text: We implement technical, physical, and organizational measures designed to manage and mitigate risks from cybersecurity threats. For example, we employ multifactor authentication, single sign-on, and email filtering services across our systems. Additionally, we conduct monthly video-based cybersecurity awareness trainings across our workforce, which cover relevant topics such as social engineering, phishing, password protection, confidential data protection, and mobile security. We regularly perform company-wide phishing tests. We currently leverage multiple third-party service providers to assist in monitoring, managing, and detecting cybersecurity threats and conducting periodic vulnerability assessments of our critical assets.

companyName: Invivyd, Inc.

ticker: IVVD


text: We engage consultants or other third parties in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures and monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Jaguar Health, Inc.

ticker: JAGX

secItem: Item 1C


text: Our management team has formed a dedicated group, including our General Counsel, Chief Technology Officer, and key information technology team members from our information technology security, compliance, vendor management office and our project management office, which is responsible for assessing and managing our material risks from cybersecurity threats. This group meets on a quarterly basis to discuss the results of our cybersecurity and privacy matters and to evaluate new technologies from a security, operational, and regulatory perspective prior to their implementation. Their findings are summarized in a comprehensive report that is reviewed by our Audit Committee. Our Chief Technology Officer has over 30 years of experience in cybersecurity related to infrastructure (on-premise and cloud based), security (managed both internally and by third-party providers), and development (agile and waterfall methodologies). Our Chief Technology Officer is supported by a team of information security and compliance professionals and third-party partners.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: We experience cyber-attacks of varying degrees on a regular basis in the ordinary course of our business. As of the date of this report and for the time period of January 1, 2023, through December 31, 2023, the Company is not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, there can be no assurance that we will not be materially affected by such risks in the future. For information on the cybersecurity threats and risks we face and the potential impacts on the business related thereto, see Item 1A. Risk Factors – Risks Related to Security Vulnerabilities and Service Reliability.

companyName: LIVEPERSON INC

ticker: LPSN


text: Engaging Third Parties on Risk Management We engage a range of external experts, including consultants, auditors, and cybersecurity assessors, who assist us in evaluating and testing our cybersecurity systems and processes. These partnerships are intended to give us access to specialized knowledge and insights that can inform our cybersecurity strategies and processes, including as to industry-standard control frameworks and applicable regulations, laws, and standards.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: One of the key functions of our Board is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: Allakos Inc.


text: We use a third party to perform annual security assessments. This includes both external penetration testing and internal vulnerability testing, as well as a security program maturity assessment based on the NIST framework (National Institute of Standards and Technology). External testing consists of scanning all our public IP addresses for open ports and determining if any device or service on those ports have known vulnerabilities. Internal vulnerability testing is performed from within the network to determine if any known vulnerabilities exist due to outdated patches or insecure configurations. The security program maturity assessment is a review of our policies and practices against a set of standard best practice controls identified by the NIST to determine a maturity level score. We use this assessment to focus our efforts on continually improving our cybersecurity policies and practices. We currently do not have any formal processes to oversee or identify cybersecurity risks associated with third-party service providers but our Director of Information Technology generally evaluates such risks.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: We also perform annual internal assessments and audits of internal processes and controls related to cybersecurity and engage third-party experts to support the assessment of cybersecurity related risks, including cybersecurity penetration testing. The results of these assessments, audits and tests are reported to the CIO and CFO.

companyName: MOOG INC.

ticker: MOG-A


text: In conjunction with management, the CIO regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks. Key performance indicators, emerging threats, current trends and notable detections are reported to members of the Company's senior leadership team. The global cybersecurity team also works closely with our legal team to address legal, regulatory and contractual requirements.

companyName: ESAB Corp

ticker: ESAB


text: The Company maintains cybersecurity programs according to the set of guidelines developed by the National Institute of Standards and Technology through the Cybersecurity Framework. The Company maintains a set of IT Security Standards that provides a framework of layered security protection. In addition, the Company maintains and communicates to its workforce a Use of Information Technology Policy to support the understanding of and commitment to safely using IT assets. This knowledge can help prevent accidental or intentional misuse of Company IT resources, which can compromise the confidentiality, integrity, and availability of sensitive data and systems. The Company requires cybersecurity training to raise awareness and educate employees about cybersecurity risks. The Company updates its training program at least annually.

companyName: STEPAN CO

ticker: SCL


text: The Information Security & Compliance team is led by the Executive Director, Information Security and Compliance, who has 27 years of experience in IT and Security, including business risk management and cybersecurity, and reports to the Chief Information Security Officer (CISO), who has over 26 years in information technology and security roles. The Information Security & Compliance team has established processes and procedures that guide and enable continuous monitoring, detection, prevention, mitigation, and remediation of cybersecurity incidents. These processes are carried out using various security platforms tools, capabilities and strategies including tests of the Company's information security program, tabletop exercises, penetration and vulnerability testing, disaster recovery (DR) simulations, and other exercises to evaluate the effectiveness of the information security program and improve the security measures and planning. The Incident Response team utilizes procedures that identify escalation paths when security events are identified. Incident priorities dictate the escalation of events and how an Incident manager reports them to the executive leadership team within the Company and to the Board of Directors.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: At AssetMark, cybersecurity risk management is an integral part of our comprehensive enterprise risk management program. Our approach to cybersecurity risk management is designed to follow our industry's best practices, identifying, monitoring, assessing and responding to cybersecurity threats and incidents. This includes managing risks related to third-party vendors and service providers and facilitating coordination across different departments of the Company.

companyName: AssetMark Financial Holdings, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Principal Security and Infrastructure Architect with over 20 years managing large scale enterprise security systems and programs.

companyName: Definitive Healthcare Corp.

ticker: DH


text: Management is accountable for our day to day risk management activities. With the assistance of our third-party IT and cybersecurity team, we employ a range of tools and services, including a governance, risk and compliance platform to inform our managements' risk identification and assessment relating to our technology program. With this platform, we map our cybersecurity and risk management program to the Center for Internet Security ("CIS") framework.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Risk Assessment and Management Our approach to managing material risks from cybersecurity threats, which is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework (though we do not imply that we meet any particular technical standards, specifications or requirements), is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure to vulnerabilities. the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security risks.

companyName: FUEL TECH, INC.

ticker: FTEK


text: For additional information about cybersecurity risk, see "Item 1A. Risk Factors - We and our hotel manager rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business."

companyName: Sotherly Hotels Inc.

ticker: SOHOO


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • development of a multi-year cybersecurity roadmap and prioritization rubric based on risk; • a contracted third-party security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents and (4) actively monitoring for threats; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: As of December 31, 2024, we were not aware of any cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition. As discussed more fully under Part 1, Item 1A. Risk Factors, the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient. No matter how well designed or implemented the Company's cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner. See Part 1,

companyName: Certara, Inc.

ticker: CERT


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, mitigate or remediate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident impacting our data at a third-party vendor or customer. Contracts with third-party vendors, who have access to our network or who hold or store personal information on our behalf, contain provisions requiring such vendors to maintain a program that meets our information security standards. We periodically assess risk of vendor compliance with our information security program requirements, including the obligation that our vendors must notify First Advantage within a designated time period upon identifying certain cybersecurity events. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our cybersecurity risk management program includes but is not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • an annual tabletop exercise conducted by a third party to simulate a cyber emergency and practice our response to such a scenario; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for relevant service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Commerce.com, Inc.

ticker: CMRC


text: While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of our hotel managers, which are the third-party operators of our hotels and resorts, or of our franchisors. Although we set clear expectations of our hotel managers and franchisors, we rely on our hotel managers and franchisors for managing their cybersecurity risk. We conduct surveys of our hotel managers and franchisors to assess their cybersecurity risk management programs and procedures, to identify gaps and request remediation and to understand our risk exposure. Many of our hotel managers and franchisors carry cyber insurance policies to protect and offset a portion of potential costs incurred from a security breach. Additionally, we currently have cyber insurance policies to provide supplemental coverage above the coverage carried by our hotel managers and franchisors.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: In addition, to detect cybersecurity events, we deploy security logging and monitoring, malicious code detection, and data loss protection tools. If the company is the target of a cybersecurity attack, we have established processes for incident response and crisis management to detect and triage potential incidents and determine severity, contain, and eradicate a threat. These processes also include steps to recover our systems and information through established and exercised system recovery plans and business continuity plans. Our incident response process includes steps to notify regulatory and other governmental authorities of cybersecurity events as required by law, including providing notice to investors for material cybersecurity events.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: We provide training to our management and employees designed to equip employees with the knowledge and skills necessary to identify and respond to cybersecurity risks, tailored based on the persons' roles within our organization.

companyName: Jet.AI Inc.

ticker: JTAI


text: Management's role in assessing and managing our material risks from cybersecurity threats, as well as making final materiality determinations and disclosures and other compliance decisions, is documented in the CNX IRP, and our processes for identifying, prioritizing, and remediating vulnerabilities are documented via the Company's vulnerability management program procedures. In connection with and pursuant to the IRP, our dedicated incident response team works collaboratively across CNX to carry out a program that has been designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to potential cybersecurity incidents.

companyName: CNX Resources Corp

ticker: CNX


text: Our CSO has served as such since 2021, and has over 20 years of experience in various roles in information security, including serving as an IT security leader at AT&T/Warner Media, where he implemented an extensive security program managing complex incident response events. He holds a degree in Information Technology.

companyName: N-able, Inc.

ticker: NABL


text: We, like any technology company operating in the current environment, have experienced cybersecurity incidents in the past. However, as of the date of filing this Annual Report on Form 10-K, we have not previously experienced any cybersecurity incidents that were determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Yext, Inc.

ticker: YEXT


text: As part of our product development activities, we have implemented the Trimble Secure Development Life Cycle ("TSDLC"), which uses overlapping security activities and controls to build robust security into the cloud-based products and services we provide, some of which are also deployed across our own IT infrastructure. TSLDC includes vulnerability scanning, intrusion prevention, tracking of security metrics, and code analysis vulnerability tools. Over 100 of our products are certified to ISO/IEC 27001:2013, which addresses secure information, resilience to cyber-attacks, existence of a centrally managed framework, organization-wide protection, responses to evolving security threats, and protection of data.

companyName: TRIMBLE INC.

ticker: TRMB


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer in consultation with our Chief Executive Officer and Legal Counsel. Such individuals and their respective teams have collectively over ten years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee and our board of directors annually about cybersecurity threat risks, among other cybersecurity related matters.

companyName: Profound Medical Corp.

ticker: PROF


text: We rely on our systems and networks to support our business activities. As some of these networks and systems are managed by third parties, our cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with our use of third-party service providers. Based on their risk profiles, we contractually require certain third parties with access to our information systems or data to maintain cybersecurity programs and to report actual or suspected security incidents to us. Additionally, we monitor and identify cybersecurity risks posed by third-party vendors based on their criticality and risk profile, who provide software and/or hardware to the Company or otherwise have access to our Company systems and have a cyber review process that is part of vendor onboarding.

companyName: Seaport Entertainment Group Inc.

ticker: SEG


text: We have not experienced any material cybersecurity incidents in the past calendar years and the expenses we have incurred from cybersecurity incidents during that time were immaterial. We have not identified risks from known cybersecurity threats that have materially affected us, including our operations, business strategy, results of operations or financial condition.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: Our cybersecurity risk management program is aligned to the Company's business strategy. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: General Motors Financial Company, Inc.


text: These aforementioned security measures are integrated into our broader enterprise risk management strategies. Cybersecurity risks identified through the processes described above under Item 1. Business - Risk Management are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are regularly reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these services have included external penetration testing, audit services, legal counsel, threat intelligence, forensic investigation, and managed security service providers.

companyName: ONITY GROUP INC.

ticker: ONIT


text: Our Chief Information Security Officer, who reports to our Chief Risk Officer, is responsible for managing our information security team, maintaining and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats, subject to oversight by and reporting to the Board Risk Committee, which in turn reports directly to the Board. In addition to the Board Risk Committee, two of our management committees are also involved in overseeing risks from cybersecurity threats: our Enterprise Risk Management Committee and our Information Security Sub-Committee. These two management committees report to the Board Risk Committee, which in turn reports directly to the Board.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. The cybersecurity organization provides the IT leadership, which includes Chevron's CIO, with regular cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The leadership of the cybersecurity organization has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.

companyName: CHEVRON CORP

ticker: CVX


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our own and our customer's information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding such incidents can be made by management, the Board of Directors, and legal counsel in a timely manner.

companyName: VirnetX Holding Corp

ticker: VHC


text: We are not aware of any existent weakness in our systems or malware embedded in our systems that are likely to would materially affect, or are reasonably likely to materially affect, our operations.

companyName: AiXin Life International, Inc.

ticker: AIXN


text: While we have experienced cybersecurity incidents in the past, to date none have materially affected the Company or our financial position, results of operations and/or cash flows. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Our business and operations could be adversely impacted in the event of a failure of our information technology infrastructure or adversely impacted by a successful cyber-attack."

companyName: ASTRONICS CORP

ticker: ATRO


text: We have a unified and centrally-coordinated team, led by our Vice President of IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Vice president of IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: In particular, our information security program and approach is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The NIST Framework establishes core requirements related to information protection, processes and technologies. In addition, we maintain a Data Protection Framework and various policies, including Information Security Policy, Privacy Policy, and Records & Information Management Policy, to appropriately manage personal information necessary to operate our business and comply with applicable regulations. We also maintain a Third-Party Risk Management Program, including a Vendor Management Policy, which allows us to better oversee, monitor, identify and control certain risks related to the processing of personal information and customer information by our authorized third parties.

companyName: Argo Group International Holdings, Inc.


text: Our employees are one of our strongest assets in protecting our customers' information and mitigating cybersecurity risk. We maintain comprehensive and tailored training programs that focus on applicable privacy and cybersecurity requirements. Additionally, we make strategic investments in cybersecurity to protect our customers and information systems, including both capital expenditures and operating expenses for hardware, software, personnel and consulting services.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: As is the case for all companies in our industry or with a significant digital presence, we are periodically subject to cyberattacks and other cyber incidents and, therefore, cybersecurity is an integral component of our overall enterprise information security program. We have adopted a multi-layered framework to secure our networks, systems, devices, products and services while also assessing, identifying, and managing cybersecurity risks. That framework is designed to help protect our information assets, operations, and resources from internal and external cyber threats by understanding and seeking to mitigate risks while ensuring business resiliency from unauthorized access or attack. Our cybersecurity policies, standards, and procedures include security risk assessments for high priority systems, third party compliance assessments for external vendors and suppliers, and incident management and breach response plans which are influenced by, and periodically assessed against, recognized cybersecurity frameworks. Our incident management policy is designed to help prevent, manage, and coordinate our response to, and recovery from, potential and confirmed cybersecurity incidents and includes processes to triage, assess the severity of, escalate, contain, investigate and remediate incidents, as well as comply with applicable legal obligations. Informa PLC's chief information security officer ("CISO") and Security team have implemented a similar framework and we collaborate on best practices, improvements, and risk assessments. Some Informa TechTarget systems are currently managed within the Informa PLC environments and overseen by the Informa PLC framework. The teams collaborate regularly and share any relevant findings.

companyName: TechTarget, Inc.

ticker: TTGT


text: The Company's Chief Information Security Officer ("CISO") and the Cybersecurity and Data Privacy Steering Committee are responsible for developing, implementing and evaluating our information security program. The CISO regularly reports on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Audit Committee. Our Chief Digital and Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decades of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.

companyName: HASBRO, INC.

ticker: HAS


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We continue to make significant investments to augment the capabilities of our people, process, and technologies in order to address our cybersecurity risks. Our cybersecurity risks, and the controls designed to mitigate those risks, are integrated into our overall risk management governance within our Global Information Security (GIS) organization. Pursuant to our current policies an update on the operations of the cybersecurity program and the risks and trends in cybersecurity are reviewed, at a minimum, annually by our Board of Directors and periodically by the Audit Committee of our Board of Directors (Audit Committee).

companyName: SYNCHRONOSS TECHNOLOGIES INC

ticker: SNCR


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based upon our assessment of their criticality to our operations and respective risk profile.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program. The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect achievement of our business, operations and strategic objectives and to understand, assess, and prioritize those risks. The ERM program also intends to facilitate the implementation of risk management strategies and risk mitigation processes across the Company that are responsive to the Company's risk profile, overall business strategies, and specific material risk exposures. The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the Company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is appropriately communicated to senior executives and the Board of Directors (Board) or relevant committees. The Board regularly reviews and discusses with members of management responsible for risk management the guidelines and policies governing the ERM process. This includes the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, in addition to the risk mitigation strategies in each instance.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Chief Financial Officer and Vice President of Affiliate Marketing are responsible for assessing and managing material risks from cybersecurity threats, as well as managing, responding to and reporting material cyber incidents if any occur. They will provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

companyName: Sharplink, Inc.

ticker: SBET


text: Customer Data Privacy Reviews. The Bank conducts independent external and internal reviews of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC. Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review the effectiveness of the Bank's internal controls, including those controls related to customer data privacy based on independent external audit and internal audit reports.

companyName: BankFinancial CORP


text: We, along with CoreSite, our data centers operations subsidiary, each maintain a management information security steering committee. We maintain two steering committees because of the distinct nature of CoreSite's business. Each committee works in collaboration with the other, including through the overlap of certain key steering committee members. Each committee meets quarterly. These committees provide direction and support for our and CoreSite's security initiatives and review operational metrics.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: The Risk Committee of our Board of Directors meets with management to review and provide oversight of certain operational areas where we have identified key risks to our business, including our cybersecurity practices. The Risk Committee reviews our strategies, governing and management framework, security principles, and training and evaluations for cybersecurity threats. As part of this review, each quarter the Chief Risk Officer presents key cybersecurity metrics and analysis to the Risk Committee.

companyName: AMERISAFE INC

ticker: AMSF


text: As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity. The Company also participates in a cybersecurity risk insurance policy.

companyName: MAXLINEAR, INC

ticker: MXL


text: The Company's endpoints and networks are monitored 24/7 by its security operations center and the Company conducts periodic reviews and testing to prevent and mitigate cybersecurity threats and respond to cybersecurity incidents.

companyName: Revance Therapeutics, Inc.


text: Equinix's cybersecurity risk management processes are carried out in the context of broader business objectives and are integrated into Equinix's broader risk management processes as described above in "Equinix Risk Management and Strategy".

companyName: EQUINIX INC

ticker: EQIX


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of business information, result in litigation costs and negatively impact our reputation among customers and partners.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: Our Chief Executive Officer and Chief Financial Officer are principally responsible for overseeing the cybersecurity risk management program, in partnership with outside consultants, as well as managing and responding to material cyber incidents if any occur. They will provide periodic briefings to the Audit Committee and to the Board of Directors about our cybersecurity risks and activities, including cybersecurity incidents and responses, cybersecurity systems testing, third-party activities and related topics. In addition, our policies for managing and responding to cybersecurity incidents include procedures for appropriate escalations to our Audit Committee Chair.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: The Adviser maintains a cybersecurity risk management process to identify and mitigate risks that impact the firm. The Adviser's Vice President, IT Security periodically discusses and reviews cybersecurity risks and related mitigants with the Adviser's Information Security Steering Committee and incorporates relevant cybersecurity risk updates and metrics.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: The management team also includes Technology SME's, Legal advisors, Business Unit leaders, HR representatives and Finance representatives to further assist our VP of Information Security and SVP of Information Technology with assessing and managing our material risks from cybersecurity threats.

companyName: StandardAero, Inc.

ticker: SARO


text: At the management level, our Information Security Steering Committee ("ISSC"), with oversight by our VP of IT and General Counsel, is responsible for leading our cybersecurity risk management program and enterprise cybersecurity matters. Under the ISSC, we have various cybersecurity working committees, led by our Cybersecurity Leaders, which are primarily responsible for operational review of cybersecurity threats and incidents as part of our incident response process. Cybersecurity Leaders receive reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents. For potentially material cybersecurity threats and incidents, we escalate these to the ISSC, which, with additional oversight and support from our interim CEO, would raise such threats and incidents to our Audit Committee Chair and, as appropriate, to our Board as they arise. If the cybersecurity incident is determined to be material, disclosure would be filed with the SEC within four business days of determination.

companyName: Lucid Group, Inc.

ticker: LCID


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: Power REIT

ticker: PW


text: Our cybersecurity risk management program includes: • responsibility for inventory and control of enterprise and software assets, technical and administrative controls and testing of our controls and security measures; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls, including monitoring and alerting; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Management works primarily with third parties (principally professional services and consulting firms) to assist them in identifying, assessing, and managing cybersecurity risks. To operate its business, the Company utilizes certain third-party service providers to perform a variety of functions and seeks to engage reliable, reputable service providers that maintain cybersecurity programs. The Company is not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect it, including its business strategy, results of operations, or financial condition.

companyName: CAPITAL PROPERTIES INC /RI/

ticker: CPTP


text: Our management is responsible for the day-to-day oversight and management of our enterprise risks, including risks from cybersecurity threats. Primary responsibility for assessing, monitoring, and managing our cybersecurity risks rests with our Chief Information and Data Officer and dedicated information security team, who develop, prioritize, and execute our cybersecurity strategy in partnership with relevant departments and business units. Our CIDO, who has over 25 years of information technology experience including cybersecurity and information security, oversees our cybersecurity framework and reports to our management-level information technology steering subcommittee and management-level enterprise risk management committee. Our CIDO is assisted in this oversight role by additional members of management.

companyName: Brand Engagement Network Inc.

ticker: BNAI


text: As of the date of filing, there are no material risks from cybersecurity threats, including those resulting from previous incidents, that have or are reasonably likely to have a material impact on our business strategy, results of operations or financial conditions. Refer to Item 1A, Risk Factors, for further information and a discussion of a previous cybersecurity incident identified at the Company.

companyName: KAMAN Corp


text: Our Information Security Policy is designed to align with certain best practices, including the EU General Data Protection Regulation (GDPR). This policy promotes the management and execution of our information security framework for preserving the confidentiality, integrity, availability and privacy of our information assets, including by helping enable us to better oversee, monitor and identify certain risks related to the processing of information by authorized third-party service providers. We also have an Information Technology (IT) Steering Committee to help ensure security and compliance across our IT services. We have in the past, and may in the future, engage third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: We have a set of Company-wide cybersecurity policies and procedures and continue building these important document libraries. Management approves initial policies and reviews them periodically for updates and changes. Our cybersecurity program follows the internationally recognized risk framework, ISO 27001. We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a multi-faceted cybersecurity strategy based on prevention, detection, and mitigation. The Company continues to work to ensure the inclusion of our cybersecurity risks are fully incorporated into the Company's overall risk management approach.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: We annually undergo an external evaluation by a third party cybersecurity firm with a specialty in penetration testing. Our vendor management group performs information security risk assessments on our third party service providers with respect to their ability to protect data from unauthorized access, and on a risk weighted basis, we perform re-assessments routinely. The Company also requires these vendors to adhere to privacy and cybersecurity measures and has a third party service provider monitoring program in place that reviews changes to the security posture of certain higher risk third party service providers. In addition, the Company negotiates appropriately protective terms in its legal agreements with these providers.

companyName: ARCH CAPITAL GROUP LTD.

ticker: ACGL


text: To manage the risks identified, the company implements controls and tests those controls for effectiveness. The Company uses the Federal Financial Institutions Examination Council Cyber Assessment Tool (CAT), the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), the NYS DFS cybersecurity requirements and the Center for Internet Security (CIS) Critical Controls to help inform the Company of best practices for control implementation and potential risk mitigation opportunities that align with defined risk scenarios, and generally as a baseline for best practice control implementation.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: WTW's management is responsible for the day-to-day management of risks, and the board, including through its committees, is responsible for understanding and overseeing the various risks facing WTW. As a professional services firm providing advice, broking and solutions in the areas of people, risk and capital, and often involving confidential and sensitive information, cybersecurity risk management is an integral part of our enterprise risk management ('ERM') strategy.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: In an effort to protect our business from cybersecurity threats, we maintain and utilize various tools and processes that are designed to identify, assess, and manage cybersecurity risks. Our cybersecurity risk management program, which is in process of being integrated into our enterprise risk management program, is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Our cybersecurity risk management program focuses on monitoring the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.

companyName: Tango Therapeutics, Inc.

ticker: TNGX


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and reporting quarterly on cybersecurity matters to the Cybersecurity and Data Privacy Steering Committee, as well as to the Board and the Cybersecurity Committee. Our Chief Information Officer is an Executive Sponsor of the Cyber Security Program, has over two decade of experience leading cyber security oversight, and others on our cyber security team have cybersecurity experience and certifications, such as the Certified Information Systems Security Professional, or other industry leading certifications.

companyName: HASBRO, INC.

ticker: HAS


text: Management Oversight Management regularly assesses and identifies potential cybersecurity risks as a key component of the Company's ERM program. The Company's cyber risks are reviewed and prioritized as part of the annual Enterprise Risk Assessment and ongoing quarterly reviews. Changes in these risks are communicated at least quarterly to the Audit Committee. Management further enables regular reviews of systemic, emerging, and ongoing security and data privacy risks through a standing body, the Privacy and Security Executive Committee ("PEC/SEC") which meets quarterly and whose reporting is used to inform the Audit Committee and annual reporting to the Board of Directors. The PEC/SEC is comprised of senior management including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, Chief Human Resources Officer, General Counsel and other senior leaders as required.

companyName: KORN FERRY

ticker: KFY


text: Cybersecurity risk management program, including, but not limited to, the following: • Risk assessment activities/analyses • Risk Committee oversight, documentation, escalation • Reporting of risk issues deemed material to our Audit Committee of the Board of Directors Cybersecurity services, including, but not limited to, the following: •24x7 Security services and Operations across (3) countries, including an Incident Response Plan and process.

companyName: Fortrea Holdings Inc.

ticker: FTRE


text: We maintain a cybersecurity incident response plan which outlines our response and action in the event of a major cybersecurity incident. The cybersecurity incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to varying levels and personnel within the Company depending on the severity of the threat, effectively communicating to stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the Senior Vice President – Technology Solutions would, as soon as practicable, inform the Cybersecurity Incident Response Team, the members of which would then collaborate with the Senior Vice President – Technology Solutions to manage material risks.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: We view cybersecurity as the prevention and timely detection and correction of any unauthorized occurrence or series of related unauthorized occurrences that are on or conducted through ADT's information systems and that jeopardizes the confidentiality, integrity, or availability of ADT's systems or any information residing therein. We believe that the safety, security, and privacy of our customers are fundamental to the services we provide. Our cybersecurity policies guide us as we strive to continuously enhance methods, best practices, and technologies to better monitor and protect customer data and inform and enable customers to make choices about their data privacy. We carefully consider data privacy when developing our own products and when incorporating products provided by our business partners.

companyName: ADT Inc.

ticker: ADT


text: The Company's President and Chief Executive Officer, Chief Financial Officer and Treasurer, Chief Operating Officer and General Counsel and Secretary (" Senior Management ") are responsible for assessing and managing cybersecurity risks with the support of the entire CSIR Team, led by the Director of Operations/Risk Management. The Director of Operations/Risk Management is the primary lead for monitoring the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and ensuring that the Cybersecurity Policies are followed. Senior Management works collaboratively with the Director of Operations/Risk Management and the entire CSIR Team to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Cybersecurity Policies. The CSIR Team also includes a third-party, on-demand IT support team, a Primary IT Support Contact, who is the technical response lead, a Primary Communications Contact responsible for handling external communications during and after an incident, as well as other delineated primary contacts in areas including, but not limited to, HR, Legal, Accounting, Asset Management and Acquisitions. Pursuant to the Cybersecurity Policies, information security incidents must be reported, without delay, to the IT support team or the Director of Operations/Risk Management, who will then advise Senior Management of the incident. Senior Management will then report such threats and incidents to the Audit Committee, when appropriate.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Cybersecurity Risk Governance and Oversight The Company's Board of Directors maintains an active role in the Company's overall enterprise risk oversight to identify and mitigate broader systemic risks. The Audit Committee is responsible for overseeing and reviewing the Company's information security programs, including cybersecurity. The Director of Global Information Systems, who manages information security training and awareness program, updates the Audit Committee periodically regarding information security matters. The findings from the Company's annual third-party and internal information security audits also are reported to the Audit Committee. The Company also actively engages with key vendors and industry participants as part of its efforts, which are reported to the Audit Committee. In addition to the Audit Committee's oversight, the full Board of Directors receives periodic updates relating to information security and cyber security risks. The Board of Directors receives an annual report from its independent cybersecurity advisor.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory and Management Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels to validate roles and responsibilities and response protocols respective to cybersecurity threats. The outcomes of these tabletop exercises are reviewed annually at the Board of Directors level.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Technical safeguards – We seek to maintain an information technology infrastructure that implements risk-based physical, administrative and technical controls to safeguard our information systems and information stored on our networks, including customer information, personal information, intellectual property and proprietary information.

companyName: DONALDSON Co INC

ticker: DCI


text: Our board of directors has delegated oversight of our enterprise risk management processes, including those relating to cybersecurity risks, to the Audit Committee.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We have established a risk-based cybersecurity and information security program ("program") designed to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management process includes policies that specify the requirements for technical security controls, monitoring systems, tools and services from third-party providers, and employee training and awareness. Our cybersecurity risk management process also includes regular independent audits across our operating units. Management oversees our cybersecurity risk management process in order to assess and manage material risks from cybersecurity threats identified by both internal and external threat intelligence. Our program monitors and evaluates risks from cybersecurity threats, and we aim to adapt our program and related processes accordingly. As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures for managing a cybersecurity incident. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.

companyName: TransDigm Group INC

ticker: TDG


text: CNDT 2023 Annual Report We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, maintain continuous monitoring during the engagement of the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.

companyName: CONDUENT Inc

ticker: CNDT


text: Third-Party Review Processes—Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data from third-party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies, and includes cybersecurity team assessments of third-party products and systems proposed to connect to our information systems environment or access our data. A subgroup of our cybersecurity team is dedicated to risk-assessment analyses of vendor security practices and protections. In certain circumstances, we enter into information security agreements with service providers to secure their commitment to maintain certain security protections.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: As part of our cybersecurity risk management processes, we regularly engage third-party service providers to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Open Lending Corp

ticker: LPRO


text: Our Information Security Department, reports to our Chief Information Security Officer who reports to the Chief Information Officer. This team is comprised of full-time information security professionals, is responsible for the implementation of our cybersecurity strategy, including assessing and managing material risks from cybersecurity threats. Our Chief Information Officer is an experienced information technology professional with 35 years of experience in the industry, including oversight of our cybersecurity department and has a degree in Management Information Systems. Our Chief Information Security Officer regularly informs our Chief Information Officer and Chief Financial Officer of any cybersecurity risks and incidents. Our Chief Financial Officer is responsible for oversight of our response to cybersecurity incidents, as appropriate. In addition, our executive management discusses cybersecurity issues quarterly.

companyName: APTARGROUP, INC.

ticker: ATR


text: Management and Strategy have no employees. Our business is externally managed by the Advisor, an affiliate of the Sponsor. We are dependent on the Advisor and affiliates of our Sponsor (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on the them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT II, Inc.


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties. We and third parties may be subject to cybersecurity attacks or security breaches. To the extent that we rely on the technologies of third parties, we depend upon the personnel and the processes of such third parties to protect against cybersecurity incidents, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our Management Team will report to the Board of Directors and provide updates on the Management Team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. Management is not aware of any cybersecurity incidents encountered by the Company since the Sponsor Handover. In addition to our own cybersecurity risks, any proposed Business Combination target, such as EEW, may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Compass Digital Acquisition Corp.

ticker: CDAQF


text: We deploy multiple tools and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents, both internal and associated with the use of any third-party service provider.

companyName: Fabrinet

ticker: FN


text: Our cybersecurity program and controls are designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risk is incorporated into the Company's broader Enterprise Risk Management program, and is managed in alignment with our business objectives and operational needs.

companyName: TreeHouse Foods, Inc.

ticker: THS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Officer, who has been designated as our Chief Information Security Officer ("CISO"), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Shake Shack Inc.

ticker: SHAK


text: I n addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates. We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Our Audit Committee directly oversees our processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.

companyName: Symbotic Inc.

ticker: SYM


text: The Company's cybersecurity risk management program is integrated into the overall risk management framework, including risk identification, assessment, and mitigation across all business areas. We have collaborated with third-party consultants and built a cybersecurity program designed to protect and safeguard the integrity of our information systems, which aligns with industry standards and regulatory requirements. Key components of our cybersecurity risk management and strategy include:

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: While we have experienced cybersecurity incidents in the past, as of the date hereof, none have materially affected us or our business strategy, financial condition, results of operations, and/or cash flows. We continue to invest in cybersecurity and resiliency of our networks to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information which they contain. For more information about cybersecurity risks relating to our business, refer to Item 1A, Risk Factors included in this Annual Report on Form 10-K.


text: Cognizant's cyber risk management program is periodically audited as part of external certification audits. We also engage third-party cybersecurity experts to assist with risk assessment and conduct penetration testing among other items. Key findings from the audits and third-party risk assessments are summarized and communicated to the Company's senior leadership and the Audit Committee, and remediation actions are implemented to enhance our overall cybersecurity program.

companyName: COGNIZANT TECHNOLOGY SOLUTIONS CORP

ticker: CTSH


text: We did not experience a material cybersecurity incident during the fiscal year ended December 29, 2023. For more information on risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see "Information technology system failures, cybersecurity incidents or other disruptions to our use of technology and networks could interrupt our operations and adversely affect our business" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: Chefs' Warehouse, Inc.

ticker: CHEF


text: We engage third party professionals to assess our cybersecurity program and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance. In addition, our internal audit function regularly meets with the cybersecurity team and periodically tests the control framework and operation of our cybersecurity incident response plan. The results of these tests are presented directly to the Audit Committee of the Board of Directors.

companyName: FRANKLIN COVEY CO

ticker: FC


text: Our Chief Information Security Officer is certified as a Certified Information Systems Security Professional (CISSP) and has significant experience in monitoring, implementation and management within the disciplines of information and personal data security, disaster recovery, and asset management. He has over 10 years of service in U.S. Army Cyber Operations and within U.S. Army Cyber Command. Our Global Data Privacy Officer has served as our head of Internal Audit for nearly 10 years and has received privacy-related certifications from the International Association of Privacy Professionals (IAPP) including Certified Information Privacy Manager (CIPM) and Certified Information Privacy Professional / Europe (CIPP/e).

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. For more information, see the section titled "Risk Factor— Risks related to product development and regulatory process— Our business and operations, or those of our CROs or third parties, may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity, which could materially affect our results".

companyName: Revolution Medicines, Inc.

ticker: RVMD


text: The policies and procedures established pursuant to the Program include: • Risk Identification – Seeking to identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners, including using audits and testing. • Protection – Implementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technology. • Detection – Detection of the occurrence of anomalies and cybersecurity events through monitoring and communication to appropriate personnel. • Response – Establishing appropriate responses when cybersecurity events are detected, including through response planning and establishment of communications channels. • Recovery – Seeking to ensure resilience and restore any capabilities or services that were impaired due to a cybersecurity incident, through recovery planning and other measures. Pursuant to the Program, the Bausch Health Information Technology Security Department develops specific cybersecurity policies, procedures and guidelines. Key cybersecurity risk drivers, mitigation strategies, and key updates are incorporated as part of our ongoing Enterprise Risk Management processes. Our executive management team is responsible and accountable for the Program, cybersecurity risks generally, and ensuring that appropriate resources are allocated to addressing such risks, with Board-level oversight from the Audit and Risk Committee of the Board of Directors. We review and seek to improve the Program through assessments from external, independent third parties, who review documentation, conduct interviews with key stakeholders, assess security roadmap progression and maturity against industry benchmarks, report on our internal incident response preparedness and help identify areas for continued focus. We also have insurance coverage for potential losses arising from a cybersecurity incident and to provide professional services that mitigate potential business impacts during cybersecurity incidents.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some vital areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. Additionally, we leverage a Security Operations Center ("SOC")-as-a-Service provider to ensure continuous monitoring and rapid response to potential threats, enhancing our ability to maintain a robust security posture at all times.

companyName: Altair Engineering Inc.


text: We recognize the importance of establishing governance and oversight over cybersecurity risks, and we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: DZS INC.


text: AerSale's comprehensive cybersecurity risk management program includes, among others: a security awareness training agenda with topics relating to phishing, spams, viruses, insider threats, suspicious activity and procedures to escalate them, as well as other safety concerns. Certain training programs are employee targeted based on their individual job responsibilities and on the potential risks associated with such roles.

companyName: AerSale Corp

ticker: ASLE


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and is designed to share common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. We have a cross-functional team composed of senior IT, cybersecurity and compliance leadership that typically meets on a monthly basis to discuss efforts to identify new or prospective risks, mitigate previously identified risks, and discuss recent cybersecurity events. This cross-functional team reports into an executive steering committee comprised of senior enterprise leadership which meets, at a minimum, quarterly.

companyName: Endeavor Group Holdings, Inc.


text: Third party vendors and suppliers also play a role in our cyber risk management program. In circumstances where such third parties will access our systems and data, our SDIS participates in the vendor management process, including the review of contractual requirements and contractually imposing obligations on the vendor to report cybersecurity incidents to us so that we can assess the impact. In addition to the incident response plan and vendor management process, our cyber risk management program includes: • an information technology and cybersecurity training program, and ongoing employee testing to evaluate the effectiveness of quarterly internal training and awareness communications; • external advisors to assist with cybersecurity risk assessment, including third-party monitoring of the Company's systems, external network penetration testing, and yearly cyber event preparedness exercises; • development of strategies to mitigate cyber risks; • crisis management, business continuity, and disaster recovery plans.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: The VRM currently is managed under the direction of the CISO, with a goal of ensuring that vendors meet obligations associated with the confidentiality, integrity, and availability of Company and customer information. Beginning with the establishment of vendor relationships, vendors are risk rated based on their criticality to the operations of Premier and the sensitivity of the information such vendor has or utilizes to provide services to the Company. These assessments include, but are not limited to, a review of financial, operational and security aspects of the vendor. After the establishment of the vendor relationship, vendors are reevaluated on a regular basis based on their criticality and risk rating, with such reevaluations being conducted either annually, every two years or every three years.

companyName: PREMIER FINANCIAL CORP


text: AFG has also adopted a Security Incident Response Plan ("SIRP") that is designed to provide a management framework across Company functions for a coordinated assessment and response to potential security incidents. The AFG CISO leads and facilitates the SIRP team, which also includes AFG's Chief Administrative Officer and Chief Human Resources Officer, AFG's Chief Financial Officer, AFG's Chief Information Officer, AFG's General Counsel and Great American Insurance Group's President and its General Counsel.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Additional cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data their customers have entrusted to us, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Topeka


text: Cybersecurity Risks To date, we have not experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition. While we recognize that evolving cybersecurity threats could pose risks, we currently believe such risks are not reasonably likely to materially affect our performance.

companyName: VERDE RESOURCES, INC.

ticker: VRDR


text: Effect of Cybersecurity Threats The company did not experienced a cybersecurity incident that materially impacted our operations during the year ended December 31, 2023, and the company is not aware of any active risks from cybersecurity incidents or risks that are reasonably likely to have a material impact on the operations of our business, including its business strategy, or financial condition. For more information on additional risks that the company might face regarding cyberattacks and cybersecurity, see "Risk Factors - Risks Related to our Business and Industry - Cyberattacks or risks related to cybersecurity could have a material effect on our business."

companyName: Microvast Holdings, Inc.

ticker: MVST


text: The purpose of our cybersecurity program is to assess, identify, manage and mitigate cybersecurity risk while supporting the achievement of our business objectives. Under our comprehensive risk management program, the Board of Directors of the Company maintains oversight of the most significant risks facing the Company, including cybersecurity risks, while senior management is responsible for the identification and prioritization of risks that are material to our business, corresponding risk-mitigation efforts and day-to-day management of our risk management program.

companyName: GULF RESOURCES, INC.

ticker: GURE


text: In an effort to deter and detect cyber threats, we periodically provide training programs to our employees on issues related to privacy and data protection, cybersecurity risks, and the importance of reporting all incidents immediately. Topics include identifying phishing, password protection, securing confidential data, and mobile security. In addition, we use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. We also perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms. Additionally, as part of our overall risk mitigation strategy, the Company obtains certain insurance policies. However, such insurance may not be sufficient in type or amount to cover us fully against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: The IS Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO") on our cybersecurity risk management program. Directors receive presentations on cybersecurity topics from our CISO as part of the board of directors' continuing education.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: We have policies and procedures designed to prevent, detect and respond to cybersecurity incidents or threats. We use industry standard security and monitoring systems that are managed by our internal information technology team with support from third-party IT services firms. We also periodically conduct security testing or hire third-parties to conduct security testing, such as phishing testing and penetration testing. The results of our security testing are reported to our chief technology officer and, when relevant, with the wider executive team.

companyName: COMPASS Pathways plc

ticker: CMPS


text: We utilize a wide range of protective cybersecurity technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. In addition, we use an information security risk management approach that includes monitoring security threats and trends in the industry, analyzing potential security risks that could impact the business, partnering with industry recognized security organizations, and coordinating an appropriate response should the need arise.

companyName: SM Energy Co

ticker: SM


text: The Audit Committee receives regular reports from management on our cybersecurity risks, which include updates on trends and threats, the Company's backup and restore systems, internal and external risk assessments, results of PCI and other security audits, and planned updates and upgrades. The Audit Committee also receives regular enterprise risk management updates, which include management of cybersecurity risks.

companyName: LANDS' END, INC.

ticker: LE


text: Based on the risk and impact assessment mentioned above, the Information Security organization forms an Incident Response Team to identify the key responders for the security incident and maintain engagement and communication throughout the incident lifecycle, which may include, among other things, containment, eradication, recovery, and a review of lessons learned. In addition to the Incident Response Team, we have also formed a Cybersecurity Committee that is notified of information security incidents for the purposes of assessing the potential materiality of any such incident. The Cybersecurity Committee consists of management and other representatives of our IT, Finance, Legal, and Internal Audit teams with assistance of third-party consultants and outside legal counsel as appropriate. When necessary, the Cybersecurity Committee will bring matters to the attention of the Audit Committee of the Board of Directors as discussed more fully below.

companyName: Vista Outdoor Inc.


text: Crescent follows National Institute of Standards and Technology standards for cybersecurity risk management and has put policies, controls and multiple layers of security in place to safeguard its systems and data, including those of the Company. In particular, Crescent deploys specialized security technology and operational controls including, but not limited to firewalls, anti-virus systems, multi-factor authentication, restricted access, and electronic surveillance/monitoring. Crescent conducts regular testing to assess information technology vulnerabilities and employee cybersecurity awareness, utilizes third-party technology solutions for real-time vulnerability management, and engages third-party consultants to conduct cybersecurity assessments and preparedness analyses periodically. Crescent also requires all employees, including those of the Adviser and the Administrator, to complete comprehensive cybersecurity training at least annually.

companyName: Crescent Private Credit Income Corp


text: use of end-to-end encryption and tokenization technology, a public key infrastructure, designed to ensure that only trusted devices can access our enterprise information technology network, and Intrusion Detection and Intrusion Prevention (IDS/IPS) that scans data in transit to help detect and prevent the execution of harmful code; and a third-party risk management process for service providers, suppliers, and vendors who have access to our information systems.

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: We face a number of cybersecurity risks in connection with our business. Although we did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: LendingTree, Inc.

ticker: TREE


text: Senior leadership provides the Board of Directors with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, third-party audit reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Audit Committee of the Board of Directors provides oversight and is responsible for assessing risks to our business, in accordance with its charter. The Audit Committee engages in regular conversations with senior leadership about our security systems in order to monitor and mitigate risks from cybersecurity incidents, in accordance with our security principles and protocols.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: GECM also provides its employees with cybersecurity awareness training at onboarding and semiannually, as well as interim security reminders and alerts. GECM's third-party consultants conduct regular phishing tests and provide additional training as appropriate.

companyName: Great Elm Group, Inc.

ticker: GEG


text: We employ an array of data security technologies, processes, and methods across our infrastructure to protect systems and sensitive information from unauthorized access. OneMedNet maintains comprehensive identity and access management practices ( e.g., roles and access privileges for each user; multi-factor authentication, privileged user accounts, single sign-on, user lifecycle management) and employs a variety of security information and event management tools. We developed, maintain and utilize a global integrated information security framework to guide our practices, based on relevant industry frameworks and laws, including, but not limited to NIST, GxP, HITRUST, the ISO 27000 family, COBIT, GDPR, and HIPAA.

companyName: OneMedNet Corp

ticker: ONMD


text: The Audit Committee of our Board of Directors oversees our cybersecurity and data privacy risk management activities, and reports to the Board regarding such oversight as appropriate. The Audit Committee receives updates from management regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: Editas Medicine, Inc.

ticker: EDIT


text: We use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and hosting companies. We have a vendor management process to manage cybersecurity risks associated with our use of these providers which includes risk assessments and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our risk management program also assesses third-party risks to identify and mitigate risks from vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition, we strive to have the appropriate cybersecurity clauses in our agreements and where necessary we have Data Processing Agreements (DPAs) put in place for privacy of data.

companyName: CHART INDUSTRIES INC

ticker: GTLS


text: Monitor emerging data protection and cybersecurity laws, and implement changes to our processes, systems and offerings designed to comply, and through policy, practice and contract (as applicable) require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; Complete several cyber-specific audits per year; and Engage consultants and other third parties in connection with our cybersecurity practices.

companyName: AvePoint, Inc.

ticker: AVPT


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K.

companyName: Nabors Energy Transition Corp. II


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;

companyName: FLANIGANS ENTERPRISES INC

ticker: BDL


text: The Board of Directors maintains oversight of cybersecurity risk primarily through its Audit Committee. The Audit Committee receives regular updates from management on cybersecurity risks and incidents and the overall effectiveness of our cybersecurity programs.

companyName: JANEL CORP

ticker: JANL


text: The audit committee assists the board in fulfilling its oversight responsibilities with respect to the management of risks arising from cybersecurity threats, and our security team provides written reports to the audit committee for its review. The audit committee is responsible for reporting findings related to its review of these matters to the board.

companyName: HUBSPOT INC

ticker: HUBS


text: We design and assess our program based on the NIST 800-53 security, a framework recognized framework that demonstrates an organization's commitment to information security. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST 800-53 1 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Metsera, Inc.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyber-attack disrupts the Company's critical operations, service or financial systems. See "Risk Factors - We are highly dependent on information technology and security breaches or systems failures could significantly disrupt our business, which may, in turn, negatively affect the market price of our securities and our ability to pay dividends."

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT