fortify our defenses. We utilize advanced monitoring tools and anomaly detection systems to swiftly identify any suspicious activities or deviations from normal operation. Our security infrastructure includes firewalls, intrusion detection systems, encryption protocols, and access controls to protect our systems and data from unauthorized access or malicious attacks. In the event of a security incident, we have established incident response procedures to contain the threat, minimize the impact, and restore normal operations as quickly as possible. We also conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect our information systems that are vulnerable to such cybersecurity threats.

companyName: ALPHA & OMEGA SEMICONDUCTOR Ltd

ticker: AOSL


text: Cybersecurity is a critical component of our risk management program; thus, we have implemented a Cyber and Information Security Program to protect the confidentiality, integrity and availability of our information and information technology environment. Our program aligns with applicable federal and state regulations, industry frameworks such as the Federal Financial Institutions Examination Council ("FFIEC") and best practices from the National Institute of Standards and Technology ("NIST"). The FFIEC framework offers a set of guidelines to help financial institutions effectively manage and mitigate cybersecurity risks. The framework focuses on ensuring the confidentiality, integrity and availability of sensitive information. NIST is part of the U.S. Department of Commerce, which develops cybersecurity standards, guidelines and other resources.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: We have processes in place to manage and mitigate risks associated with the use of third-party service providers., including, but not limited to conducting due diligence before onboarding new service providers and continuously monitoring their compliance with our security standards.

companyName: Powerfleet, Inc.

ticker: AIOT


text: To help identify, assess, and manage risks from cybersecurity threats, we have integrated cybersecurity risk management into our broader, Company-wide enterprise risk management (ERM) evaluation and strategy process, which is led by our executive officers, overseen by the Audit Committee of the Board, and reviewed annually by the full Board. Our ERM process takes a top-down, enterprise view of material risks impacting our Company, including credit, liquidity, strategy, cybersecurity, and operational risks, and is an ongoing process consisting of risk identification, risk rating, analysis and action plans, and reporting and monitoring. Employees responsible for assessing identified risks deliver an update quarterly to our senior leadership team, which consists of our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Information Officer, General Counsel, Chief Human Resources Officer, Chief Growth Officer, and Vice President of Supply Chain. Status updates with respect to these risk areas are delivered quarterly by management to the Audit Committee of the Board, and full risk assessment results are presented by management annually to the full Board.

companyName: TopBuild Corp

ticker: BLD


text: As discussed in more detail under the heading "Governance" below, the Board of Directors' oversight of cybersecurity risk management is supported by the Audit Committee, our Vice President ("VP") of Global Technology, and other members of management.

companyName: Champion Homes, Inc.

ticker: SKY


text: The pace of change in approaches undertaken by cyber criminals requires that we strive for continuous improvement and constant monitoring of the broader landscape. In 2024 we adopted the cybersecurity framework of the National Institute of Standards and Technology ("NIST"), and worked to assess our adoption of the NIST cybersecurity framework against a group of peers. We believe that continued evaluation by external experts is the best means to ensure both the design and operational effectiveness of our cybersecurity policies, internal controls, and standards. Furthermore, these periodic reviews are critical to evaluate that we have the right people, technology, and processes to identify, prevent, and detect the activities of bad actors who desire to challenge the system continuity and functionality of the information technology we depend on to operate our business. In addition to our prevention efforts, we also prepare for criminal infiltration through the evaluation of our incident response plan including table top exercises, which helps us assess our ability to react timely and effectively to various degrees of cybersecurity incidents. We believe our plan is well-designed and capable to manage an unforeseen breach including the eradication of the infiltrator from our networks. We carry cyber insurance to transfer the residual risk of an incident. We also work with our cyber insurance carrier to regularly refine our response procedures, which include the definition of internal and external communications channels to key stakeholders, as well as the identification of material breaches and the associated incident reporting up to senior management and our Board of Directors.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: We also maintain a variety of incident response plans that are utilized when incidents are detected. We conduct periodic tabletop exercises, in which different internal and external stakeholders, including from time to time our CEO, Non-Executive Chair, or Board of Directors, participate in a simulated cyber scenario. The purpose of these exercises is to test our cyber incident response plan, identify weaknesses or gaps, and ensure that all participants are aware of, and familiar with, their roles and responsibilities.

companyName: FOOT LOCKER, INC.


text: As any new threat to security may be identified, our personnel are notified, with instruction to increase awareness of the threat and how to react if such a threat or actual breach appears to be encountered. Periodic educational notices are also disseminated to all personnel. Additionally, as our systems are modified and upgraded, all personnel are notified, with instruction as appropriate. Responsibility for the identification and assessment of risks and the recommendation of upgrades to our systems resides with our expert consultants who report to our Interim Chief Executive Officer.

companyName: enCore Energy Corp.

ticker: EU


text: With respect to third party service providers, Cheniere's information security program includes conducting risk-based due diligence of certain service providers' information security programs prior to onboarding. Cheniere strives to contractually require third party service providers with access to its information technology systems, sensitive business data or personal information to maintain reasonable security controls and restrict their ability to use Cheniere's data, including personal information, for purposes other than to provide services to them, except as required by applicable law. Cheniere also seeks to negotiate contractual requirements which compel its service providers to notify them of information security incidents occurring on their systems which may affect Cheniere's systems or data, including personal information.

companyName: Sabine Pass Liquefaction, LLC


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees or customers violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We expect the third-party vendors that provide our IT services to use various tools and methodologies to manage cybersecurity risk and to monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We expect to require third-party service providers with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Marker Therapeutics, Inc.

