text: We believe that cybersecurity is a critical part of our overall risk management, which is supported by both our management and our Board of Directors. We believe that we face the same external threats common to other participants in the infrastructure sectors, which include ransomware and malware attacks in addition to the risks brought on by the vendor supply chain. Through the leadership of our Vice President of Information Technology, who reports to our Chief Financial Officer, we routinely assess these threats and evaluate our landscape for new vulnerabilities, considering both for their probability of occurrence as well as their perceived potential impact. We supplement our risk assessment processes with robust identification tools which we review routinely through the use of intrusion prevention and detection systems. We supplement our internal procedures with third parties, who routinely assess our network infrastructure for vulnerabilities both internal and external to our firewall. We also conduct periodic training and awareness programs for all of our employees with systems access in order to drive adoption and awareness of their critical roles in cybersecurity processes and controls.

companyName: NWPX Infrastructure, Inc.

ticker: NWPX


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Poseida Therapeutics, Inc.

secItem: Item 1C


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion. Our internal auditors perform audit engagements to assess our strategies, policies, procedures, and controls to reduce the risk of a cybersecurity incident.

companyName: BATTALION OIL CORP

ticker: BATL


text: We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. The Company's general risk management program is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: The Company maintains processes designed to identify, assess, and manage material risks from cybersecurity threats to its information systems. These processes are proportionate to the size and nature of the Company's operations and are integrated into the Company's overall risk management practices.

companyName: REST EZ Inc.

ticker: RTEZ


text: The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program.

companyName: FuboTV Inc.

ticker: FUBO


text: The Head of Global ISGA maintains a Certified Information Systems Security Professionals, or CISSP, certification and has more than two decades of IT security management experience. The IT security team is supported by external vendors that provide managed services for network support, security operations and other IT areas as needed. Our IT security team also meets regularly with our Global Privacy Committee, which oversees our Enterprise Data Protection Program, to coordinate on cybersecurity initiatives and strategy related to protection of personal data.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: Our Chief Financial Officer is responsible for management oversight of our information security program and controls, which includes cybersecurity risk management. Our Director of IT ("Director") is responsible for the development, operation, and maintenance of our information security program and controls.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: We have established and implemented processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity risk management efforts are led by our Chief Information Security Officer ("CISO"). We deploy technical safeguards designed to protect the Company's information systems from cybersecurity threats, including firewalls, network access control, end point protection, privileged access management, user behavior analytics, and multi-factor authentication, among others, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We also perform robust security reviews of third-party software vendors prior to purchasing their software or engaging their services. We maintain a comprehensive, risk-based, third-party risk management process to identify, oversee, assess, and manage cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: ACUITY INC. (DE)

ticker: AYI


text: Ongoing Monitoring and Reporting of Cybersecurity Incidents The Company has an internal security team, supplemented with third-party security partners, to consistently monitor, detect and respond to potential cybersecurity incidents. The Company has a cybersecurity incident reporting protocol that provides a mechanism for the appropriate members of management and the Board to be made aware of cybersecurity incidents. The Company also requires security awareness training for all employees to enable employees to understand their role in preventing and reporting cybersecurity incidents.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: We utilize third party cybersecurity consultancy firms to manage and execute our cybersecurity programs. These third party firms are led and supervised by our Chief Information Officer ("CIO"). Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. On a quarterly basis, our third party cybersecurity consultancy firms perform phish testing and on demand information security training. On a yearly basis, our third party consultancy firms perform, among other trainings and assessments, information security awareness training, internal cybersecurity risk assessments, internal and external penetration tests, key vendor risk assessments, incident response tabletop exercises, written information security and business continuity plan policy gap analysis reviews and revisions as well as incident response plan reviews and revisions. The results of the assessments are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, Audit Committee and members of management.

companyName: Ridgepost Capital, Inc.

ticker: RPC


text: With oversight from our Board, the Audit Committee, a special working group comprised of two of our Board members, and key leaders across Kforce, we have put proactive measures and systems in place to protect our information assets from unauthorized use or access, including annual employee training. The Firm's cybersecurity framework is based on the National Institute of Standards and Technology ("NIST").

companyName: KFORCE INC

ticker: KFRC


text: In 2023, we did not identify any cybersecurity threats or incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to Our Business and Industry" in this annual report on Form 10-K.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: Cybersecurity risks are communicated and discussed with our Board of Directors at least annually in conjunction with our overall ERM program. Internal Audit provides periodic updates to the Audit Committee on testing completed to meet TSA requirements. As part of its oversight responsibilities, our Board of Directors also receives frequent updates from executive management on our company's physical and cybersecurity efforts.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Risks Associated with Third-Party Service Providers In addition, we implement robust processes to oversee and manage risks associated with our business arrangements with third-party service providers. All new Simpson third-party business agreements are reviewed and assessed by our Information Security Team. We also perform information security program investigations on the security posture of, and assess any publicly known information security events related to, these third-party service providers. If a third party service provider with a business agreement with Simpson experiences an information security breach or incident, our Information Security Team reviews and assesses such event to understand Simpson's overall exposure to the security incident.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The Bank's board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology and cyber-related business impact. This committee provides oversight and governance of the technology program and the information security program. The committee is chaired by managers within the enterprise information technology department and include the Chief Information Officer, Chief Technology Officer, and Information Security Officer. The committee meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings may occur to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Bank's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Operations Team in our Information Technology department which reports directly to the CIO. The Cybersecurity Operations Team is primarily responsible for evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: We have implemented a set of comprehensive cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees receive annual cybersecurity awareness training, including specific topics related to social engineering and email frauds. We utilize an outsourced information technology firm and consultants with significant expertise in cybersecurity. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Kinetic Seas Inc.

ticker: KSEZ


text: Our DevOPS/Security Manager leads our cybersecurity program and is tasked with supporting our security functions of identifying, preventing, detecting, responding to, and recovering from cybersecurity threats and incidents. The DevOPS/Security Manager has 27 years of experience in IT networking, administration, and security related roles, including nine years at the Company. Prior to joining the Company, our DevOPS/Security Manager served for 15 years in a senior leadership role in the IT department of a large, publicly traded Fortune 500 company. The DevOPS/Security Manager provides quarterly updates to the Cybersecurity Committee on the Company's cybersecurity program, including cybersecurity risks, incidents, and mitigation strategies. Our DevOPS Security Administrator has experience developing and maintaining an IT security program for a Fortune 500 company, has a bachelor's degree in information technology, and maintains a Comptia Security+ certification. The Company has established processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: As of the date of this Annual Report on Form 10-K, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. For more information, see "Risk factors - If our internal information technology systems or sensitive information, or those of our third-party CROs or other contractors or consultants, are or were compromised, we could experience adverse consequences from such compromise, including but not limited to, a material disruption of the development of our product candidates, regulatory investigations or actions, litigation, fines and penalties, reputational harm, loss of revenue or profits, and other adverse consequences."

companyName: Anebulo Pharmaceuticals, Inc.

ticker: ANEB


text: Cybersecurity Risk Assessment — We have integrated cybersecurity risk management into our broader Enterprise Risk Management ("ERM") framework to promote a company-wide culture of cybersecurity risk management. Our ERM framework is designed to identify and prioritize company-wide risks, including cybersecurity threats, and integrate mitigation measures into our business, operational and capital structure planning activities. The purpose of the ERM framework is to enable the Board and executive leadership to (1) align risk management with strategic objectives, (2) identify risks, including cybersecurity risks, throughout the organization, (3) assess and prioritize risks that could impact the Company's operational and strategic objectives, (4) develop and monitor risk mitigation initiatives, and (5) report and assess material risks, mitigation strategies and progress to the Board and/or its applicable committees. Cybersecurity risk is reviewed by a cross-functional, management-level ERM Steering Committee as part of the Company's overall enterprise risk management program.

companyName: TALOS ENERGY INC.

ticker: TALO


text: Managing Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our IT service provider to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Gyrodyne, LLC

ticker: GYRO


text: Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our finance, compliance, law and human resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents. These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents are included in the course of regular meetings of such committees. Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents are made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule. Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our accounting and law functions on a quarterly basis.

companyName: AMGEN INC

ticker: AMGN


text: The Board has ultimate oversight responsibility for the Company's risk management and recognizes the importance of protecting the data provided by the Company's customers and employees and devotes considerable time and attention to overseeing the strategies the Company employs to protect our data and systems and to mitigate against cybersecurity risk. A cybersecurity expert chairs the Risk Committee and provides technology-related insight and guidance to the Company. As part of the Risk Committee's responsibility for monitoring key business and regulatory risks, the Risk Committee receives from both our Chief Information Officer and CISO quarterly reports and materials which include a review of cybersecurity and information technology key risk indicators, test results and related remediation, and any recent cybersecurity threats or incidents and how the Company is managing those threats or incidents. The Risk Committee also periodically reviews reports on the threat environment, vulnerability assessments, results of penetration testing, and potential cybersecurity and data privacy incidents, as well as information on ongoing employee training relating to data privacy and cybersecurity and how to protect data against cyber threats. Further, on a quarterly basis, our CRO presents to the Risk Committee updates from our Director of Enterprise and Operational Management on the Company's business continuity program, which covers, among other things, outages and incidences and disaster recovery and business continuity testing. The Risk Committee also approves the annual risk assessment required by the Gramm-Leach-Bliley Act. Moreover, the CISO follows a risk-based escalation process to notify the Risk Committee outside of the cycle of regular updates when management has identified an emerging risk or material issue related to cybersecurity. The Risk Committee also reports material cybersecurity risks to the full Board, based on our CISO's assessment of risk. In addition, the Audit Committee reviews reports of the Company's internal audit department's periodic audits of our information security area and various components thereof.

companyName: SouthState Bank Corp

ticker: SSB


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the board of director's continuing education on topics that impact public companies. Members of our management team, including our CFO, General Counsel, Vice President of Finance, Vice President of Quality, and IT Senior Director, are responsible for assessing and managing our material risks from cybersecurity threats. This cybersecurity management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. This team includes individuals with significant experience running or overseeing cybersecurity programs at similarly sized biotechnology organizations and navigating the associated risk landscape.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Our corporate information security organization, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The corporate information security organization manages the Company's enterprise security structure with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Central to this organization is our carefully selected combination of security tools that concentrate on both perimeter and internal environments. These solutions are responsible for the protection, detection and response capabilities used in the defense of Patrick's data and enterprise computing networks. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses, which we believe improves our cybersecurity program.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Board of Directors Oversight of Cybersecurity Risks The Board of Directors is responsible for overseeing Arcadium Lithium's Enterprise Risk Management, which includes cybersecurity reporting.

companyName: Arcadium Lithium plc


text: The Company's cybersecurity risk management program leverages the National Institute of Standards and Technology Cybersecurity Framework for identifying, assessing, and managing material risks from cybersecurity threats. This approach combines prevention and detection techniques, informed by internal and external sources, to identify and analyze potential threat activities. When a threat is identified, a cyber incident response plan outlines the Company's procedures for containing, remediating, and recovering from the cybersecurity incident. Cybersecurity tenets are also incorporated into the Company's technology policies.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Our DO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: We rely extensively on various information systems and other electronic resources to operate our business. In addition, nearly all of our customers, service providers and other business partners on whom we depend, including the providers of our online banking, mobile banking and accounting systems, use their own electronic information systems. Any of these systems can be compromised, including by employees, customers and other individuals who are authorized to use them, and bad actors using sophisticated and a constantly evolving set of software, tools and strategies to do so. The nature of our business, as a financial-services provider, and our relative size, make us and our business partners high-value targets for these bad actors to pursue. See "Risks Related to Information Security and Business Interruption" section of the Risk Factors included in Item 1A of this 2024 Form 10-K for additional information. Implementing an Information Security Program that establishes policies and procedures for security operations and governance;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Regulatory, Intellectual Property, Cybersecurity and Privacy Risks" in this Annual Report.

companyName: Polaris Inc.

ticker: PII


text: The Corporation uses an integrated cybersecurity incident response plan ICIRP designed to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Corporation and with our Board of Directors, notify law enforcement and other government agencies, and notify customers and employees. The ICIRP provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the CIRST. The CIRST facilitates coordination across key stakeholders of the Corporation. The Corporation's CISO and key members of management are members of the ICIRP. The Corporation provides the CISO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Corporation's data for the benefit of our customers, employees and shareholders. We periodically engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Corporation's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact. Materiality is determined by considering qualitative and quantitative factors. The CSIRT team also conducts tabletop exercises to simulate responses to cybersecurity incidents. The Sponsor's team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: CNL Strategic Capital, LLC


text: o The Company evaluates the risk profile of its third-party service providers and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed. The information security team periodically reviews key vendors and counterparties' cybersecurity practices and may conduct audits or assessments at its discretion.

companyName: IMAX CORP

ticker: IMAX


text: Our cybersecurity program is designed to identify, assess, and mitigate risks from cybersecurity threats, and includes the following elements: • a risk assessment process to identify and assess cybersecurity risks; • a risk mitigation strategy to address cybersecurity risks; • an incident response plan to identify, respond to, mitigate and remediate cybersecurity incidents; • an awareness and training program to educate employees about cybersecurity risks; • a procedure to procure information technology services, including cloud computing and data storage, from third-party providers with sufficient cybersecurity provisions, and to monitor their cybersecurity process on an ongoing basis; and • periodic testing and evaluation by external parties we engage to assess the effectiveness of the cybersecurity intrusion protections and make recommendations to improve the security of our information systems.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: Monitoring Cybersecurity Incidents The IT Manager and other information security staff utilizes vendor relationships and various other internet based daily updates for the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This knowledge is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The IT Manager provides structure for clear processes to ensure the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, we believe we are equipped with a well-defined Incident Response Plan that is adequately resourced. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevent future incidents.

companyName: Gouverneur Bancorp, Inc./MD/

ticker: GOVB


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, see "Risk Factors–Risks related to our dependence on third parties–Our information technology systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business."

companyName: Upstream Bio, Inc.

ticker: UPB


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives regular reports from the CIEC on our cybersecurity risks. In addition, CIEC updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Board also receives briefings from IRT on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CIO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: QUANTUM CORP /DE/

ticker: QMCO


text: As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: The Board oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership regularly briefs the Board on our cybersecurity and information security posture and the Board is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance to Rumble On.

companyName: RideNow Group, Inc.

ticker: RDNW


text: Our team of cybersecurity professionals is led by our Chief Information Officer, who has over 20 years of experience in cybersecurity in regulated industries. Our cybersecurity team monitors the prevention and detection of cybersecurity events and is responsible for incident response and remediation.

companyName: AGENUS INC

ticker: AGEN


text: Cybersecurity Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: WhiteHorse Finance, Inc.

ticker: WHF


text: Risk Management and Strategy Albany International Corp. views cybersecurity risk management as a cornerstone of our Enterprise Risk Management ("ERM") strategy, and we are committed to protecting our digital assets and sustaining investor confidence. Cybersecurity risks we face include data breaches, operational disruptions, reputational harm, and regulatory fines. Such incidents could lead to shutdowns or disruptions of or damage to our systems and those of our customers and suppliers, and unauthorized disclosure of sensitive or confidential information, potentially including personal data and proprietary business information. Unauthorized disclosure of, denial of access to, or other incidents involving sensitive or confidential Company, employee, customer or supplier data, whether through systems failure, employee negligence, fraud, misappropriation, or cybersecurity, ransomware or malware attacks, or other intentional or unintentional acts, could damage our reputation and our competitive positioning in the marketplace, disrupt our business or our customers' businesses, cause us to lose customers and result in significant financial exposure and legal liability.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: A cybersecurity threat resulting in a material cybersecurity incident could materially affect us and our business strategy, results of operations and financial condition, especially if it causes one or more of the following to occur: our incurring substantial costs to resolve the incident and address legal, reputational and other fallout from the incident; one or more of our IT systems become unavailable to operate our business; unauthorized third parties gain access to our sensitive and confidential business information; we lose access to information on our IT systems necessary to operate our business; and our customers' and suppliers' trust in our ability to protect their information is damaged to the extent that it impairs our ability to do business with them.

companyName: Sylvamo Corp

ticker: SLVM


text: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data necessary, the use of third-party security experts if and when an incident is detected.

companyName: Transit Pro Tech Inc.


text: We implement and maintain controls and capabilities for identifying, assessing, and managing risk from cybersecurity threats to the confidentiality, integrity, or availability of our information systems or any information residing therein. We also carry out broad-scope initiatives and project-specific initiatives aimed at continuously improving our cybersecurity posture. Our risk assessments and initiatives include identification of reasonably foreseeable internal and external risks, assessing the likelihood and potential impact that could result from such risks, and planning and implementing risk management controls as applicable. As a result, we adapt safeguards and processes in order to reduce identified risks in our security posture. Our cybersecurity processes form a part of our overall risk management practices and inform our annual enterprise risk assessment conducted by our internal audit team.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Under the supervision of our SVP, Engineering and our VP, IT, Infra & Security, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.

companyName: Rent the Runway, Inc.

ticker: RENT


text: Additional information on cybersecurity risks we face is discussed in "Risk Factors" in Item 1A, which should be read in conjunction with the foregoing information.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: Company's cybersecurity risk management program is supervised by our Senior Manager of Information Security (SMIS), who reports directly to the Company's Chief Operating Officer ("COO") in Pakistan. The SMIS and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current SMIS received his Bachelors in Computer Sciences and has over 20 years of cybersecurity experience, including relevant prior senior leadership experience at our companies. Furthermore, he has also achieved globally recognized information security certifications, including CISSP (Certified Information Systems Security Professional), CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CRISC (Certified in Risk and Information Systems Control), CompTIA Security+, ISO 27001 Lead Auditor, CEH (Certified Ethical Hacker), CHFI (Computer Hacking Forensic Investigator), among others.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: As of and for the year ended December 31, 2024, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.

companyName: Royale Energy, Inc.

ticker: ROYL


text: In connection with these risk assessments, we design, implement and maintain reasonable safeguards to minimize the identified risks and address identified gaps in existing safeguards, update existing safeguards as necessary and monitor the effectiveness of our safeguards.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: These processes are managed and monitored by a dedicated information technology team, led by our Chief Information Security Officer ("CISO"), who also serves as our Chief Information Officer, and include mechanisms, controls, technologies, systems and other processes designed to prevent or mitigate data loss, theft, misuse or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we conduct penetration and vulnerability testing, data recovery testing, security audits and ongoing risk assessments, including due diligence on and audits of our key technology vendors and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends and their impact on the Company's risk environment. We also rely on information technology and third party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.

companyName: DocGo Inc.

ticker: DCGO


text: While to date, we have not experienced a significant compromise, attack, or loss of data related to cybersecurity attacks, due to the nature of our business, we are under constant threat of an attack and could experience a significant cybersecurity event in the future. Potential risks we could face from a cybersecurity event are discussed in "Risk Factors" above.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Key elements of our risk management procedures and processes include: • risk assessments to help mitigate material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • formal information security training program for all team members as well as supplemental training on specific matters such as phishing and email security best practices; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • attack and response simulations at the technical level and execute tabletop response exercises at the management level; • a third-party risk management process for service providers; and • cybersecurity insurance to cover certain expenses in the event of a cybersecurity incident.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: The principal objectives of our Cyber Program are to minimize the risks associated with cybersecurity threats to our business operations, financial performance and financial condition, and protect the confidential information, intellectual property, and other assets of Manhattan, and those of our customers, vendors, partners, employees, and consumers that can be at risk due to cybersecurity threats to Manhattan.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: The nature of our business provides us with access to personal health information ("PHI") which is considered protected data under the Health Insurance Portability and Accountability Act of the 1996 ("HIPAA"). Our data storage and websites that access PHI are HIPAA compliant.

companyName: Polomar Health Services, Inc.

ticker: PMHS


text: Genworth's CISO is an information technology and security professional with 24 years of experience and 12 years of service at Genworth. In his 24 years of experience, he has held roles in information technology infrastructure administration, information technology infrastructure, security consulting and security administration. He received a Bachelor of Science Degree in Business Administration from Regent University and is a Certified Information Systems Security Professional (CISSP).

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: To date, the risks from cybersecurity threats have not materially affected us. Notwithstanding our investment in cybersecurity, however, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition.

companyName: Ingredion Inc

ticker: INGR


text: Third-party security firms are used in different capacities to provide or operate some of these controls and technology systems, including cloud-based services and platforms. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring.

companyName: KELLANOVA


text: Our Director of Cyber Security & Infrastructure ("DCSI") oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed security provider, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry's risk profile and threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party test our incident response processes.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Our business depends on the availability, reliability, and security of our information systems, networks, data, and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could adversely affect our operations, customer service, product development, and competitive position. They may also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are likely to, materially affect us, our business strategy, results of operation or financial condition. For more information on the risks from cybersecurity threats that we face, refer to Part I, Item 1A. "Risk Factors," of this Annual Report on Form 10-K, including but not limited to the risk factors titled, "We may be vulnerable to both physical and cybersecurity breaches, which could disrupt our operations and have a material adverse effect on our business, financial condition and results of operations" and "We may be exposed to cybersecurity threats and breaches, which could have a material adverse effect on our business, financial condition and results of operations."

companyName: Core Scientific, Inc./tx

ticker: CORZ


text: Our IT Director leads day-to-day IT operations across all areas of the business and is responsible for advising on the strategic and operational processes related to our cyber risk management program. Our current IT Director has over 25 years of IT management experience, including over 15 years of experience in cybersecurity management in both public and private companies. In addition, we have assembled an IT Steering Committee, or ITSC, which is comprised of the Executive Leadership Team as well as IT management, to support management and to maintain visibility of the status and ongoing strategy of our cybersecurity program.

companyName: RAPID MICRO BIOSYSTEMS, INC.

ticker: RPID


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. At the highest level, the Company's program includes multi-layered governance by management, the Audit Committee and the Board of Directors.

companyName: Uniti Group LLC


text: Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures: • Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate. • Conduct exercises to ensure the company is prepared to respond to cyber incidents. • Align the cybersecurity program with NIST cybersecurity framework. • Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors. • Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: We take a holistic, multi-layered approach to cybersecurity and privacy that combines traditional Defense-in-Depth methods with next-generation Zero Trust principles. In developing our cybersecurity risk management program, we are informed by industry benchmarks and standards, including the cybersecurity framework created by the National Institute of Standards and Technology ("NIST") and the Software Assurance Maturity Model developed by the OWASP (the "OWASP SAMM"). We also have various security-related certifications and authorizations, including ISO 27001, SOC 2 Type II and FedRAMP, for certain of our products and services.

companyName: PTC INC.

ticker: PTC


text: Our board of directors, in coordination with the Audit Committee, oversees our risk management program, including the management of risks associated with cybersecurity threats. Our board of directors and Audit Committee receive periodic updates on developments in our cybersecurity risk management practices, evolving standards, third-party vulnerability assessments, and information security issues. On an annual basis, our board of directors and the Audit Committee discuss our approach to overseeing cybersecurity threats with senior management, including our Chief Executive Officer ("CEO").

companyName: I-ON Digital Corp.

ticker: IONI


text: Mr. Patel has over 10 years of experience overseeing an Information Technology function. Our VP of Information Security has over 25 years of experience in leading cybersecurity functions across strategy, architecture, engineering, and operations.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. This data is consolidated in centralized repositories, assessed using industry-standard practice risk quantification models, and prioritized for remediation based on risk and impact to the business. We have in the past used widely adopted risk quantification models, including those described in National Institute of Standards and Technology (NIST) special publications as well as the FAIR Institute's Factor Analysis of Information Risk (FAIR) methodology for Quantifying and Managing Risk to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards, and may continue to use these or other models in the future. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and continuously improve our security measures and planning. We have a role-based security training program under which all staff undergo mandatory periodic security awareness training, with additional on-the-job security training and coaching provided to our IT and technology personnel by an external third-party cybersecurity firm. We continuously enhance our cybersecurity measures by providing ongoing simulated phishing exercises to our employees to increase their preparedness to address potential threats. The results of these assessments are reported to the Audit Committee as discussed below under "--Cybersecurity Governance."

companyName: Emerald Holding, Inc.

ticker: EEX


text: Processes and Risk Assessment Fortress's cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in its funds and its employee information; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with executive management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.

companyName: AmBase Corp

ticker: ABCP


text: No risks from cybersecurity threats, including as the result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, operational disruptions, be subject to litigation, civil or criminal investigations, regulatory intervention or incur costs related to remediation, payment of ransom or penalties, including as a result of unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Inotiv's cybersecurity risk management framework is grounded in external standards, specifically those of the National Institute of Standards and Technology (NIST) and the Center for Internet Security (CIS). These guidelines provide a strong, structured foundation designed to systematically protect business operations, customer data, and intellectual property in an environment of rapidly evolving cyber threats. We deploy a multifaceted security strategy that includes multi-factor authentication (MFA), advanced malware defenses, and comprehensive endpoint protection supported by Extended Detection and Response (XDR) technology. Additionally, we leverage the expertise of a third-party provider of Managed XDR services, which provides continuous monitoring across our environment to respond swiftly to potential security events.

companyName: Inotiv, Inc.

ticker: NOTV


text: Our board of directors are responsible for overseeing our policies and practices related to corporate governance including cybersecurity risks. On a quarterly basis, our board of directors and audit committee receive a report from management on our cybersecurity threat risk management processes and strategies. Outside of quarterly meetings, our board of directors and audit committee are notified following any cybersecurity incident and meet to address and identify the cybersecurity threat's severity levels. Our board of directors and audit committee also review management's materiality assessment regarding any cybersecurity incident requiring disclosure to the SEC.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: The Company's Cybersecurity Program ("CSP") drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer ("CSO").

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: The Board of Directors (the "Board") retains ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. The Board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee receives a cybersecurity report from the Chief Technology Officer and the information security team. This report may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each report are determined based on current priorities and emerging issues in cybersecurity. The Audit Committee, along with the Chief Technology Officer and the information security team, also report to the Board at least annually on data protection and cybersecurity matters.

companyName: WELLTOWER INC.

ticker: WELL


text: Our cybersecurity program is managed by our Chief Technology Officer. Most of the information generated and collected by us is stored and maintained by third-party vendors and service providers, who have demonstrated their own cybersecurity protocols which our management believes to be adequate for protecting our digital files in their possession. Our CTO is responsible for assessing and managing cybersecurity risks. Our CTO has cybersecurity expertise. We have no formal cybersecurity policies and processes in place; however, the Board and management believe cybersecurity represents an important component of our overall approach to risk management and oversight.

companyName: Mobiquity Technologies, Inc.

ticker: MOBQ


text: Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity-related risks is integrated into our overall risk management framework. The Company conducts an annual cybersecurity risk assessment and reports the most significant risks and associated planned mitigation strategies to the Audit Committee of the Board of Directors. The annual risk assessment is carried out under the supervision of the President of Nucor Business Technology, the Company's Cybersecurity Director, and the Company's Vice President and Corporate Controller. See "Governance" below. The Board also regularly receives focused presentations regarding cybersecurity risks from the Company's Cybersecurity Director.

companyName: NUCOR CORP

ticker: NUE


text: Material Impact of Cybersecurity Risks Cybersecurity threats have the potential to disrupt operations, compromise sensitive data or lead to regulatory penalties. Our proactive risk management processes are designed to minimize the likelihood and impact of such events. As of March 31, 2025, we did not experience any cybersecurity incidents.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Currently, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on our reputation, business strategy, results of operations or financial condition.

companyName: Coterra Energy Inc.

ticker: CTRA


text: We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our Company grows, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, Governance

companyName: Pelthos Therapeutics Inc.

ticker: PTHS


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly, as well as through the audit committee, which has been tasked with such oversight in the audit committee charter. The audit committee of our board of directors reviews cybersecurity and information security risks and mitigation strategies; the audit committee receives periodic updates on information security and privacy, and the full board receives at least an annual update.

companyName: QuantumScape Corp

ticker: QS


text: Our CIO has developed expertise in cybersecurity, compliance, enterprise architecture and design, data analytics, digital transformation, and customer service through years of experience in the information technology space. Our Director of Cybersecurity is designated as the senior executive responsible for cybersecurity and reports directly to our CIO. He has a comprehensive information technology background with 30 years of information technology experience, to include 10 years of systems architecture and design, 12 years of management, and 14 years of service in managing, or assisting in managing, cybersecurity related risks.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: As one of the critical elements of enterprise-wide approach to risk management, our cybersecurity program is focused on the following key areas:

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: Our management team is responsible for assessing and managing risks from cybersecurity threats. The Vice President, Global IT and Senior Vice President, Risk and Internal Controls have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. They provide briefings to the management team, including the Chief Financial Officer/Chief Operating Officer and the General Counsel and Secretary, as well as the Board and the Audit Committee. Their briefings include topics such as threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us. The briefings also cover alerts and reports produced by security tools deployed in our IT environment. Our Vice President, Global IT has over 20 years' experience leading teams in cybersecurity, and designing and securing critical IT infrastructure in the healthcare, biotech and sports entertainment sectors. Our Senior Vice President, Risk and Internal Controls has more than 30 years' experience designing, implementing and leading risk management, internal control and compliance programs, including cybersecurity, data privacy and business resilience, in global organizations.

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: In the event of a cybersecurity incident, CTBI maintains incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level t o each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) determined to be at a critical threat level is escalated to a group consisting of CTBI's Chief Executive Officer and certain other officers, including the Chief Legal Officer, Executive Vice President/Operations, Chief Risk Officer, and Chief Financial Officer for review.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: The company conducts a security assessment for potential suppliers and service providers, which includes detailed interviews, questionnaires, and cyber-risk scoring. This process extends beyond initial engagement, with ongoing monitoring to identify emerging security risks or changes in suppliers' risk profiles.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: As an externally managed company, the Company's day-to-day operations are managed by the Adviser and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior New Mountain Capital professionals and our Adviser is a subsidiary of New Mountain Capital. As such, we rely on the cybersecurity policies and procedures implemented by New Mountain Capital. Below are details New Mountain Capital has provided to us regarding its cybersecurity program that are relevant to us.

companyName: New Mountain Net Lease Trust


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of trustees on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A.—Risk Factors—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.

companyName: New Mountain Private Credit Fund


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Our Chief Information Security Officer, who reports to our Chief Information Officer, brings to bear more than two decades of experience implementing NIST cybersecurity frameworks, including most recently five years as chief information security officer for a Fortune 200 company. He also holds multiple certifications including the globally recognized Certificate Information Systems Security Professional designation since 2006. The Chief Information Security Officer leads a dedicated team of internal IT employees, along with multiple long-term third-party security vendors. Our board of directors, and the Care, Compliance, & Cybersecurity Committee of the board, supports our Chief Information Officer and Chief Information Security Officer by leveraging members' experience with information technology and management, including information technology strategy and risks associated with cybersecurity matters, as part of its oversight function.

companyName: Enhabit, Inc.

ticker: EHAB


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include responding to internal and external threats to the security, confidentiality, integrity and availability of our data and information systems. We may detect potential vulnerabilities and anomalies through our technical safeguards and we have adopted policies relating to the notification of and response to cybersecurity incidents.

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: Our cybersecurity risk management program is designed as a holistic program focused on predicting, preventing, detecting, and responding to cybersecurity threats across enterprise systems as well as the operational technology systems for our plants and pipelines.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: Continuous improvement is integral to our cybersecurity approach. Regular assessments, conducted with the expertise of external security firms against international standards, allow us to quantify our program's effectiveness. The insights gained from these assessments serve as a foundation for continuous improvement efforts. Outcomes are reported to our Audit Committee for transparency and accountability. We rely on services from a variety of third-party providers to supply things such as cloud storage and networks. On an annual basis, we review these providers to assess their risk profiles. We rely on these third parties to have their own cybersecurity programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: SunOpta Inc.

ticker: STKL


text: Management's Role Managing Risk Senior IT leadership play a pivotal role in managing cybersecurity risk and keeping the Audit Committee apprised of cybersecurity developments. Senior IT leadership provide comprehensive briefings to the Audit Committee on a periodic basis. These briefings encompass a broad range of topics, including: current cybersecurity landscape and emerging threats; status of ongoing cybersecurity initiatives and strategies;

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Atlanta Braves Holdings and Braves Holdings have also established a Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at Braves Holdings, including cybersecurity. The Compliance Committee is composed of members of Liberty's ISSC as well as the Braves Holdings executive leadership team, including the President and Chief Executive Officers of the Baseball and Development divisions, Chief Financial Officer and Chief Legal Officer. The Head of Information Security provides periodic updates to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example thread intelligence providers, cybersecurity software providers, managed cybersecurity service providers and cybersecurity testing firms.

companyName: Repare Therapeutics Inc.


text: Our information security incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the incident response leadership team. The incident response leadership team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's information security incident response plan includes reporting to the cybersecurity committee chairperson of the board of directors for certain cybersecurity incidents and, if appropriate, the cybersecurity committee and the board of directors.

companyName: NETGEAR, INC.

ticker: NTGR


text: The Company activated their incident response plan to address a security incident in 2024. The Company is not aware of additional cybersecurity threats or any material cybersecurity incidents to date that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: Our Board of Directors has a process in place to monitor management's oversight of cybersecurity. This is done primarily through regular reports to its Risk Committee as well as the full Board of Directors. Management provides reports on the emerging cybersecurity threat landscape and our cybersecurity risk management program, including our risk evaluation, the results of independent third-party security assessments, and our efforts to manage cyber related risks.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: Under the direction of our chief information officer with oversight from management's steering committee, the Company has implemented a cybersecurity incident response plan that sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to all stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the chief information officer would, as soon as practicable, inform management's steering committee, the members of which would then collaborate with the chief information officer to manage material risks.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: The CIO has primary responsibility for assessing, monitoring and managing our cybersecurity risks, informed by thirty years of experience focusing on cloud, cybersecurity, and privacy in leadership roles at public companies. The Security Director also has thirty years of experience in the software and security industry, with executive positions in product security, security intelligence and data science. In his capacity at iRobot, the Security Director implements and oversees information security processes and regularly informs the Chief Financial Officer and CIO of cybersecurity developments, including potential threats and risk management techniques.

companyName: IROBOT CORP

ticker: IRBTQ


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Regulatory, Intellectual Property, Cybersecurity and Privacy Risks" in this annual report on Form 10-K.

companyName: Polaris Inc.

ticker: PII


text: Although the Company has confidence in the security measures and processes it deploys to protect its environment from cybersecurity threats, neither the Company nor the third parties it relies on may be able to fully, continuously, and effectively implement security controls as intended. As stated above, we utilize a risk-based approach and judgment to determine which security controls to implement, and it is possible we may not implement appropriate controls if we fail to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate, but not fully eliminate, risks, and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: We have made significant investments in people, processes, and technology to protect the confidentiality, integrity, and availability of our IT systems. As part of that effort, we utilize the National Institute of Standards and Technology Cybersecurity Framework as a guide for our security controls. We are continuing to advance towards an architecture based on "Zero-Trust" principles, where we continuously validate the identity and security posture of every user, device, application, or network component trying to leverage our IT resources. We temper this architecture with a business-risk-based approach that ensures we protect our digital assets while aligning our security measures with our overall organizational goals and priorities. In addition, our employees undergo annual security awareness training to improve their understanding of cybersecurity threats, and their ability to identify and escalate potential threats.

companyName: BROWN FORMAN CORP

ticker: BF-A


text: Additionally, we maintain a privacy risk management program to evaluate risks associated with the collection, usage, sharing, and storage of customer data. An independent third-party assesses our privacy risk management program, to evaluate efficacy and to benchmark against industry standards.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Historically, and at the time of this filing, we have not experienced cybersecurity incidents that were deemed by the company to be material individually or in the aggregate, or reasonably likely to be material, but we have experienced cyber attacks of varying degrees in the past.

companyName: CME GROUP INC.

ticker: CME


text: We seek to provide a secure working environment by establishing and maintaining effective security measures to protect the Company's employees, properties, technology, and our customers' assets from potential threats, including cybersecurity threats. Accordingly, we have implemented numerous controls, technologies and processes and have integrated operational measures into our overall risk management system to assess, identify, and manage material risks from internal and external cybersecurity threats.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: The nature of our business exposes us to cybersecurity threats and attacks that can lead to the unauthorized acquisition or access, compromise, loss, misuse or theft of our data, including personal information, confidential information or intellectual property. To date risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition. See Part 1, Item 1A, Risk Factors, in this Annual Report on Form 10-K for a discussion of cybersecurity risks.

companyName: Bark, Inc.

ticker: BARK


text: Our management team, including our Chief Financial Officer, and our external information technology service provider are responsible for assessing and managing our material risks from cybersecurity threats. We have outsourced implementation and day-to-day function of our overall cybersecurity risk management program to our third-party information technology service provider. Our management team supervises both our internal personnel and our third-party information technology service provider.

companyName: Contineum Therapeutics, Inc.

ticker: CTNM


text: We are committed to establishing and maintaining comprehensive incident response and recovery plans to address our response to a cybersecurity incident.

companyName: ALIMERA SCIENCES INC


text: Our board of directors as a whole has overall responsibility for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our CEO and our executive management team are responsible for briefing our board on cybersecurity risks on a regular basis. Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team, and briefs our senior management and CEO on cybersecurity risks and policies. This ensures that the senior management are kept abreast of the cybersecurity posture and potential risks faced by the Company.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: Ares' cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Ares prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor or Ares. Ares' cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity threats, including those which may impact us, our Advisor or Ares, is integrated into Ares' Enterprise Risk Management program, which is overseen by the Ares Enterprise Risk Committee (the "Ares ERC"), as discussed below. In addition, Ares periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing preparation of cybersecurity policies and procedures, testing of incident response plans, engagement of vendors to conduct penetration tests. Management participates in cybersecurity incident response efforts by being a member of the incident response team and helping direct the company's response to cybersecurity incidents.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: The Executive Director of Information Security & Compliance has served in various roles in information technology and information security for over 30 years, including serving as the Vice President of Information Technology and Executive Director of Information Security & Compliance for two large companies. The Executive Director of Information Security & Compliance holds undergraduate degrees in information systems and operations management, as well as graduate degrees in information systems and finance and has attained the professional certification of Information Technology Project Management. The Company's CEO, CFO and General Counsel, Corporate Secretary and Chief Risk & Compliance Officer each hold degrees in their respective fields, and each have over 20 years of experience managing risks at the Company or at similar companies, including risks arising from cybersecurity threats.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: We require third-party service providers to certify their ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect the Company.

companyName: Zhuoxun Hongtu Inc.


text: W e use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines. We also engage with outside risk experts and industry groups, including other peer institutions, as needed, to help us evaluate potential future threats and trends, particularly with respect to emerging information security and fraud risks. In addition, we use a third-party to help mitigate risks with our third- and fourth-party providers; however, our ability to monitor our service providers' cybersecurity practices is limited. We generally have agreements in place with our service providers that include requirements related to cybersecurity and data privacy. We cannot guarantee, however, that such agreements will prevent a cyber incident from impacting our systems or information. Additionally, we may not be able to obtain adequate or any reimbursement from our service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cyber incidents attributed to our service providers in relation to any data that we share with them. To offset non reimbursement of a cyberthreat or liability expense of an incident we maintain cyber insurance.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: Landbay Inc

ticker: LNBY


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a primarily domestic presence, with our cybersecurity threat operations designed with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, software updates and patches, anti-malware functionality and access controls, all of which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity threats and risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic mandatory training for personnel regarding cybersecurity threats, which reinforces the Company's information security policies, standards and practices, and such training is scaled to reflect the roles, responsibilities and information systems access of such personnel. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested, evaluated and adjusted periodically. • Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, internal audit and other key business functions, as well as the members of the Board of Directors and the Audit Committee in an ongoing dialogue regarding cybersecurity threats and incidents.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents;

companyName: Wilhelmina International, Inc.

ticker: WHLM


text: Our board of directors administers its cybersecurity risk oversight function directly through the audit committee. Through its regular meetings with management, including the finance, legal, and risk management functions, the audit committee reviews and discusses all significant areas of our business, including cybersecurity risks, and summarizes for the board of directors all areas of risk and the appropriate mitigating factors. The audit committee is responsible for the oversight of cybersecurity risk monitoring and assessment, and the officers and information technology personnel who oversee monitoring and assessing strategic risk exposure and the day-to-day management of material risks.

companyName: ALPINE IMMUNE SCIENCES, INC.


text: Our Board recognizes the importance of maintaining the trust and confidence of our customers, suppliers, business partners and employees. Our Board, through the Audit Committee, oversees our cybersecurity program as part of our enterprise-wide approach to risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our risk management approach and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • development of a multi-year cybersecurity roadmap and prioritization rubric based on risk; • a contracted third-party security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our response to cybersecurity incidents and (4) actively monitoring for threats; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: We obtain cybersecurity threat intelligence information from law enforcement reports and our cybersecurity operations providers and communicate this information to relevant stakeholders within the organization. We employ third-party cybersecurity operations providers to monitor cybersecurity events and provide rapid responses to any critical events. In addition, we employ contractual provisions to require our third-party information service providers to implement and maintain appropriate security measures over the information we entrust to them. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging larger, well-known third-party service providers with significantly greater cybersecurity capabilities than we possess. Because we rely on their greater expertise, our ability to identify and remediate weaknesses or vulnerabilities in the services they provide is limited. We have not engaged third parties to assess our cybersecurity defenses or to audit our cybersecurity program, nor have we conducted direct or indirect technical evaluations of the information systems that our third-party service providers use.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading " Failure of our information technology systems, including cybersecurity attacks or other data security incidents, could significantly disrupt the operation of our business." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: PEDEVCO CORP

ticker: PED


text: We have established a security committee, which contains management representation from our information technology, legal, and finance groups. The security committee includes our Vice President – Information Systems, who has more than 15 years of experience in the following information technology areas: compliance, security, auditing, vendor management, and systems and network operations. The security committee oversees our cybersecurity incident response plan and is responsible for assessing and managing cybersecurity threats and evaluating the potential impact of such threats on our business strategy, results of operations, and overall financial condition. The security committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment. Our Vice President - Information Systems is responsible for proposing strategies and tactics to mitigate cybersecurity threats, which are subject to review and approval by the security committee.

companyName: Five Point Holdings, LLC

ticker: FPH


text: At least annually and on a periodic basis, our audit committee receives an update from management on our cybersecurity threat risk management and strategy processes and generally receives materials on our ability to mitigate current and emerging risks. Our processes require that our audit committee is designated to receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: SYNLOGIC, INC.

ticker: SYBX