text: Franklin Templeton and the Adviser recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of their prevention efforts is employee training on their data privacy and cybersecurity procedures. For example, all new hires of Franklin Templeton and the Adviser receive mandatory privacy and information security training. In addition, current employees of the Adviser must complete mandatory annual cybersecurity and data trainings, which are supplemented by regular phishing and other cyber-related testing and trainings that the Adviser conducts throughout the year.

companyName: Franklin BSP Capital Corp

ticker: FRBP


text: We recognize the importance of securing our data and information systems and have a process for assessing, mitigating and managing cybersecurity and related risks.

companyName: INTRUSION INC

ticker: INTZ

secItem: Item 1C


text: Our IT team, led by the Vice President of IT and the Director of Network and Information Systems, is responsible for day-to-day assessment and management of cybersecurity risks, including the monitoring and detecting of cybersecurity incidents and executing our cybersecurity incident response plans. Members of our IT team have undergraduate and graduate degrees in relevant fields, including information systems, information assurance, and information technology with a concentration in cybersecurity. Members of our IT team have also obtained relevant certifications, including the Director of Network and Information Systems being a Certified Information Systems Security Professional.

companyName: ALAMO GROUP INC

ticker: ALG


text: Risk Management and Strategy AVITA Medical has implemented an Information Security Management System ("ISMS"). The Company's ISMS is a continuous process designed to analyze the potential risks, vulnerabilities, the likeliness of occurrence and the related consequences of cybersecurity threats. The process is based on establishing the context, assessing the risks, and treating the risks. The key concept of the ISMS is to consistently maintain and improve confidentiality, integrity, and availability of information assets that should be protected by the organization on behalf of itself and its clients, and third parties. Once a risk, threat or vulnerability is identified, the Company establishes a risk treatment plan to take corrective action to prevent risks that can be avoided and minimize the ones that cannot. We engage an independent third-party cybersecurity services and consulting firm to continuously review our information security and provide technical oversight. We also conduct internal phishing campaigns and perform an independent penetration test on an annual basis. In addition, we conduct regular security awareness training and testing of our employees. The Company has not had any material cybersecurity incidents.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Depending on the environment, systems, and data, we employ strategies and practices designed to protect and mitigate cybersecurity material risks to our Information Systems and Data, including but not limited to: • Utilizing third-party tools to monitor threats and cybersecurity vulnerabilities, reduce risk, and enhance governance, risk, and compliance management. • Engaging a managed cybersecurity service provider to monitor and assess cybersecurity threats, serve as a point of contact for incident notification, and collaborate with our in-house IT team. • Maintaining security policies, procedures, and standards considering evolving threats and industry standards. • Engaging external subject matter experts and advisors to inform us of current cyber practices, policies, and programs. • Conducting tabletop exercises focused on scenarios such as ransomware, disaster recovery, and business continuity. • Providing mandatory annual security and privacy awareness training to all employees who have access to company email and connected devices. • Conducting phishing simulations and cyber hygiene training sessions to educate employees and promote responsible cybersecurity practices. • Maintaining an incident response plan.

companyName: SI-BONE, Inc.

ticker: SIBN


text: The Audit Committee of the Company's Board of Directors maintains oversight over cybersecurity risk, in coordination with the full Board of Directors. The Board of Directors and the Audit Committee receive and provide feedback on quarterly updates from management regarding cybersecurity, including highlights of recent incidents throughout the industry and the emerging threat landscape, as well as the prompt notice of any cybersecurity threats or incidents with the potential to significantly impact the Company, including its financial condition, results of operations, and cash flows, and regular updates about incidents with a lesser impact. Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee. The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The information technology department, led by our Director of Information Technology & Services ("IT Director"), is responsible for our cybersecurity program. The IT Director, along with a third party provider with significant cybersecurity experience, manages information security, infrastructure, and compliance. This collaboration ensures that our cybersecurity practices are aligned with industry standards and best practices.

companyName: CALAVO GROWERS INC

ticker: CVGW


text: The threat intelligence function within the Cybersecurity Program actively engages in private and public information sharing communities and leverages both commercial and proprietary products to collect a wide variety of industry and governmental information regarding the latest cybersecurity threats, which informs the cybersecurity risk assessments and strategy. This information is also provided to an internal forensics team, which develops and implements technologies designed to help detect these cybersecurity threats. Where a potential threat is identified, an incident response team evaluates the potential impact, and coordinates remediation where required. These groups, as well as Morgan Stanley's Operational Risk Department (the "Operational Risk Department"), review external cybersecurity incidents that may be relevant to Morgan Stanley and its affiliates, and the outcomes of these incidents further inform the design of the Cybersecurity Program. In addition, Morgan Stanley maintains a robust global training program on cybersecurity risks and requirements and conducts regular phishing email simulations for its employees and consultants.

companyName: Ceres Tactical Commodity L.P.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Planet Fitness implements processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: As a large financial technology provider, we continually face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts to identify and respond to cybersecurity threats, we cannot guarantee that we will not experience a material cybersecurity incident in the future or that an undetected incident has not already occurred. For further discussion of cybersecurity risks, see the section entitled "Risk Factors" in Item 1A.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: IHM's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help IHM prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us. IHM's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, is integrated into IHM's information technology program. In addition, both IHM and the Company periodically engage with third-party consultants and key vendors to assist them in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: Chatham Lodging Trust

ticker: CLDT


text: The Company's Manager of Information Technology & Facilities (the "IT Manager") is responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in conjunction with our General Counsel and our Head of Information Technology and report to our Audit Committee. In addition, we maintain an Information Technology Steering Committee, which is comprised of several senior members of the Company. Our Chief Financial Officer has over 10 years of experience in leading Information Technology departments at various companies. Our General Counsel has over 10 years of experience related to general legal matters, including in the capacity of understanding and guiding companies on Information Technology matters and the related risks. Our Head of Information Technology has over 30 years of relevant experience, including managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.

companyName: Quantum-Si Inc

ticker: QSI


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our customers, colleagues, regulators, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyberattacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see "A major information or cybersecurity incident or an increase in fraudulent activity could lead to reputational damage to our brand and material legal, regulatory and financial exposure, and could reduce the use and acceptance of our products and services." under "Risk Factors."