ticker: MRKR


text: The Company has systems and processes for identification, assessment, and management of material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company's multi-faceted approach includes deploying applications and control activities to actively monitor and mitigate potential threats to the Company's IT environment.

companyName: TREX CO INC

ticker: TREX


text: As detailed above, Voya Financial's CISO and the information security team regularly assess and manage cybersecurity risks. Voya Financial's information security leadership team has extensive information technology and information security experience, and the full team comprises over 100 employees with over 150 certifications from leading information security certification organizations. The CISO, who oversees the organization supporting the day-to-day operations of our information security program, brings over 30 years of professional IT experience in financial services. Before assuming his current role, the CISO served as Voya Financial's Chief Technology Officer, where he was responsible for our infrastructure, cloud, and business resiliency office. Additional management of cybersecurity risks is conducted by Voya Financial's Technology and Operational Risk Committee ("TORC"), which has been delegated authority by Voya Financial's Management Risk Committee to provide oversight of operational risk, including information and technology risk, as well as related legal, compliance and regulatory risks. Members of the TORC include senior management with relevant expertise in operations, technology, information security, legal, compliance, data privacy and operational risk management. The information security team participates in the TORC meetings to discuss cybersecurity risks and mitigation treatment. The TORC provides guidance and direction in assessing, addressing, mitigating and monitoring cybersecurity risks within Voya Financial.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: A comprehensive and layered auditing approach including people, processes and technology components is executed by our internal audit program in order to evaluate the effectiveness of existing controls and ensure that cybersecurity risk has been adequately mitigated within our institution. Periodic phishing tests, network and application security reviews, third-party vulnerability assessments and penetration testing are used to gauge the overall effectiveness of our cybersecurity defenses.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Our Board of Directors, through its Audit Committee, is responsible for overseeing our cybersecurity risk management. On a regular basis, the Board of Directors or Audit Committee receive and review reports from the CDTO and CISO relating to the status of cybersecurity planning and protections, the overall state of our cybersecurity program, emerging cybersecurity developments and threats, and our strategy to mitigate cybersecurity risks.

companyName: AAR CORP

ticker: AIR


text: As of October 31, 2024, we are not aware of any cybersecurity incidents that have materially impacted, or are reasonably likely to materially impact, our operations or financial condition.

companyName: GREIF, INC

ticker: GEF


text: Impacts of Cybersecurity Threats To date, there have been no cyber security threats or incidents that have materially impacted our operations or financial condition. However, as a result of risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we continue to allocate substantial resources to sustain and enhance our cyber security capabilities, which allocation of resources has in turn materially affected our business strategy and processes. Despite these investments, we cannot be certain that the protective measures and processes implemented will be successful or adequate to counter all current and emerging risks and threats. A significant cybersecurity incident involving our systems and data, or those of our customers, business partners or vendors, could have a materially adverse effect on our business strategy, results of operations and financial condition.

companyName: FUELCELL ENERGY INC

ticker: FCEL


text: Our management team, including our CISO, Chief Financial Officer, and General Counsel, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a combined 30 years of experience in cybersecurity and risk management. Our CISO holds the CRISC, CISA, CDPSE, and PMP industry certifications.

companyName: iHeartMedia, Inc.

ticker: IHRT


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of the Company's board of directors and the Company's board of directors, both the audit committee and board of directors regularly interact with, and receive reports from, management of the Company, the Adviser, Apollo, and other service providers. The audit committee of the Company's board of directors and the Company's board of directors receive presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Apollo's peers and third parties. Additionally, Apollo and other service providers periodically report to management as it relates to the Company's cybersecurity practices.

companyName: Apollo Realty Income Solutions, Inc.


text: We require each third-party infrastructure and applications service provider that has access to our system to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: We engage third party services in connection with our cybersecurity risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. Our managed information technology service provider monitors and alerts us of cybersecurity threats and potential breaches. Our managed information technology service provider has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: Abbott's cybersecurity program also aims to identify and assess cybersecurity risks associated with its use of third party service providers with access to Abbott's systems and data, as well as such third party service providers' adherence to certain cybersecurity standards and processes. As appropriate, Abbott requires such third party service providers to agree to be subject to cybersecurity evaluations by Abbott.

companyName: ABBOTT LABORATORIES

ticker: ABT


text: Management and Strategy recognize the importance of managing the material risks of cybersecurity threats, and we have implemented processes for identifying and assessing cybersecurity risks and incidents. Senior management oversees and works closely with our IT department to continuously review and evaluate cybersecurity risks in alignment with our business goals and needs.

companyName: MARIZYME, INC.

ticker: MRZM


text: As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity incidents.

companyName: CORPAY, INC.

ticker: CPAY


text: The Company's Board and management recognize the importance of maintaining the trust and confidence of our customers, clients, business partners and employees, and that effective risk oversight is critical in running a successful business and fulfilling its fiduciary responsibilities to the company and its shareholders. Our Board is responsible for assuring that an appropriate culture of risk management exists within the Company and for setting the right "tone at the top." The Board oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance shareholder value.

companyName: BADGER METER INC

ticker: BMI


text: Our Chief Information Officer (CIO) oversees our information systems and cybersecurity function and reports to our Chief Executive Officer (CEO). He has over 20 years of experience in leading information systems management, strategy, and operational execution, including incident prevention, management, and response. Our Company's Chief Information Security Officer (CISO) is responsible for developing and implementing our information security program and reports to our CIO. The CISO has over 25 years of experience supporting cybersecurity and information technology. They are supported by a direct and cross-functional team of professionals with expertise and experience in threat assessment and detection, mitigation strategies, incident response, training, and regulatory compliance.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Oversight of Global Technology. including J.P. Morgan's technology risk framework, comes from the Chief Information Officer and the Global Technology Operating Committee.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Our CIO has primary management responsibility for ACV's cybersecurity. He has over twenty- five years of experience working in information technology, with the last fifteen years in senior leadership and delivery roles in large, geographically spread corporate technology settings. Pursuant to our Cybersecurity Incident Response Plan ("CIRP"), which governs ACV's responses to cybersecurity events and is designed to align with industry practices, when a cybersecurity event has been identified, it is assessed by our Cybersecurity Department based on a threat detection and response analysis to determine whether the event is a cybersecurity incident. Events that do not meet the standard of incident are resolved and closed out by the Cybersecurity Department in our cybersecurity event management system.

companyName: ACV Auctions Inc.

ticker: ACVA


text: We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Vice President of Information Technology and Director of Risk Management to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Cybersecurity Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. In general, our Board of Directors oversees risk management activities designed and implemented by our management. Our Board of Directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our Board of Directors has authorized our audit committee to oversee risks from cybersecurity threats.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has more than 20 years of professional IT management experience and maintains a Global Information Assurance Certification. The Director of IT reports to our VP of Finance, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our VP of Finance meets with the audit committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could negatively impact the confidentiality, integrity, or availability of our information systems or the information held on such systems. These processes include controls, procedures, systems and tools that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. Such processes are set forth in our joint Cybersecurity Policy and Disaster Recovery Plan (collectively, the "Cybersecurity Policy"). The Cybersecurity Policy sets forth the role of the Information Security Committee in preparing, implementing, and maintaining incident response procedures in consultation with senior management of the Adviser and Administrator.

companyName: Runway Growth Finance Corp.

ticker: RWAY


text: Also, in the event of a cybersecurity threat or cybersecurity incident, the Company's cybersecurity management team will conduct an investigation and impact analysis and, as necessary, the CTO will activate the Company's Cyber Incident Response Team. The Cyber Incident Response Team is a subset of the Company's Crisis Response Team, which has responsibility for operational and business resilience, as well as tactical and strategic response. A foundational aspect of the Crisis Response Team is prompt and comprehensive communications to all concerned parties, both internal and external, including direction for management to inform the Board about risks from cybersecurity threats.

companyName: UNITIL CORP

ticker: UTL


text: We consider cyber risks among the top risks for us within our enterprise risk management framework. This framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, and that are required to be reported in this Form 10-K. We do not believe we have experienced any risks from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, our business strategy or our results of operations or financial condition, including for any of the three years ended July 31, 2024, 2023 or 2022. For further discussion of the risks associated with cybersecurity incidents, refer to the cybersecurity risk factors in Item 1A, "Risk Factors" in this Form 10-K.

companyName: DONALDSON Co INC

ticker: DCI


text: Our risk management program also assesses third party risks, and we perform third-party risk management assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors. CITIZENS, INC.

companyName: CITIZENS, INC.

ticker: CIA


text: Additionally, as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. As reflected in its charter, the Audit Committee is required to periodically review and receive reports from management regarding risks and exposures related to information technology and cyber security.

companyName: Li-Cycle Holdings Corp.


text: As a technology vendor within hosted services segment, Crexendo understands the importance of cybersecurity and data privacy. To proactively protect against related threats, and to be fully prepared for timely and effective response in case of an incident, a comprehensive program has been put in place leveraging the following:

companyName: Crexendo, Inc.

ticker: CXDO


text: Cybersecurity requires ongoing investment and diligence against evolving threats and in the context of new or developing technologies. For further information regarding the risks we face from cybersecurity threats and how our business strategy, results of operations, and financial condition could be materially affected by such risks, see Part I Item IA. "Risk Factors" under the heading, "Privacy and information security laws are complex ".

companyName: DAVITA INC.

ticker: DVA


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct basic security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the System and Organization Controls (SOC) reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's incident response team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.

companyName: ZYNEX INC

ticker: ZYXIQ


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: The Audit Committee of the Board provides strategic oversight of Aquestive's cybersecurity matters, including risks associated with cybersecurity threats. The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: risk review of certain third-party service providers, including software vendors, third-party cloud services, and third-party hosting services, with ongoing risk monitoring for critical vendors through an external cybersecurity intelligence service;

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Reporting to Board of Directors The DIT, in his capacity, regularly informs the Chief Financial Officer (CFO) and Chief Executive Officer (CEO) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, any significant cybersecurity matters, and strategic risk management decisions would be escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: HMN FINANCIAL INC


text: Our Incident Response Plan ("IRP") has evolved with our cyber environment and consists of a set of state-of-the-art-tools capable of monitoring, reporting and alerting, as well as regular reviews. The IRP also sets forth guidelines on how to triage, assess the severity and materiality of findings, and remediate and escalate findings to upper management in a timely manner, as necessary. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. However, such insurance may not be sufficient to cover us against all possible claims related to security breaches, cyber-attacks and other related breaches. Our current environment contains no known risks from cybersecurity threats that could materially impact our business operations, financials, or public reputation.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: The CISO also reports to the full Board on the Company's information security program at least annually, facilitates Board tabletop exercises on cybersecurity, discusses any changes in the Company's cyber risk profile, and provides Board training on a periodic basis with third-party cybersecurity experts. Moreover, consistent with our Incident Response plan, the Risk Committee and the Board are to be apprised of significant cybersecurity incidents.

companyName: SYNOVUS FINANCIAL CORP

ticker: SNV


text: The underlying processes and controls of cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Orchestra has an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, the Company, in conjunction with the third-party cyber risk management specialists, develops a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee at least annually regarding cybersecurity risks, as well as plans and strategies to mitigate those risks.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: We maintain policies regarding our information security practices, including an incident response plan to coordinate response and mitigation efforts in the event we experience a cybersecurity incident. These policies require notification of cybersecurity incidents to our information security team, and if warranted based on the perceived level of severity of the incident, to members of our executive leadership. We have not identified any cybersecurity incidents or threats that have materially affected us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and security incidents that could affect our information or systems. For more information, please consult "ITEM 1A. RISK FACTORS."

companyName: AlTi Global, Inc.

ticker: ALTI


text: Our CTO and Director of Information Security are responsible for oversight of the Company's cybersecurity program, implementation and compliance of our information security standards, and mitigation of information security-related risks. Our CTO, with 37 years of IT experience and an undergraduate degree in Computer and Information Science, has served in his current role for four years and previously served as our Director of Infrastructure Management for 12 years. Our CTO reports to the Company's Chief Innovation Officer and President of ArcBest Technologies, who directly reports to the Chief Executive Officer. Our Director of Information Security, reports to our CTO, has 32 years of IT experience, including over 20 years in information security; a Master of Business Administration; an undergraduate degree in Computer Information Systems and Quantitative Analysis; and is a Certified Information Systems Security Professional.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: The Company has a process to prioritize and manage security related projects. The ISSB provides oversight of program changes, security awareness updates, exposures from new exploits, and risks to information, data and systems. Policies and standards are regularly reviewed within the Governance Model and presented to the Board.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties. Findings are actioned on throughout the year and reported to various committees. The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center. PART I: ITEM 1A., ITEM 1B., AND ITEM 1C.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: We have an internal cybersecurity risk management team consisting of our cybersecurity operations team, cybersecurity engineering team and data privacy and data security team, all reporting to our Chief Information Security Officer ("CISO"). This team is responsible for overseeing cybersecurity threats and assessing and managing material risks from cybersecurity threats.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: The Audit Committee oversees major enterprise risks and the steps management has taken to monitor and control such exposure, including risks to our information technology infrastructure and security. Members of our legal, compliance, enterprise risk management and information security management teams provide information and updates on any significant issues related to these topics at the periodic Audit Committee meetings, which are typically held at least quarterly. The Audit Committee is responsible for ensuring independent examination of management's programs to identify, assess, respond to and monitor risks, which include those performed by internal audit and third party consultants, among others.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, and is responsible for oversight and management of our cybersecurity risk management program. Our management team receives briefings from our internal Information Security team and the Disclosure Committee whenever applicable. Such briefings include information regarding threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. Our management team also provides quarterly cybersecurity risk management program updates, to the Board of Directors or to the Audit Committee, in alternating quarters.

companyName: CADENCE DESIGN SYSTEMS INC

ticker: CDNS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition.

companyName: InvenTrust Properties Corp.

ticker: IVT


text: Cybersecurity risk management practices are ultimately led by our CSO, who has tenured experience in the cybersecurity field and is recognized within the industry. The CSO is supported by personnel across the Security organization in assessing, monitoring, and managing cybersecurity risks. Security personnel have relevant experience and credentials to perform their associated risk management responsibilities, and with the help of these individuals and teams, the CSO oversees governance programs, confirms compliance with relevant security requirements, manages known risks, and educates the company on cybersecurity.

companyName: HashiCorp, Inc.


text: As required by Item 106 of Regulation S-K, the following sets forth information regarding our cybersecurity strategy, risk management and governance.

companyName: CATERPILLAR INC

ticker: CAT


text: Certain of our manufacturing sites are certified to ISO 27001 (an international standard focused on information security), and we continue to perform assessments of our A&D sites and systems that support A&D data under U.S. NIST 800-171 Enhanced Cybersecurity Measures for Government Contractors.

companyName: CELESTICA INC

ticker: CLS


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Viewbix Inc.

ticker: VBIX


text: Our Board of Directors has overall responsibility for risk oversight, and has delegated the responsibility of cybersecurity and other information technology related risks to the Audit Committee of the Board of Directors, which oversees the implementation and continuous improvement of our comprehensive cybersecurity risk management program and compliance with disclosure requirements. The Audit Committee is provided with information, results of internal and external assessments, and updates on cybersecurity initiatives at Audit Committee meetings from our Chief Information Officer, and is responsible for reporting any findings and recommendations to the Board of Directors for consideration. Our team of cybersecurity professionals is led by our Chief Information Officer, a seasoned technology executive with over 20 years of experience in the cybersecurity field, a strong focus on systems and security, and a proven track record of leading cyber experts to protect organization from evolving threats. The cybersecurity team has the primary responsibility for AerSale's comprehensive cybersecurity risk management program, and supervises internal personnel as well as external cybersecurity consultants. Our processes are designed to prevent and monitor cybersecurity incidents, allowing us to timely detect and respond to incidents through our cybersecurity response plan, which includes materiality evaluations based on the size and scope of the incident. This evaluation is documented in an incident report that is shared with the Chief Information Officer, Chief Financial Officer and Audit Committee to effectively manage resources to reduce risk and prevent future incidents.

companyName: AerSale Corp

ticker: ASLE


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information assets and information security program, including to conduct risk assessments and penetration testing. The Company uses a variety of processes to address cybersecurity threats associated with third parties, including our use of third-party technology and services, such as conducting risk assessments and reviewing contractual requirements where the Company has determined it to be appropriate.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: In the event of a material cybersecurity incident, the cybersecurity risk supervisory divisions are to immediately report it to Honda's Risk Management Officer. Upon receiving the report, a Global Emergency Headquarters will be established, which coordinate with relevant organizations affected by the incident in order to prevent and contain the crisis. Such response status is reported to Honda's Board of Directors and the Executive Council as necessary based on the judgment of the Risk Management Officer.

companyName: AMERICAN HONDA FINANCE CORP


text: The AVP of Cybersecurity works directly with the CIO to create and maintain cyber policies, standards, and processes that support the Company's overall strategy and the current cyber environment. We believe our cybersecurity program and policies are aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The AVP of Cybersecurity and CIO are experienced technology and cybersecurity professionals, with over 10 and 20 years of experience in information security and technology, respectively. The AVP of Cybersecurity leads periodic meetings of our chartered Cybersecurity Steering Committee, which cover key cyber threats, policy changes, and project updates. The Cybersecurity Steering Committee includes our CIO, other executive-level leaders, and key members of management. Further, the Cybersecurity Steering Committee engages an external expert to prepare a formalized evaluation on the design of, and adherence to, the Company's current cybersecurity policies.

companyName: Aveanna Healthcare Holdings, Inc.

ticker: AVAH


text: The Company mitigates risks from cybersecurity incidents using a multifaceted approach which includes but is not limited to: establishing information security policies, implementing information protection processes and technologies, assessing cybersecurity risk, implementing cybersecurity training, monitoring our information technology systems, and collaborating with public and private organizations on best practices. The Company is currently in material compliance with relevant information privacy and cybersecurity governmental standards with which it is required to comply.

companyName: DT Midstream, Inc.

ticker: DTM


text: Our team of cybersecurity professionals is led by Agenus' Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: Our Audit Committee is responsible for the oversight of risks from cybersecurity threats and provides regular reports to the entire Board. In addition, at least annually, the entire Board receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Board generally receives materials indicating current and emerging material cybersecurity threat risks and describing the company's ability to mitigate those risks, and discusses such matters with our CIO and CISO. Material cybersecurity threat risks are also considered during separate Board meeting discussions of overall key enterprise risks, operational budgeting, crisis management planning, and other relevant matters.

companyName: Fortive Corp

ticker: FTV


text: The Company understands that security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Company is focused on addressing cybersecurity risks on confidentiality, integrity, and the availability of the information the Company collects, transmits and stores by identifying, preventing, and mitigating cybersecurity risks. The Board of Directors, through the Board Risk and Audit Committees, and the Company's Enterprise Risk Management Committee provide direction and oversight of the enterprise-wide risk management program of the Company, which includes the Information Security Program. The Chief Information Officer and the Chief Risk Officer oversee these programs to accomplish the following: • assure the confidentiality, integrity and availability of our information and information systems; • protect against any anticipated threats or hazards to the confidentiality, integrity or availability of such information and information systems; and • protect against unauthorized access to or use of such information or information systems that could result in substantial harm or inconvenience to us, our clients and the value of the Company.

companyName: CIVISTA BANCSHARES, INC.

ticker: CIVB


text: Our risk oversight activities, including those related to cybersecurity, are supported by internal reporting structures. These structures include protocols in the event of an incident, including the escalation by the cybersecurity team through its reporting structure to the executive team, our Disclosure Controls Committee, our risk council made up of members of our senior management supported by subject matter experts within our organization that administers our ERM program, our Nominating and Governance Committee and the Board, depending on the level of the threat or incident.

companyName: Cable One, Inc.

ticker: CABO


text: We encrypt sensitive client information both during transmission and at rest using industry standard protocols. We also have a mature application security program that promotes security champions within the developer community to instill strong, secure coding practices for reducing vulnerabilities and delivering a secure web application.

companyName: Paylocity Holding Corp

ticker: PCTY


text: The Company employs enterprise security systems as the backbone of a defense in depth (DiD) strategy, such as patch management, intrusion detection, and network segmentation. A managed detection and response (MDR) solution from a world-class security company unifies our antivirus/malware (NGAV), endpoint detection and response (EDR), cyber threat intelligence, managed threat hunting capabilities, and security hygiene.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example using professional services firms, threat intelligence service providers, managed cybersecurity service providers, penetration testing firms and forensic investigators. We also have a public bug bounty program.

companyName: NETGEAR, INC.

ticker: NTGR


text: Management and Strategy We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Cyber Risks Related to Third Parties Risks from cybersecurity threats associated with its use of third-party service providers are addressed as part of the information security risk and third-party risk domains, and their management is integrated into the ERM Framework.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: CommScope has implemented a cybersecurity program that is dedicated to protecting our business processes, technology assets and sensitive information entrusted to us by our customers, suppliers, employees and other stakeholders. Drawing on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and Center for Internet Security (CIS) 18 Critical Security Controls, our security program seeks to identify high-value enterprise assets and business processes and manage the cybersecurity threats facing them with layered controls. We practice a "Defense in Depth" methodology, meaning that valuable assets or business processes are generally protected with more than one layered control.

companyName: Vistance Networks, Inc.

ticker: VISN


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the Director of Operations & Administration, who reports to the Chief Executive Officer, or CEO, and has experience in identity and access management, escalation and incident response, and risk management. The Director of Operations & Administration is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Landos Biopharma, Inc.


text: Our CIO holds a graduate degree in Business Administration and has more than 23 years of experience across technology roles, including the past three years overseeing cybersecurity programs. Our Vice President of Information Security holds a bachelor's degree in Information Systems Security and brings over 15 years of experience in cybersecurity leadership roles. Our CEO, Chief Financial Officer, and Chief Legal Officer each hold undergraduate and/or graduate degrees in their respective fields, and each has experience managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: The Audit Committee of the Board of Directors oversees SLB's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity team briefs the Audit Committee on the effectiveness of SLB's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the SLB Board of Directors, at least annually, as part of the Company's enterprise risk management process.

companyName: SLB LIMITED/NV

ticker: SLB


text: We have a process of continuous improvement by incorporating lessons learned from attempted attacks and feedback from phishing exercises, among other learnings. We also have a third-party risk management process pursuant to which new and existing vendors undergo a structured review of their controls and systems, as well as a periodic review from our security team to help ensure vendors protect our data and systems. We seek to require our third-party vendors contractually to maintain a level of security that is acceptable to us.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Management is responsible for the day-to-day management of risks we face, including risks related to cybersecurity. Primary responsibility for our cybersecurity program is assigned to our CISO, who joined OneStream in May 2017 and has served as our CISO since December 2020. He has over 28 years of cybersecurity experience in the commercial and government sectors and works directly with the Information Security team to oversee and implement our cybersecurity program, including the policies and processes described in "Risk Management and Strategy" above. Our CISO reports directly to our Chief Risk Officer, or CRO. The CISO and the CRO both participate in regular meetings of our Operations and Risk Committee, a management committee which monitors risks across the Company, including cybersecurity and other information security risks.

companyName: OneStream, Inc.

ticker: OS


text: The Company is committed to maintaining a robust cybersecurity risk management program designed to identify, assess, and mitigate cybersecurity risks, including those related to data breaches, phishing, ransomware, insider threats, third-party relationships, software vulnerabilities, regulatory compliance, cloud security, artificial intelligence, and end-user computing. We are constantly evolving our cyber defenses to prevent and minimize impacts from cyber threats by using a multi-pronged approach that helps safeguard our assets and data.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: To more effectively prevent, detect and respond to information security threats, we have a dedicated Chief Information Security Officer ("CISO") whose team is responsible for our overall information security, cyber risk, and business continuity. The CISO brings over 25 years of extensive experience in information technology and information security and serves as the designated executive leader for cyber or data-related incident response activities. Our CISO's experience includes leading cybersecurity programs for Fortune 100 companies. In addition to the CISO, the Chief Information Officer and Chief Legal Officer are responsible for overseeing risks related to cybersecurity and data privacy. Our Chief Information Officer's experience includes more than 25 years of leading all information technology strategies and operations and oversight of IT systems for various Fortune 100 companies, and our Legal Department has personnel specializing in data privacy and cybersecurity who assist our team in assessing and managing cybersecurity risks.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: At least annually, our Vice President, Information Technology discusses with our Board a report on cybersecurity, including an update regarding our cybersecurity risks, mitigation activities and industry developments. In addition, our internal audit function provides regular updates to our Audit Committee on the results of our cybersecurity audits and related mitigation activities. In 2023, as part of our enterprise risk management update to our Board, our Vice President, Information Technology discussed risks and trends associated with information technology, including cyber-attacks, and current and future planned actions to mitigate such risks. In addition, in 2023, our Vice President, Information Technology reviewed with our Board updates related to our operational and resource readiness with respect to cyber incidents, our incident response processes and emerging cybersecurity risks.

companyName: MASCO CORP /DE/

ticker: MAS


text: A part of our strategy for managing risks from cybersecurity threats is assessment and testing of the effectiveness of our cybersecurity measures. We engage third parties to perform assessments on our cybersecurity measures, and we adjust our cybersecurity measures as necessary based on the information provided by the assessments.

companyName: Krystal Biotech, Inc.

ticker: KRYS


text: Our assessment and management of material risks from cybersecurity threats are integrated into the company's overall risk management processes. For example, the Head of Information Technology works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Equillium, Inc.

ticker: EQ


text: Adherence to the ISP is of utmost importance, and any exceptions to policy must be recommended by the ISGC, approved by the Enterprise Risk Management Committee, and reported to the Board at least annually.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our Senior Vice President of Technology and Innovation and Vice President of Network Infrastructure and Cyber Strategy oversee our cybersecurity program. They hold degrees in industrial engineering and computer science and information systems and decision science, respectively. The team responsible with administering our cyber security program have a combined 35 years of experience in cybersecurity, information security & information technology risk management, governance, risk, and compliance. Our board of directors and our audit committee are regularly updated on cyber security as part of their oversight of relevant cybersecurity risks. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: The Cybersecurity and Information Technology programs are aligned to the Company's business strategy. They share common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk. In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan. Key elements of the Cybersecurity and Information Technology programs include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology ("IT") environment; • an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents; • utilization of independent third parties to perform penetration testing of the Company's environment; and • utilization of a third party to monitor elements of our Cybersecurity and IT environment continuously.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee. The audit committee has primary board responsibility for strategic oversight of our cybersecurity program, including by quarterly reviewing and discussing with management the Company's cybersecurity and other information technology risks, controls and procedures, as well as the Company's plans to mitigate cybersecurity risks and to respond to data breaches.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: Our risk management program for cybersecurity is led by the HubSpot Security & Privacy Committee, which we refer to as the Committee. The Committee oversees our information and technology risk management, compliance, and control functions, and serves as a forum for the discussion of issues involving information security and risk management.

companyName: HUBSPOT INC

ticker: HUBS


text: The three lines of defense model is designed to provide a structure for risk management in the first line of defense ("FLOD"), monitoring and guidance by the second line of defense ("SLOD"), and independent audit by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer oversees the Company's information, cyber, and technology security. The Enterprise Risk Management Organization provides second line monitoring and guidance. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our cybersecurity risk management and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: • The Cyber Operations team is responsible for maintaining prevention, detection, and response capabilities in a defense-in-depth infrastructure. The prevention, detection, and response capabilities leverage various tools and services. The Cyber Operations team is engaged to provide timely incident response and works to minimize adverse impacts to our operations. • The Cyber and Information Technology Governance and Compliance team works to align the Company's cyber approach to requirements such as NIST 800-171, CMMC, and other information technology general controls. The Cyber and Information Technology Governance team develops Company policies designed to reduce, manage, and mitigate cyber risks. • The Classified Information team maintains the Company's classified information systems and works closely with the Company's Industrial Security team to help the Company meet the requirements laid out by the DoD for classified systems. • The Cyber/Supplier Risk Management team collaborates with the Company's supply chain function to identify and work with critical suppliers to reduce cyber risk and minimize or eliminate collateral impacts.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: In evaluating the risks identified as a part of the annual assessment process, the Company's information security team considers the likelihood and severity of the respective risk and the potential impact of the risk on the Company, its customers, and its employees. These risks are then prioritized and monitored by the information security team.

companyName: Oil-Dri Corp of America

ticker: ODC


text: Our board of directors oversees our risk management approach, including the management of risks arising from cybersecurity threats. Our board of directors receives periodic presentations and reports on cybersecurity risks, which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On a periodic basis, our board of directors discusses our Company's approach to cybersecurity risk management with management.

companyName: STORE CAPITAL LLC


text: The Chief Financial Officer chairs quarterly Enterprise Risk Management Committee meetings to review and evaluate various risk factors, including cybersecurity. The Chief Financial Officer's expertise in financial risk management, strategic planning, and organizational leadership is instrumental in guiding the committee's discussions and decisions. The Chief Financial Officer ensures that appropriate financial and operational implications of cybersecurity risk are considered and integrated into our Enterprise Risk Management Strategy.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: Apollo's cybersecurity incident response plan provides for proper escalation of identified cybersecurity threats and incidents, including, as appropriate, to the Company's management. These discussions provide a mechanism for the identification of cybersecurity threats and incidents, assessment of cybersecurity risk profile or certain newly identified risks relevant to the Company, the Adviser, and evaluation of the adequacy of the Company's cybersecurity program (as coordinated through the Adviser and Apollo), including risk mitigation, compliance and controls.

companyName: Apollo Realty Income Solutions, Inc.


text: Our information security program is administered under the supervision of our EVP, Chief Digital and Innovation Officer (CDIO) and Vice President (VP) of Platforms, Infrastructure and Cybersecurity, who share responsibility for assessing and managing the Company's cybersecurity risks. Both our CDIO and VP of Platforms, Infrastructure, and Cybersecurity have over 20 years of related experience, holding technical leadership roles at notable multinational organizations, across diverse industries.

companyName: AVIS BUDGET GROUP, INC.

ticker: CAR


text: 6. Education and Awareness: We provide regular, mandatory security awareness training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: SUTRO BIOPHARMA, INC.

ticker: STRO


text: Key Program Components We take cybersecurity seriously, and our cybersecurity program is aligned to well-known and established cybersecurity frameworks. We use, and continue to improve, our cyber defense-in-depth strategy, which uses multiple layers of security for holistic protection.

companyName: FOOT LOCKER, INC.


text: Cybersecurity is an area of focus for our board of directors, audit committee, and management. As part of our board of directors' overall responsibility for oversight of management's general risk identification and management activities, our the audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. Members of the audit committee review and discuss with management and our auditors quarterly the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security and review risk and mitigation steps taken by management related to data privacy.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: We conduct regular security assessments to identify vulnerabilities, test compliance, proactively address security risks that would impact the organization, and prioritize those risks based on their likelihood and potential impact. The associated activities include performing risk, vulnerability, penetration, and compliance assessments to assist in identifying potential internal and external threats and weaknesses in our systems, networks, and applications and performing simulations to test and improve our incident response plans while building resiliency. In addition to the controls and assessments noted above, we regularly engage with our internal and external auditors and third-party cybersecurity consultants to assess our cybersecurity program, ensuring adherence to applicable industry standards, practices, and laws.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: Regularly, Mosaic engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness. As part of our third-party risk oversight, we regularly review the vendor's ratings and conduct assessments and interviews with their personnel. The results are then reported to leaders in the Information Technology department.

companyName: MOSAIC CO

ticker: MOS


text: Notwithstanding our risk management efforts related to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material or other adverse effect on us. See Item 1A. "Risk Factors" for a discussion of our information technology and cybersecurity risks.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1.A Risk Factors—Data protection, cybersecurity and data privacy issues could adversely impact our business."

companyName: NCR Atleos Corp

ticker: NATL


text: The increased use of, and dependence on, information management systems in order to engage with customers and conduct business necessarily creates cyber risk. Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware will continue to exist. Cyber breach statistics over the past several years evidence the targeting of numerous banking institutions and credit bureaus. Phishing attempts have also significantly increased and political conflict also presents cyber threats by nation states.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: Any potentially significant information security issues that arise during the year are discussed with management and captured in our disclosure controls and procedures and are discussed with our Audit Committee chair between board meetings as appropriate.

companyName: Zumiez Inc

ticker: ZUMZ


text: CFO and representatives from our management committee on cybersecurity, which includes our Chief Business Development Officer and General Counsel, and our outside consultants, who collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks, are primarily responsible to assess and manage our material risks from cybersecurity threats.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Administered by security, information technology, and compliance professionals and managed by senior management at each of our subsidiaries, our cybersecurity program integrates into our broader enterprise risk management framework and aligns with recognized frameworks and industry standards, as applicable, and complies with various legal and regulatory requirements.

companyName: ARGAN INC

ticker: AGX


text: The Company's cybersecurity strategy is guided by prioritized risk, identified areas for improvement based on the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and emerging business needs. This strategy is shared with the executive leadership at least annually. The Company maintains a global incident response plan, coupled with a global continuous monitoring program. This plan and program include incident alerting, comprehensive incident criticality assessments, and escalation processes to support teams, senior leadership, and the Board. This escalation process also includes cross-functional materiality determinations and applicable reporting requirements.

companyName: Veralto Corp

ticker: VLTO


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Consolidated Water Co. Ltd.

ticker: CWCO


text: We maintain an information security program and governance framework that are designed to protect our information systems against risks related to cybersecurity.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Additionally, in Item 1A Risk Factors under the headings of "Risks Related to Our Intellectual Property and Technology", and "Technology failures, cyber incidents, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business", forward-looking cybersecurity threats that could have a material impact on the Company are discussed. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: KELLANOVA


text: The SVP IT brings over two decades of extensive experience in global technology organizations spanning various industries. With a background encompassing more than 20 years of expertise in information security, risk management, and compliance, the SVP IT has successfully led cyber security initiatives and ensured compliance with regulatory standards such as Payment Card Industry ("PCI") and Sarbanes-Oxley ("SOX"). The SVP IT is also supported by an Incident Response Team Security Officer ("IRT Security Officer") who provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents. The Company's IRT Security Officer has completed rigorous cybersecurity awareness and threat response training, equipped with the skills to develop effective incident response plans and swiftly mitigate emerging cyber threats. With expertise in threat detection, incident coordination, and remediation, the IRT Security Officer contributes to enhancing the Company's cybersecurity posture and readiness.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: Technical Safeguards We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks. These safeguards include firewalls, intrusion prevention, testing and detection tools, anti-malware functionality, software patch management, facility and infrastructure security, system change control, and access controls. Technical safeguards are evaluated and upgraded over time to address risks identified through vulnerability assessments and cybersecurity threat analysis. We have implemented processes to monitor security threats and vulnerabilities and respond to all cybersecurity incidents affecting us.

companyName: Telesis Bio Inc.


text: If a cybersecurity threat or incident is identified, the IRT will communicate the cybersecurity threat or incident and any damages to the CIO and other members of senior management of the Company. The Company will assess the materiality of the cybersecurity threat or incident to determine if any public disclosures are required under the SEC's cybersecurity disclosure rule. If deemed necessary, third-party consultants, legal counsel, and assessors will be engaged to evaluate the materiality assessment.

companyName: Solo Brands, Inc.

ticker: SBDS


text: We are not aware of any cybersecurity events that have materially affected or are reasonably likely to materially affect Ameren, including our business strategy, results of operations, financial position, or liquidity.

companyName: AMEREN CORP

ticker: AEE


text: We utilize third party service providers to support and facilitate business and operational activities and to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Third Party Risk Management framework, which provides the tools and practices utilized in the oversight of third party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values.

companyName: BANK OF HAWAII CORP

ticker: BOH


text: Our cybersecurity oversight function, which is led by our Chief Information Security Officer (CISO) and also includes our Chief Information Officer (CIO), Chief Executive Officer, Chief Financial Officer and General Counsel, directly oversees the cybersecurity and risk management process, which incorporates input from personnel from different functions, levels, and operating regions to support a high level of visibility and accountability throughout the company and to incorporate multiple vantage points on risks and potential mitigations. The cybersecurity oversight function meets at least quarterly to discuss key risks and to discuss mitigation strategies. The results of our cybersecurity team process are communicated to the leadership team and its risk & reputation committee (the RRC) at least quarterly.

companyName: SYSCO CORP

ticker: SYY


text: We utilize third-party service providers as a part of our day-to-day business operations. Certain of the networks and systems used to conduct our operations are managed by such third-party service providers and are not under our direct control. To address cybersecurity risk to our operations arising from our relationships with third-party service providers, we maintain a third-party risk management program, which includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.

companyName: Under Armour, Inc.

ticker: UAA


text: Cybersecurity threats could potentially result in slowed or halted business operations, such as shipping, closing sales, marketing engagement, and other communications. This would negatively impact the Company's financial condition until the issue is resolved. Such threats could impact customers of certain programs that rely on digital resources, but a majority of our products would not be materially affected.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: In the event a threat results in a cybersecurity incident, we have a process for escalating certain cybersecurity incidents from our security team up through our security leadership and ultimately to management.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact, that is aligned with the National Institute of Standards and Technology ("NIST"). This program is integrated into the Company's overall Enterprise Risk Management and Resiliency process.

companyName: HERSHEY CO

ticker: HSY