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board of Directors and management. Our Board of Directors has delegated to the Audit Committee oversight of our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security. Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: We maintain a process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: BioCardia, Inc.

ticker: BCDA


text: Our Information Security Program is evaluated regularly by both the internal audit function as well as third-party audit firms. These audits help ensure our program is appropriate to address the changing threat landscape and aligns to industry standards such as the National Institute of Standards and Technology Cybersecurity Framework, as well as other legal and regulatory guidance including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, the Bankers Electronic Crimes Taskforce Ransomware Self-Assessment Tool, and the Gramm-Leach-Bliley Act. Controls are reviewed for adequacy and design at least annually, and both internal and third-party audits aid in identifying areas for continued focus, providing assurance that controls are appropriately designed and operating effectively. Additionally, we meet regularly with examiners from the Office of the Comptroller of the Currency to review our cybersecurity program and discuss the changing threat landscape.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We did not identify a material security breach during the year ended December 31, 2024, nor have we identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Information Security Program Our processes for assessing, identifying and managing material risks from cybersecurity threats, as defined in Item 106(a) of Regulation S-K, are integrated into our overall risk management strategy. We regularly assess the risks inherent in operating our business as well as the effectiveness of our risk management activities. The Artisan Risk and Integrity Committee, which includes members of the Company's senior leadership team including senior representation from the firm's operations, distribution, finance, internal audit, investment strategy and legal functions, facilitates our annual enterprise risk assessment process, which identifies and prioritizes key risks to achieving our purpose and maintaining our business model. We also conduct a bottom-up information and cybersecurity risk assessment on an annual basis, which focuses on the evolving threat landscape, changes in the firm's operations, changes in regulatory requirements and security incidents. This risk assessment informs the Company's information security awareness training and testing and assessment program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Our board of directors meets regularly with our executive management and receives updates on the status and overall effectiveness of our technology and cybersecurity program, relevant information technology operations, any changes in material cybersecurity risks and any significant cybersecurity incidents consistent with our technology and cybersecurity program. The board also discusses with executive management the steps management has taken to monitor and mitigate privacy, data security, and cybersecurity risk exposures, our information governance policies and programs, and major legislative and regulatory developments that could materially impact our exposure regarding privacy, data security risk, and cybersecurity. The board of directors considers cybersecurity as part of our business strategy, financial planning, and capital allocation.

companyName: Cardiff Lexington Corp

ticker: CDIX


text: Additionally, Palantir utilizes third-party software, services, and providers in our cybersecurity program in furtherance of our security processes such as endpoint security, threat intelligence, cloud security, and authentication services. The third-party vendors we engage with are generally required to implement industry standard technical, administrative, cybersecurity, and physical measures designed to protect the security and confidentiality of Palantir information (including customer information). Additionally, such providers undergo review, dependent on the software and services they are expected to provide, as part of our vendor onboarding process and may be subject to additional review upon certain critical events, or in connection with contract renewals. Third-party providers must notify Palantir promptly of relevant security incidents.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management will be supported by the Audit Committee, which regularly interacts with the Company's management team.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: We depend on information technology and systems for various operations (including refinery processes and refined product loading) and for capturing accounting, technical and regulatory data for reporting, analysis, and archiving. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. As of the filing date of this report, our risk assessment process related to cybersecurity includes conducting vulnerability assessments using a combination of internal and third-party capabilities to perform technical assessments, vulnerability scanning, and incident and event monitoring. We are working to establish a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners, and we anticipate that such a program will follow well-organized cybersecurity frameworks under a central control figure.

companyName: BLUE DOLPHIN ENERGY CO

ticker: BDCO


text: Our Vice President of Information Technology, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity program. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.

companyName: Phunware, Inc.

ticker: PHUN


text: AGM's CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo's cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, AGM's CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.

companyName: Apollo Realty Income Solutions, Inc.


text: Additional Measures and Good Practices In addition to the aforementioned protocols, we are committed to continuous improvement and adaptation of our cybersecurity measures to counter new threats. This includes engaging in threat intelligence sharing with industry partners, conducting regular cybersecurity risk assessments, and implementing a comprehensive incident response plan to quickly address and mitigate the impact of any cybersecurity incidents.

companyName: AIBOTICS, INC.

ticker: AIBT


text: The Senior Vice President of Information Technology is responsible for assessing and managing cybersecurity risks. He has over twenty years of experience at the company, encompassing network engineering, information technology and cyber security. Management has a depth of cybersecurity experience focused on increasing the organization's resilience to security threats and stays current on new developments through continuing education and monitoring of the cybersecurity landscape. As part of their accountability for incident response, significant incidents are communicated to an internal committee including the Chief Financial Officer and general counsel to assess their materiality and if materiality is confirmed it is reported by the defined process. To date UScellular has not identified nor become aware of any cybersecurity incidents that individually or in aggregate have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations, or financial condition.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: We do not maintain sensitive financial information or client data within our digital marketing tools or within our information technology platforms. We do not have a large or complex data environment or systems that process sensitive information and as such we maintain an information security and cybersecurity program and a cybersecurity governance framework that is appropriate for an operation of our size. As a digital marketing services provider, we utilize social media and other marketing platforms to build client marketing campaigns and direct marketing services. The vast majority of market data and analytical tools we use are developed and supported by large technology companies and as such rely on their infrastructure to ensure their web-based solutions have the appropriate cybersecurity protections to ensure our digital marketing services are secure. We leverage our proprietary digital analytical tools to develop more target marketing plans for our clients. We utilize PCI compliant merchant processors to ensure that client payments for services and ad spend are securely processed and cybersecurity risks minimized for us and our clients.

companyName: SPECIFICITY, INC.

ticker: SPTY


text: The alignment of strategic objectives and risk management to avoid siloed risk management approach. This is the key step in performing risk assessments.

companyName: CXApp Inc.

ticker: CXAI


text: Our Board Risk Committee generally meets quarterly and is responsible for overseeing cybersecurity risk and our information security program, including cybersecurity, and ensuring the continued development of the program as the Company grows and cyber and information risk exposures change. At each Board Risk Committee meeting, the chief information security officer presents information security metrics and any updates to the Information Security Program. New and changing cybersecurity risks are discussed when needed. The chair of the Board Risk Committee also serves as a board member and previously served as the chair and interim chief executive officer of the Information Systems Audit and Control Association. As a board member of the Information Systems Audit and Control Association, she is a member of their Audit and Risk Committee, Compensation and Human Capital Committee and Governance and Nominating Committee. All cybersecurity-related policies are reviewed and approved annually by the chief information security officer, chief risk officer, Enterprise Risk Management Committee, Board Risk Committee and the board of directors.

companyName: Sterling Bancorp, Inc.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, and we currently do not expect that risks from cybersecurity threats are reasonably likely to materially affect us, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: MEDALLION FINANCIAL CORP

ticker: MFIN


text: As of December 31, 2024, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: GD Culture Group Ltd

ticker: GDC


text: Mid Penn protects and monitors its technology environment with industry leading security tools including next-generation firewalls with intrusion prevention services, intrusion detection and response tools, email security gateway, log and event monitoring software, and an industry-leading antivirus solution. Each system is administered and monitored by members of our Information Technology and Information Security staff. Real-time alerts received from these systems are responded to by staff and worked until the threat is determined to be mitigated. Impactful computer security events would be subject to the guidance provided in our Incident Response Program, that is tested annually so we are ready to respond if needed.

companyName: MID PENN BANCORP INC

ticker: MPB


text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Board will be notified as necessary.

companyName: SSR MINING INC.

ticker: SSRM


text: The ISO is responsible for cybersecurity under the ITSM and holds a Certified Information Security Manager certification and was a former Chief Information Security Officer ("CISO") for the United States segment of a multi-national bank. The ISO reports directly to the Executive Vice President, Chief Risk Officer of the Bank who is a member of the executive team. The Chief Operating Officer, who is a member of the executive team, is a former CISO and holds both a Certified Fraud Examiner and Certified Information Security Manager certification. The Chair of the RMC of the Board also has multiple certifications in information and cybersecurity, including a Certified Information Systems Security Professional certification.

companyName: Provident Bancorp, Inc. /MD/


text: conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; dark web scanning to determine any leaked credentials both corporate and personal for key employees.

companyName: TMC the metals Co Inc.

ticker: TMC


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Usio, Inc.

ticker: USIO


text: Our cybersecurity risk management and strategy processes are coordinated by our Director of Technology. He maintains the Certified Information Systems Security Professional certification and has eight years of senior leadership experience in defensive cyber security in both the private sector and Department of Defense. He is supported by leaders from our Information Technology, Document Management, and Compliance teams, as well as management's Disclosure Committee who have extensive work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. They draw on their knowledge of daily information technology operations, ongoing cybersecurity initiatives and various monitoring tools to ultimately report through the Director of Technology and Director of Internal Controls to the Audit Committee on the monitoring, prevention, mitigation, detection and remediation of cybersecurity incidents. In the event the Audit Committee determines that a cybersecurity incident has occurred, the Audit Committee will evaluate whether to escalate the cybersecurity incident to the full Board.

companyName: Bridger Aerospace Group Holdings, Inc.

ticker: BAER


text: We rely on IT networks and systems to process, transmit and store electronic information and to manage or support our business. We have implemented information security processes designed to identify, assess and manage risks from cybersecurity threats to our systems and data.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: During the fiscal year ended March 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition, as we have described in the Risk Factors section of this Form 10-K.

companyName: CYANOTECH CORP

ticker: CYAN


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Chief Technology Officer, with extensive cybersecurity knowledge and skills from years of relevant work experience at Welltower and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This information security team comprises individuals with relevant educational and technical experience, many having held similar positions with responsibility for various aspects of cybersecurity at large organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. The Chief Technology Officer also leads our Cyber Security Working Group, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. The Chief Technology Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee and Board.

companyName: WELLTOWER INC.

ticker: WELL


text: Our CISO and DPO serves as the chair of the IT Compliance Committee, which directly reports to our CEO. The IT Compliance Committee also includes key representatives from management, and is responsible for reviewing IT planning, cybersecurity and privacy, and managing our cybersecurity teams. The IT Compliance Committee, upon reviewing assessment results regularly reported by cybersecurity teams, provides periodic updates to the Audit Committee on the effectiveness of our cybersecurity processes, and the Audit Committee reviews cybersecurity risks as part of the Company's enterprise risk management system. The Audit Committee periodically reports the results of its review to the Board. When a cybersecurity incident occurs, information is escalated to the CISO and DPO who may convene IT Compliance Committee meetings to discuss findings, actions taken, potential disclosure obligations, impact and recurrence prevention plan depending on the severity of the incident.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: dedicated cybersecurity staff, including a 24/7 security operations center monitoring for and responding to threat activity, incident response plans and processes, vulnerability management, secure software development, static and dynamic code scanning for vulnerabilities, open-source software scanning, internal and third-party penetration testing, a bug bounty program, internal audit and assurance of security controls, disaster recovery/business continuity plans, attainment and maintenance of industry-standard security certifications, identity and access management, asset management, tracking and disposal, encryption, access controls, third-party risk management, phish testing and reporting, employee security awareness training, and maintaining cybersecurity insurance.

companyName: Freshworks Inc.

ticker: FRSH


text: We comply with all relevant cybersecurity regulations and standards, including the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR). We regularly review and update our cybersecurity policies and procedures to ensure compliance with evolving regulatory requirements.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: The Audit and Finance Committee, consisting entirely of independent directors and on behalf of the Board of Directors, has oversight responsibility for enterprise risk and enterprise risk management systems for the Company, including cybersecurity risks. The Committee reports on its activities related to risk oversight to the full Board after each meeting. The Audit and Finance Committee is actively involved in reviewing the Company's information security and technology risks and opportunities, including cybersecurity, and discusses these topics on a regular basis. The Audit and Finance Committee also receives updates on a quarterly basis from senior management, including the Chief Information Security and Privacy Officer (CISO) regarding cybersecurity matters. These updates include cybersecurity risks, mitigation and status of cybersecurity risks, cybersecurity incidents (if any), cybersecurity initiatives and cybersecurity industry news and trends. In the event of a potentially material cybersecurity event, the Presiding Director and the Chair of the Audit and Finance Committee will be notified and briefed. If appropriate, the Audit and Finance Committee and/or full Board of Directors would hold a meeting or meetings to discuss and be briefed on the event.

companyName: HARLEY-DAVIDSON, INC.

ticker: HOG


text: Our security team is intentionally comprised of internal personnel with a range of technical, legal and management disciplines as well as external, third-party cyber service providers, auditors and technical consultants. This allows for broader monitoring, objective reporting, controlled policy, decreased recovery time objectives and quicker incident response.

companyName: Southland Holdings, Inc.

ticker: SLND


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to the Chief Information Officer who oversees the Company's information technology department.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: We engage consultants and other third parties in connection with our risk assessment policies and processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: GrowGeneration Corp.

ticker: GRWG


text: We engage with external experts, including cybersecurity assessors and consultants, in evaluating and testing our information systems and information security controls, enabling us to obtain specialized knowledge and insights.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or the systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.

companyName: PVH CORP. /DE/

ticker: PVH


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, including potential unauthorized occurrences on or through both, our physical systems and electronic information systems, that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process and store as part of our business, including on behalf of third parties. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: AMERICAN BATTERY TECHNOLOGY Co

ticker: ABAT


text: We engage outside experts where appropriate to aid in developing and implementing the cybersecurity program and to review its operations. Our Internal Audit function also performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to enhance our cybersecurity operations to respond to the dynamic cybersecurity landscape.

companyName: CUMMINS INC

ticker: CMI


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as Chief Digital Officer since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. Previously he served as Vice President of Technology after joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including multiple officer-level positions, of invaluable experience in information technology and security.

companyName: MARINEMAX INC

ticker: HZO


text: Our CSO has extensive experience working in the public and private sectors leading security organizations, risk management functions, and driving large information technology deployments. He has an Engineering degree, a Master of Business Administration, a Chief Information Security Officer Certification, and a Global Information Assurance Certification Security Leadership Certification. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: We have established processes for assessing, identifying, and managing material risks from cybersecurity threats and have integrated these cybersecurity processes into our overall risk management system. Specifically, we have adopted a cybersecurity framework which, where appropriate, aligns with the NIST's Cybersecurity Framework. Further, our systems, where appropriate, are PCI compliant under current standards.

companyName: FARMER BROTHERS CO

ticker: FARM


text: Credential Management and Rotation: To prevent unauthorized access stemming from compromised credentials, we implement rigorous credential management and rotation policies. These measures include regularly updating passwords and access keys, ensuring that former employees' access rights are promptly revoked, and employing advanced credential management systems.

companyName: AIBOTICS, INC.

ticker: AIBT


text: As of the date of this annual report, we maintain cyber liability insurance that provides cyber incident response coverage. However, costs, damages, and remediation associated with cybersecurity incidents may not be adequately insured under our insurance policy and may be subject to applicable deductibles, to the extent that they are covered. See also " We could lose cyber liability insurance coverage and be subject to uninsured liabilities " in Item 1A, Risk Factors, of this annual report for additional discussion of risks related to our cyber liability insurance.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: Gryphon subsequently wired the commensurate amount in USD to Sphere 3D to make them whole for the stolen BTC. Gryphon also engaged a nationally recognized third-party firm to perform a forensic analysis. The analysis revealed that the threat actor did not enter the email exchange via Gryphon's IT systems. Sphere 3D made a claim with its insurance carrier. If Sphere 3D is reimbursed by its insurance carrier, the Company would request reimbursement from Sphere 3D. The Company has also subsequently modified its control systems to protect against any future attempted incursions. During the quarter ended June 30, 2023, the Company made a payment to Sphere 3D for $560,000, which was classified as a general and administrative expense on Gryphon's condensed consolidated statement of operations.

companyName: American Bitcoin Corp.

ticker: ABTC


text: The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to our full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.

companyName: METLIFE INC

ticker: MET


text: As previously disclosed, during the three-month period ending September 30, 2022, the Company became aware of a cyberattack that had been recently made against certain systems within the Company's network environment. The attack temporarily affected operations and caused delays in execution of sales transactions at some locations. In addition, the Company incurred financial costs to investigate and remediate the incident, some of which are expected to be mitigated by insurance. During the incident, the attackers accessed and exfiltrated Company data, including some personally identifying information of certain Company employees. The Company believes it has contained the incident, which only affected certain systems, and it has restored operations and notified affected individuals. The Company has put in place remediation measures designed to help prevent future similar attacks and has proactively undertaken to implement certain other enhancements to its security system.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: We recognize the critical importance of maintaining the trust and confidence of our customers, franchisees and employees. Consequently, our cybersecurity policies, standards, processes and practices are contained within our Corporate Security Policy. Our cybersecurity policies, standards, processes and practices are fully integrated into the Company's enterprise risk management program.

companyName: POTBELLY CORP

ticker: PBPB


text: We periodically evaluate and test our policies, standards, processes, and practices to address cybersecurity threats and incidents. These efforts include a wide range of activities, including third party assessments, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The results of such assessments and reviews are reported to our management team, the Audit Committee and the Board, and we adjust our cybersecurity program as necessary based on the information provided by these assessments and reviews.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Incident Response and Business Continuity Our incident response framework follows a structured escalation and notification process focused on rapid containment, mitigation, and recovery from cybersecurity incidents. Key response detection and response workflows to leverage rapid assessment detection technology to detect of critical incidents to our Chief Executive Officer, President, and Chief Operating Officer and the Board based on severity and regulatory reporting requirements; and backup and disaster recovery, which implement immutable backups, air-gapped storage, and rapid failover solutions to protect data integrity and minimize downtime in case of cyber incidents.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Risk Management Strategy We have a comprehensive cybersecurity risk management strategy to assess, identify, and manage material risks from cybersecurity threats. The core of this strategy is our digital risk and security program, which is integrated into our overall enterprise risk framework and is based on industry standards and established frameworks such as National Institute of Standards and Technology (NIST) and other guidelines. Our program is designed to help protect our systems, data, and operations from potential cyber threats, ensure the continuity of business operations, ensure we comply with applicable laws and regulations, and meet our commitments to our members, customers, suppliers, employees, and other stakeholders.

companyName: Premier, Inc.


text: The CISO briefs the Cybersecurity Committee on cybersecurity risks on at least a quarterly basis. These briefings encompass a range of topics, including, as appropriate, key cybersecurity metrics, the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives and strategies, and incident management reports and lessons learned from cybersecurity events. The Cybersecurity Committee and CISO also maintain a continuous dialogue on potential threats. The Cybersecurity Committee annually assesses MeridianLink's cybersecurity posture and risk management efficacy, leading to improvement efforts. The Cybersecurity Committee chair and/or our General Counsel conveys certain cybersecurity updates on the CISO's behalf during board meetings.

companyName: MeridianLink, Inc.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. Further, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. For a detailed discussion of the Company's cybersecurity related risks, refer to "Operational Risk" within Part I, Item 1A. Risk Factors of this Annual Report.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: Information sharing and collaboration – We utilize threat intelligence and security information collected from various sources, including but not limited to partners, suppliers, governments and information sharing and analysis centers, to identify, protect against, detect and respond to potential cybersecurity threats and events.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: To safeguard our networks and systems, we have a dedicated cybersecurity organization overseen by our Chief Information Security Officer, which operates within our information technology department overseen by our Chief Information Officer. Our cybersecurity organization employs multiple security controls, such as firewalls, spam protection, web filtering, endpoint detection and response software, controlled access, vulnerability management, redundancies, patching, and regular onsite and offsite backups. Our cybersecurity organization also uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and risk-based performance monitoring.

companyName: WESTLAKE CORP

ticker: WLK


text: We routinely assess our systems and processes for modifications in advance of evolving state privacy regulations and other applicable industry standards and regularly update our privacy and information security policies to remain current with industry-leading practices. We are continually adapting to the ever-changing cyber risk landscape and have a dedicated team of information security professionals committed to maintaining the highest levels of systems and data security. The Company conducts and has engaged external information security firms to conduct assessments, including penetration tests, to continually improve security controls and ensure security controls. We continue to expand and grow our security team and their skillsets and make regular enhancements to our Information Security Program.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: If our information technology systems are compromised, we could be subject to fines, damages, litigation and enforcement actions, incur financial losses, suffer reputational damage, and lose trade secrets or other confidential information, each of which could significantly harm our business.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We have implemented and maintain various information security processes and technologies designed to identify, assess and manage material risks from cybersecurity threats to our computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: ENZO BIOCHEM INC


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is significant. For further discussion of risks from cybersecurity threats, see the section captioned "The Corporation's information technology systems, and the systems of third parties upon which the Corporation relies, may experience a failure, interruption or breach in security, which could negatively affect our operations and reputation." in Item 1A. Risk Factors.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: The ERM program and ERA process is described in the Company's Enterprise Risk Management Policy which was released this year. The program includes enterprise level risks grouped in 12 risk categories. Cybersecurity is included as a standing risk category. The ERM program does not itself independently review cybersecurity policies and practices. In first quarter 2024, ERM, in collaboration with Emergent's Policy and Training Center of Excellence, provided training on Emergent's Enterprise Risk Management Policy to all employees who are at the vice president level and above. As part of our ongoing Enterprise Risk Management ("ERM") enhancements, our ERM intranet page was launched in 2024 to centralize risk-related resources and policies. During the third quarter of 2024, a comprehensive reassessment of the Company's enterprise risks was conducted, with results thoroughly reviewed and communicated to executive leadership (VP and above) to align on key risks and strategic priorities. Annually, we provide an ERM training to all participants in advance of the Company's annual ERA. Full retraining on the ERM policy will occur every three years. The Company leverages the Committee of Sponsoring Organizations'("COSO") guidelines as the foundation for our ERM program and leverage external expertise.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: Our Board of Directors assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices, and risks related to information security and cybersecurity.

companyName: CVRx, Inc.

ticker: CVRX


text: Our cybersecurity risk management program is designed to monitor and control cybersecurity risk exposure, response, mitigation and protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity policies and processes are fully integrated into the Company's Enterprise Risk Management program. Our cybersecurity program is based on industry recognized best practices, including the ISO 27001 Information Security, Cybersecurity and Privacy protection international best practice standards.

companyName: KURA SUSHI USA, INC.

ticker: KRUS


text: Protecting our data, which includes information related to our patients, members, and customers, is a primary area of our focus. Given the critical nature of this information, we have developed and implemented a robust cybersecurity risk management program to assess, identify, and manage risks associated with cybersecurity threats as identified in Item 106(a) of Regulation S-K. Cybersecurity is an important and integrated part of our risk management program that identifies, monitors and mitigates business, operational and legal risks.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Security breaches, loss of data and other disruptions, including from cyberattacks, could compromise sensitive information related to our business, prevent us from accessing critical information or expose us to liability, which could adversely affect our business and our reputation" which disclosures are incorporated by reference herein. We did not experience any material cybersecurity incidents during the last fiscal year.

companyName: MYRIAD GENETICS INC

ticker: MYGN


text: We rely on the information systems of third-party vendors, including our cloud vendors, for various functions of our business, including manufacturing, sourcing, distribution, sales and marketing. We engage a third-party risk management software to oversee and identify the risks from cybersecurity threats associated with relevant vendors, based on the services such vendors provide and the information to which they have access. In addition, as part of our new vendor onboarding procedures, we review proposed new vendors' cybersecurity and data protection practices and certifications and collaborate with such vendors to align their cybersecurity platforms with our expectations.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have impacted or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The IT Director leads and coordinates cybersecurity efforts at Aeva, providing regular updates on cybersecurity progress to the senior leadership team. The Information Security team actively shares updates on the status of cybersecurity efforts and risks, evaluates our information security programs, and monitors the evolving threat landscape on a company-wide level.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: As of the date of this 2024 Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: We review the processes of our third party vendors and consider their ability to adhere to relevant industry practices and maintain adequate technology risk programs. In addition, we maintain cyber and cyber-related crime insurance coverage policies as part of our overall risk management strategy, however, our policies may not be sufficient to cover against all potential future claims, if any.

companyName: AVENUE THERAPEUTICS, INC.

ticker: ATXI


text: Managing Material Risks and Integrated Overall Risk Management We have integrated cybersecurity risk management into our risk management processes. This integration is intended to ensure that cybersecurity considerations are part of our decision-making processes. We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: Reporting to Board of Directors The Operational Risk Committee receives reports from the President, Information Security Officer, and Director of Risk Management, and briefings on our information security and enterprise risk management programs at least quarterly, including the results of any external audits, bank regulatory examinations and evaluations, as well as maturity assessments of our information security program.

companyName: F&M BANK CORP

ticker: FMBM


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: LKQ CORP

ticker: LKQ


text: We identify and assess cybersecurity risks on an ongoing basis by maintaining a cybersecurity program that involves a defense-in-depth approach with multiple layers of security controls to protect our environment. We have invested in and deployed a security operating model involving people, processes, and technology that is designed to protect against potential and known cybersecurity risks and threats. Our cybersecurity program involves collaboration with partners, including financial industry groups, to understand and incorporate best practices and engage in cybersecurity threat intelligence sharing. Our security operations team includes internal threat hunters, such as cybersecurity engineers and analysts, who are working directly with third parties to monitor the threat landscape. Alerts from monitoring are analyzed by our security teams for preemptive engagement to avoid or minimize the impact of potential cyber threats. Additional cybersecurity tools are used to detect and block malicious attacks, as well as to govern identity and access management, in each case to avoid or minimize risks of unauthorized access to systems and data.

companyName: Unum Group

ticker: UNM


text: In the event of a cybersecurity incident impacting us, the Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: COLOMBIER ACQUISITION CORP. II


text: IT Administrator oversees our information security program and leads our information security team. Our IT Administrator has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over five years of experience leading cross-functional organizations in the development and operation of large-scale systems.

companyName: Mag Mile Capital, Inc.

ticker: MMCP


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee also receives prompt and timely information regarding any cybersecurity incident that meets preestablished factors, as well as ongoing updates regarding such incident until it has been resolved. Cybersecurity events that meet specified criteria are also escalated to the Disclosure Committee. At least once each year, the Audit Committee holds a meeting dedicated to cybersecurity matters, in addition to receiving quarterly updates on cybersecurity matters at regularly scheduled Audit Committee meetings. On an annual basis, Company management presents to the Board on the Company's approach to cybersecurity risk management.

companyName: Revance Therapeutics, Inc.


text: Our board of directors has oversight of our strategic and business risk management and has delegated cybersecurity risk management oversight to the Chief Financial Officer and our cybersecurity incident response team. Our board of directors are responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors. The company will continue to commit to maintaining high standards of cybersecurity practices to protect the interests of our customers, shareholders, and other stakeholders. We will continuously monitor the latest developments in the field of cybersecurity and update our cybersecurity and risk management framework as needed.

companyName: TANCHENG GROUP CO., LTD.

ticker: QSJC


text: At the management level, our CISO is primarily responsible for leading our cybersecurity strategy centrally at Roivant and the majority of our Vants. Our CISO has extensive cybersecurity experience across a wide array of industries, with previous leadership positions specializing in safeguarding healthcare data across various health technology companies.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: Our Chief Security Officer leads our Information Security organization, which has primary responsibility for assessing and managing our cybersecurity risks. Our Chief Security Officer has principal management responsibility for overseeing the company's cybersecurity risk management program. Our Chief Security Officer reports to o ur Chief Operating Officer.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: AMN's information and cybersecurity program has adopted policies, standards, processes, and practices that follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant standards. AMN Healthcare has also implemented certain controls and procedures that allow its management to assess, identify, and manage material risks from cybersecurity threats. Our processes are integrated into the overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. These processes complement our enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Board through its Audit Committee.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: As a blank check company, we have no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Report, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Due to our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Report. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: Spring Valley Acquisition Corp. II

ticker: SVIIF


text: BlackRock's Enterprise Risk Management Framework BlackRock recognizes the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. Cybersecurity represents an important component of BlackRock's approach to ERM. BlackRock leverages a multi-lines-of-defense model with cybersecurity operational processes executed by global information security and other teams and dedicated internal audit technology and technology risk management ("TRM") teams that independently review technology risks. BlackRock's cybersecurity program is fully integrated into its ERM framework and is aligned with recognized frameworks, including NIST CSF, FFIEC CAT, FedRAMP, SOC 1/2, ISO 27001/2 and others. BlackRock aims to inform and continuously improve its cybersecurity program through engagement with regulatory, client, insurer, vendor, partner, peer, government and industry organizations and associations, as well as external audit, technology risk, information security and other assessments.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Risks from Cybersecurity Threats To date, we have not yet experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing of our systems, networks and web properties. We also employ internal security testing solutions and security awareness training for all employees.

companyName: Verastem, Inc.

ticker: VSTM


text: As codified in its charter, the Audit Committee is responsible for reviewing the processes by which cybersecurity risks are managed and reporting any issues that arise out of such reviews to the Board. The CISO provides key security metrics to the Audit Committee on a quarterly basis, and directly to the chair of the Audit Committee on a case-by-case basis, as needed, at any time during the quarter. The Audit Committee reviews these reports, which include, among other things, external events impacting the Company, cybersecurity incidents, user training statistics, and evaluations of user readiness to address cybersecurity incidents. Notwithstanding the Company's approach to cybersecurity, the Company may not be successful in preventing or mitigating future cybersecurity incidents that could have a material adverse effect on the Company. While LivaNova maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information on risks related to cybersecurity and data security, see "Item 1A. Risk Factors – Risks Relating to the Company's Business and Operations."

companyName: LivaNova PLC

ticker: LIVN


text: To operate our business, we utilize certain third party service providers to perform a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms, managed services, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology and corporate productivity services. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections and requiring their completion of written questionnaires regarding their cybersecurity programs. For service providers that provide particularly critical services to us or process particularly sensitive information for us, we engage industry leaders with robust and documented cybersecurity programs.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems. During fiscal 2024, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations or financial condition. However, if a cyberattack or other security incident results in unauthorized access to or modification or exfiltration of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.

companyName: ORACLE CORP

ticker: ORCL


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Company's Chief Executive Officer and Chief Financial Officer, whom oversee management's implementation of our cybersecurity risk management program and incident response plans.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management process.

companyName: KLA CORP

ticker: KLAC


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical comp uter networks, third party hosted services, communications systems, hardware and software, products and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature (collectively, "Information Systems and Data").

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. The Company also has a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: As part of our Enterprise Risk Management ("ERM") program, we maintain processes to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats. Central to these processes is a committee comprised of our head of Internal Audit, our Chief Information Officer ("CIO"), members of our executive team, and other senior members of management that evaluates cybersecurity risks and designs, and ensure implementation of, appropriate controls, protections and training. This committee periodically reviews overall risks to the Company as part of the ERM program and ensures the alignment of cybersecurity efforts with the overall risk management framework. The committee has identified cybersecurity threats as one of the primary categories of risk to the Company.

companyName: Installed Building Products, Inc.

ticker: IBP


text: Based on an assessment using the previously described cybersecurity risk management program, we do not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition to date. However, we, our collaborators and our third-party vendors and service providers may in the future be the target of cybersecurity threats, any of which could have a material adverse effect on our business. For a description of the cybersecurity risks we face and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Mersana Therapeutics, Inc.


text: Our Director of Information Technology and members of our cybersecurity committee oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Director of Information Technology and members of our cybersecurity committee are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: Security Awareness Training, Patch Management Process, Endpoint Detection and Response, Managed Detection and Response, Incident Response Plan, Data Encryption, Access Control, Network Security, Vulnerability Management.

companyName: Arcellx, Inc.

ticker: ACLX


text: Inland has established a Computer Security Incident Response Team ("Inland CSIRT"), which aims to manage and mitigate the impact of cybersecurity breach events, including those arising from or impacting our Advisor, Dealer Manager and service providers (including the transfer agent), tenants, and other business contacts. Members of the Inland CSIRT include Inland's VP Director of IT Infrastructure & Information Security, who has more than 20 years of experience in information technology security and leads Inland's cybersecurity program, and its Head of Technology Strategy, as well as members of the firm's legal, risk, and communications groups. Inland has established a notification decision framework to determine when the Inland CSIRT will provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including members of our Advisor's management, and our Board and Audit Committee, as appropriate.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: The Company faces risks from cybersecurity threats that could potentially have an adverse effect on our business, financial condition, results of operations, cash flows and reputation. Although such risks have no t materially affected our business, to date, we have experienced various immaterial threats to our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled "Security breaches and other disruptions in the Company's IT systems, including the Company's ERP system, could limit the Company's capacity to effectively monitor and control our operations, compromise ours or our employees', customers' and suppliers' confidential information, or otherwise adversely affect the Company's operating results or business reputation" in Item 1A. Risk Factors.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our Chief Technology Officer ("CTO"), Vojtech Rysanek. Our CTO has served in that position since November 2022, and, prior to Groupon, he was previously the CTO at Aukro, the largest online marketplace in the Czech Republic. Mr. Redmond has served in this position for the last year and has worked at Groupon for over 7 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in VMware Carbon Black, and prior to that held roles in Skyscanner. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.

companyName: Groupon, Inc.

ticker: GRPN


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition as of the end of fiscal year 2024. Our Risk Factors include further detail about our material cybersecurity risks.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: If a large scale cyberattack or other major security incident results in unauthorized access to or modification or exfiltration of a significant amount of our customers' or suppliers' data, other external data, our own data or our IT systems, or if the services we provide to our customers are disrupted, or if our products or services are reported to have (or are perceived as having) security vulnerabilities, we could incur significant expenses and suffer substantial damage to our brand and reputation, and this could result in a material impact on our business. Refer to "Data Privacy, Cybersecurity and Intellectual Property Risks" in Risk Factors included in Item 1A within this Annual Report for additional discussion of the challenges we encounter with respect to cybersecurity risks.


text: Our CPO previously served as the Global Data Privacy Officer for Hitachi Vantara LLC and prior to that practiced at the law firm of Littler Mendelson, P.C. as an attorney specializing in data privacy among other areas.

companyName: UNISYS CORP

ticker: UIS


text: We currently do not have a cybersecurity incident response plan with respect to our data and information systems. We rely on Our Town and their cybersecurity consultants as well as our franchisors, to maintain cybersecurity incident response plans applicable to their systems and hotel-level systems they manage on our behalf.

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors has responsibility for the oversight of risk management, including as to risks from cybersecurity threats. In its risk oversight role, our Board of Directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. The Board of Directors has delegated to the Audit Committee of the Board of Directors the responsibility for the oversight of information technology, including cybersecurity risks. Member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: Cybersecurity incidents detected by our cybersecurity team are evaluated internally based on their severity, with more serious incidents being escalated, as appropriate, to the highest levels of management, including our CTO, General Counsel and, ultimately, our CEO. These members of our executive leadership team are provided with details of the type and severity of the attack, the company's planned response to the incident and are briefed on what information was accessed and the impact such incident has had or is expected to have on our operations, as well as any financial or regulatory implications resulting from the incident.

companyName: Liberty Global Ltd.

ticker: LBTYA


text: A cross-functional incident response team, comprised of representatives from information technology, information security, product security, engineering, privacy and legal, is responsible for the monitoring and disposition of potential occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan. Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of our information assets.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: The chief information officer, the vice president, IT infrastructure and cybersecurity and the chief information security officer are responsible for assessing and managing material risks from cybersecurity threats and have careers that represent more than 75 years of combined experience related to the management and protection of technologies. These individuals participate in or receive updates from not only the cybersecurity incident response team but also cybersecurity oversight committees, such as the Cybersecurity and Resiliency Committee comprised of various members of management, including the chief executive officers of FPL and NEER, the chief financial officer and the chief legal officer and the Cybersecurity Governance Executive Committee comprised of various members of management, including vice president of internal audit and executive director of emergency preparedness. These committees are charged with governing cybersecurity, cyber risks and resilience activities as well as the cyber and physical security policies and programs for NEE and its subsidiaries.

companyName: FLORIDA POWER & LIGHT CO


text: We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets. We have implemented and maintain a security risk management program that is designed to preserve the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Board of Director's Oversight of Risks from Cybersecurity Management, under supervision of the Company's CEO and CFO, has developed a system of internal controls that identifies risks to the Company, designed controls intended to reduce risks to an appropriately low level, implemented control procedures, and subsequently tested such control procedures. Management presents an enterprise risk management assessment to the Audit Committee on a quarterly basis and provides the Audit Committee with frequent updates of specific financial statement risks. Risks associated with cybersecurity are included in these risk assessments, subjected to testing of key controls, and reflected in management's reports to the Audit Committee. The full Board of Directors receives periodic briefings on selected risk matters, and is invited to participate in each Audit Committee meeting and, as such, provided with the same information presented to the Audit Committee.

companyName: VISTA GOLD CORP

ticker: VGZ


text: In 2024, we did not identify any cybersecurity incidents or threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.

companyName: Investview, Inc.

ticker: INVU


text: We identify and assess cybersecurity risk in connection with our enterprise risk management ("ERM") process, which is directly tied to our management's strategic planning process.

companyName: Open Lending Corp

ticker: LPRO


text: Our COO, together with our internal IT team, are responsible for assessing and managing cybersecurity risks. They review at least quarterly with our expert advisors our cybersecurity measures and procedures in view of the Company's cybersecurity risks to anticipate future threats and trends, and determine whether and how to adjust our strategies and processes accordingly. During the year ended December 31, 2024, we did not identify risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks or threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "We depend on data and our information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."

companyName: NextCure, Inc.

ticker: NXTC


text: To help manage cybersecurity risks, we have implemented a cybersecurity program consisting of security risk assessments, testing, continuous surveillance, dynamic incident response services and business continuity planning. Our cybersecurity program utilizes the guidelines of the National Institute of Standards and Technology Cybersecurity Framework to define material risks and establish controls designed to protect, detect, respond to and recover from cybersecurity incidents. In addition, we engage consultants to assess our resilience against applicable practices and standards for our industry.

companyName: Great Lakes Dredge & Dock CORP

ticker: GLDD


text: Our management companies are ultimately responsible for our guests' information, and we monitor these companies, as well as other third-party service providers, to ensure that they are complying with our privacy, information security and cybersecurity policies. We also assess the cybersecurity proficiency of potential third-party cloud suppliers before utilizing their services.

companyName: RLJ Lodging Trust

ticker: RLJ


text: We presently do not have any substantial activities that require cybersecurity strategies; however the following will be adopted once we begin operations: recognize that cybersecurity risks pose a significant threat to the confidentiality, integrity and availability of our information systems, and to our ability to execute on our business strategy and protect stakeholder interests. Our approach to cybersecurity is anchored in formal policies, robust controls, ongoing risk assessment and clear governance structures.

companyName: ALEXANDER TECH CORP


text: Cybersecurity Risks In addition to the reliance on our own information technology systems, we rely on the information technology systems of our hotel managers to protect proprietary and customer information as well as our third-party service providers who support key portions of our operations. Any compromises of our own network or the networks of our hotel managers or third-party service providers could materially affect our business, financial condition and results of operations. For a discussion of our cybersecurity risks, refer to "Part I - Item 1A. Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our hotel managers' or our own information technology and systems, including third-party service providers, could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K. Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us. We carry insurance that helps provide protection against the potential losses arising from cybersecurity incidents, although we may incur expenses and losses related to a cybersecurity incident that are not covered by insurance or are in excess of our insurance coverage.

companyName: Park Hotels & Resorts Inc.

ticker: PK


text: Sixth Street tests its cybersecurity defenses regularly through automated and manual vulnerability scanning, to identify and remediate critical vulnerabilities. In addition, it conducts annual "white hat" penetration tests to validate its security posture. Further, Sixth Street engages in cyber incident tabletop exercises and scenario planning exercises involving hypothetical cybersecurity incidents to test its cyber incident response processes. Tabletop exercises are conducted by Sixth Street's Technology Risk team in collaboration with outside service providers as appropriate and includes members of Sixth Street's senior management and Legal/ Compliance team. Learnings from these tabletop exercises and any events that Sixth Street experiences are reviewed, discussed, and incorporated into its cybersecurity framework as appropriate. In addition to Sixth Street's internal exercises to test aspects of its cybersecurity program, Sixth Street periodically engages independent third parties to assess the risks associated with its information technology resources and information assets. Among other matters, these third parties analyze data on the interactions of users of Sixth Street's information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of the cybersecurity systems and processes.

companyName: Sixth Street Specialty Lending, Inc.

ticker: TSLX


text: Our business strategy, results of operations, and financial condition have not, to date, been affected by risks from cybersecurity threats.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: Our information technology team executes a series of preventive, detective and responsive measures aimed towards managing our cybersecurity risks, including the following:

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.

companyName: AT&T INC.

ticker: T


text: See "Risk Factors – Our internal computer systems, or those used by our third-party contractors or consultants, may fail or suffer security breaches, resulting in liability and harm to our reputation, which could negatively affect our business, results of operation and financial condition. We may face liability if we breach our obligations related to the protection, security, nondisclosure of confidential information or disclosure of sensitive data or fail or are perceived to fail to comply with applicable data protection laws and regulations, or consumer protection laws, regulations and standards. "

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX