text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a breach or compromise to our information technology systems.

companyName: Guardant Health, Inc.

ticker: GH


text: We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department. Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, Payment Card Industry compliance and incident response. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the head of information security, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role. Our head of information security reports directly to the CTO who has over 20 years of restaurant technology experience. BLOOMIN' BRANDS, INC.

companyName: Bloomin' Brands, Inc.

ticker: BLMN

secItem: Item 1C


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including third-party real-time risk assessments of cyber assets and mitigation of security risks, data loss prevention, regular air-gapped backups, continuous monitoring and threat response, advanced firewall systems, and security information and event management. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Information Officer.

companyName: SERA PROGNOSTICS, INC.

ticker: SERA


text: To our knowledge, we have not experienced any risks from cybersecurity threats or incidents through the date of this annual report that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operation or financial condition. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.

companyName: GRAN TIERRA ENERGY INC.

ticker: GTE


text: Collaborating with third-party cybersecurity consultants that perform regular penetration testing, vulnerability assessments, and other procedures to identify potential weaknesses in our systems and processes; Utilizing a third-party risk management program for purposes of identifying, assessing, and managing risks involved with external service providers;

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Material Impact of Cybersecurity Risks In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of the Advisor, the Dealer Manager, our transfer agent or any other party that provides us with services essential to our operations which could negatively impact our business, financial condition and operating results."

companyName: ARES INDUSTRIAL REAL ESTATE INCOME TRUST Inc.


text: Our cybersecurity program is focused on the following: • Cybersecurity Awareness: We identify and assess cyber risks through the dissemination of information from industry groups and third-party experts. • Training: We provide annual cybersecurity training for company personnel with network access and conduct periodic simulated phishing exercises. • Technical Safeguards: We deploy measures to protect our network perimeter and internal information technology platforms, such as internal and external firewalls, network intrusion detection and prevention, penetration testing, vulnerability assessments, threat intelligence, anti-malware and access controls. • Vendor Management: We maintain data protection agreements with our vendors that contain contractual provisions requiring safeguards for the protection of personal information. In addition, vendors are screened for data security measures as part of our vendor due diligence process. • Incident Response Plans: We maintain and update incident response plans that address the life cycle of a cyber incident (i.e., detection, response and recovery), as well as data breach response plans, and test those plans annually with tabletop exercises. • Mobile Security: We deploy controls to prevent loss of data through mobile devices. • Security Standards: Our program leverages security standards such as HIPAA, HITRUST, NIST CSF, ISO 27001, and PCI DSS. • Insurance: We maintain a cybersecurity insurance program with established and respected insurance companies.

companyName: MASIMO CORP

ticker: MASI


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is promptly escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior Alphabet Inc.

companyName: Alphabet Inc.

ticker: GOOGL


text: Like all companies with an internet presence, we are regularly subject to cyberattacks and other cyber incidents, and, therefore, cybersecurity is an important element of our ongoing information technology operations. We devote significant resources to protecting and enhancing the security of our computer systems, business information, software, networks and other technology assets, by applying our cybersecurity risk management processes, which consider physical, procedural and technical safeguards. We have a multi-faceted program for assessing, identifying and managing cybersecurity risks, that is designed to help protect our information assets and operations from internal and external cyber threats by: • organizing our cybersecurity efforts based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework by applying the framework's rubric of Identify, Protect, Detect, Respond, and Recover; • seeking to understand, manage and mitigate risk while ensuring business resiliency and protecting business, employee and patient information from unauthorized access or attack; • identifying critical business information, the lifecycles of that information, and the systems where this information is stored, distributed, processed, and eventually destroyed. For example, by managing important external parties and their operations, analyzing their cybersecurity risk to our business operations, and reviewing the residual risk with business leaders to accept and manage each external party appropriately; • protecting and securing our systems from attack with secure configuration standards and protective cybersecurity tools; • detecting potential attacks through appropriate tools, including cybersecurity-related data collection and analysis to help identify potential attacks; • responding to alerts from those tools with processes to verify whether there is a real incident and the severity of that incident using appropriate resources and team members, including establishing and exercising a Cybersecurity Incident Response Plan ("IRP") based on recognized industry practices, including NIST guidance; and • establishing and exercising processes and procedures to recover from cybersecurity incidents.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: The Information Security Management Committee's responsibilities include, but are not limited to: • Setting, reviewing and supporting the components of the Information Security Program; • Monitoring significant risk trends and proposing changes to controls and policies, as appropriate; • Ensuring that information security is resourced and prioritized; • Ensuring the proper execution of risk management activities; • Establishing and maintaining a culture that promotes information security; • Reviewing and evaluating the implementation and effectiveness of the Information Security Program through regular external and internal assessments; • Maintaining cybersecurity incident response preparedness; • Providing support for and visibility to information security initiatives; and • Coordinating with the Information Security team to provide regular reports to the Compliance and Information Security Committee of the Board of Directors about audits, security issues, changes in risk postures and regulatory matters, among other cybersecurity topics.

companyName: ENVESTNET, INC.


text: Our cybersecurity-related risks are managed using a combination of documented policies and procedures, management oversight and security systems and hardware. Relevant policies are developed with the assistance of appropriate subject matter experts and are reviewed at least annually. As part of these policies and procedures, we maintain a Security Incident Response Plan (the "SIRP") that is intended to establish a structured and coordinated approach to handling cybersecurity incidents in our business.

companyName: Repay Holdings Corp

ticker: RPAY


text: The key objectives for the Company's cybersecurity program are to implement and sustain effective security controls to stop intrusion attempts and to maintain and continuously improve its ability to respond to attacks and incidents. Success in achieving these objectives relies upon using quality technology solutions, cultivating and maintaining a team of skilled professionals, and continuously improving processes. Our cybersecurity program in particular focuses on the following key areas:

companyName: BTCS Inc.

ticker: BTCS


text: We are not aware of the occurrence of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that material cybersecurity incidents will not arise or be discovered in the future.

companyName: Serina Therapeutics, Inc.

ticker: SER


text: We have implemented a Data Protection Policy, or the DPP, in order to establish the high-level direction for properly managing the use, privacy, security, retention, and disposal of our information, data and assets, and to manage identified material cybersecurity risks. The DPP was prepared using relevant guidance issued and technology standards that are used across various industries. It applies to all entities who are using our equipment and resources, including but not limited to, employees and temporary workers. Our Senior Director, Information Technology, is primarily responsible for implementing and overseeing the DPP and identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks. He is expected to become a certified Information Security Officer in March 2024.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: The Company is committed to the ongoing development and implementation of stringent processes to oversee and manage the risks associated with third-party service providers. Our policy is to conduct thorough security assessments of key third-party service providers prior to engagement, and to ensure compliance with our cybersecurity standards. Monitoring includes quarterly security assessments and annual evaluation of security controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Notwithstanding our commitment to high standards for cybersecurity, we may not always be successful in preventing a potential cybersecurity incident that could have a material adverse effect. See "Item 1A. Risk Factors" for a discussion of cybersecurity risks.

companyName: ExchangeRight Income Fund


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example dynamic vulnerability testing, third party library vulnerability scanning, end-point management, enterprise monitoring tool, Attack Surface Management, web application firewall (WAF)/distributed denial-of-service (DDoS)/constant delivery network (CDN)/domain name server (DNS) protection, and backups and recovery. We also utilize service providers to assist with cybersecurity risk assessments.

companyName: Life360, Inc.

ticker: LIF


text: The Audit Committee is responsible for the oversight of risks from cybersecurity threats. Our Vice President - IT and the IT security team update the Audit Committee on our cyber risk management program during each of its quarterly meetings. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks. The Audit Committee also receives a detailed annual update on our cybersecurity program and strategy including cybersecurity risks.

companyName: TEAM INC

ticker: TISI


text: Management of and Reporting on Cybersecurity Matters Our management assumes responsibility for assessing, identifying, and managing cybersecurity risks, threats, and incidents.

companyName: INSPERITY, INC.

ticker: NSP


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with Riot in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: We utilize a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management, internal audit and other key business functions, as well as including our board of directors in an ongoing dialogue regarding cybersecurity threats and incidents.

companyName: CEVA INC

ticker: CEVA


text: To manage our cybersecurity program, management has established a cybersecurity steering committee and cybersecurity incident response team, both led by our chief information officer. Our cybersecurity steering committee and cybersecurity incident response team include multidisciplinary groups of corporate and operational leaders, external cyber-specialist resources and technical experts in cybersecurity risk management, incident response and security operations. Many members of our cybersecurity team have extensive experience in the operations of networks, network security and infrastructure management. Our chief information officer has over 20 years of information technology experience, including leadership roles at large, global, publicly-traded companies, and is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals on the cybersecurity steering committee and cybersecurity incident response team, and through the use of technological tools and software. Our chief information officer is also responsible for updating the audit committee on cybersecurity on a quarterly basis and, where appropriate, escalating certain cybersecurity incidents to the full Board of Directors.

companyName: FULLER H B CO

ticker: FUL


text: We rely on information technology systems and networks managed and maintained by independent third-parties. Our internal team responsible for cyber security monitors daily and weekly back-ups of our information to protect against data loss and minimize disruption to our operations in the event of a cybersecurity incident. Our systems are accessible by our employees and third parties as necessary and appropriate to perform services or otherwise do business with us, and we have implemented two-factor identification for access to our systems. As part of our risk management, we provide regular training and reminders to our associates and third parties using our systems to avoid cybersecurity incidents. Our Board receives regular updates on cybersecurity systems as part of each management report.

companyName: Nano Magic Inc.

ticker: NMGX


text: Our cybersecurity framework is overseen its Information Technology (IT) Team. The IT team is geared towards developing and refining a risk-informed decision-making process, emphasizing the early identification and mitigation of cybersecurity risks. The Software Engineer leads the charge in implementing a cybersecurity risk management program, employing a mix of technological tools, rigorous processes, and external assessments to safeguard the our assets. Regular training programs, including those focused on phishing and secure data handling, are mandatory for all employees, reinforcing the culture of cybersecurity awareness.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: We also have policies and procedures in place to manage cybersecurity risks associated with third-party service providers. We impose security requirements on our suppliers, which include maintaining a security management program, complying with information handling requirements, and notifying us in the event of any known or suspected cyber incident. Where appropriate, we assess third-party cybersecurity controls and include security and privacy addenda to our vendor contracts.

companyName: CROWN CASTLE INC.

ticker: CCI


text: Verizon also operates a robust internal audit program. Each year, Verizon's internal audit team conducts an overall business risk assessment, which includes an evaluation of cybersecurity risks. The results of the assessment are presented to the leaders of the relevant business teams, who are responsible for prioritizing and addressing the risks identified.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: Our Enterprise Risk Management unit separately provides independent oversight and monitoring of the Cybersecurity Program through periodic quality control testing and regulatory compliance verification of the Cybersecurity Program's controls. Our Internal Audit unit is an independent corporate function reporting to the board of directors' Audit Committee that also reviews the effectiveness of the Cybersecurity Program and whether it is effectively integrated into our overall enterprise risk management framework. Additionally, our Enterprise Risk Management and Internal Audit units may from time to time separately engage consulting services to perform independent cybersecurity controls audits and provide expert guidance.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Our Board has delegated to its Audit Committee oversight responsibility for cyber risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements. The Head of Cyber Security provides quarterly reports to our Audit Committee regarding cyber risk trends, technology security risks, projects to continually enhance our information security systems, cybersecurity strategy, and the emerging threat landscape. The Audit Committee reports any findings and recommendations, as appropriate, to the full Board for consideration. Our cybersecurity program is periodically evaluated by internal and external resources to evaluate and enhance the effectiveness of our information security policies, controls, and procedures. The results of those reviews are reported to senior management and the Audit Committee. As part of our cyber risk management program, we track and log security incidents across our enterprise and perform third-party risk assessments to identify and attempt to mitigate risks from third parties such as vendors and suppliers.

companyName: OXFORD INDUSTRIES INC

ticker: OXM


text: We are not aware of any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our Company, business strategy, or financial results, and we have not experienced any cybersecurity incidents that have had a material adverse impact on our operations or financial results. See Item 1A. Risk Factors for a discussion of cybersecurity risks.

companyName: TUTOR PERINI CORP

ticker: TPC


text: Employee and contractor compliance is bolstered by hiring, onboarding and termination procedures that are designed to align with cybersecurity objectives. All of our employees and contractors are required to complete security awareness training (which covers the policies and other information regarding our cybersecurity programs) both at the time of hire or engagement and then on annual basis. We also routinely disseminate cybersecurity and physical security educational materials to all employees and contractors.

companyName: Repay Holdings Corp

ticker: RPAY


text: Cybersecurity incidents come to the attention of the Company from the cybersecurity team which may be notified of such incidents from internal vulnerability monitoring systems, third-party vendors, government or industry alerts, media broadcasts, or employee self-reporting. Risk assessment and mitigation efforts related to cybersecurity incidents are subject to oversight by the Cybersecurity Committee, which monitors the prevention, detection, and remediation of such incidents. The Cybersecurity Committee, which is comprised of directors from different divisions within the Company, as well as members of the cybersecurity team and the chief information security officer, oversees Company policies and procedures for protecting cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Cybersecurity Committee meets at least quarterly or whenever a material cybersecurity incident is identified at the Company. Material cybersecurity incidents, as well as mitigation efforts related to such incidents, are promptly reported to senior management.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: Strategy/Approach Spire's cybersecurity team developed a five-year strategic roadmap in 2020, which is reviewed and updated annually. A NIST-based maturity assessment is also conducted annually to assess Spire's current maturity level and is used to establish initiatives to drive capabilities in key focus areas. Such initiatives were updated to align with federal security directives issued in 2021, with a key focus on increasing overall visibility into the environment to better correlate potential security related items; completing segregation and dependency from the enterprise and industrial control systems environments; and establishing defined policies and procedures to enhance overall governance and risk management. In addition to these strategic efforts, the Company works closely with federal agencies, including the U.S Department of Homeland Security, TSA and the local FBI chapter, and is actively involved in industry information sharing groups.

companyName: SPIRE INC

ticker: SR


text: The DCSI provides periodic reports to our board of directors, as well as our Chief Operating Officer, Chief Executive Officer and other members of our senior management as appropriate, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Privilege management software provides application context to reviewers to aid in the preemptive identification of malicious activities on a system. When administrative permissions are requested, details regarding the requesting process are forwarded to our provider for review and analysis before granting administrative privileges, limiting an attacker's ability to affect and compromise systems in the environment.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Cybersecurity risks are identified and responded to by our cybersecurity team lead by our CISO. Cybersecurity incidents are managed, evaluated, investigated, and responded to in accordance with the Company's documented Cyber Incident Response Plan ("CIRP"). The CIRP is administered by the Cyber Incident Response Team ("CIRT"), which is overseen and managed by the CISO. We test and evaluate the CIRP on at least an annual basis through tabletop exercises designed to achieve incident readiness and promote cybersecurity awareness. We also from time to time engage third parties, including assessors and consultants, and our internal audit function to perform assessments, reviews, and audits on our cybersecurity measures. The results of such assessments, reviews, and audits are reported to the Audit Committee of the Board of Directors as well as the CIRT. We adjust our CIRP and other cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, reviews, and audits.

companyName: ACUITY INC. (DE)

ticker: AYI


text: As part of our Information Security Program, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • Conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • Running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Regular cybersecurity training programs for employees and directors; conducting annual customer data handling and use requirements training for all our employees; conducting annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • Monitoring emerging data protection laws and implementing changes to our processes designed to comply; • Conducting regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • Through policy, practice and contract (as applicable) requiring employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; and • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident.

companyName: GREEN DOT CORP

ticker: GDOT


text: Our CSO conducts regular cross-functional management reviews of our programs, including with members of senior leadership. All employees and those contractors of the Company with access to our information systems receive annual cybersecurity awareness training, and we have integrated cybersecurity and data protection topics into our Code of Conduct. All critical information systems supporting our clients' clinical care have a written disaster recovery plan that is exercised at least annually. The entire program is audited annually by both internal and third-party auditors.

companyName: Veradigm Inc.


text: We complete regular cybersecurity assessments to identify potential vulnerabilities and threats, analyzing our infrastructure, systems, and data. Assessments are conducted both internally and by third parties and consider internal and external factors, technological changes, regulatory requirements, and emerging cyber threats. Our cybersecurity program adheres to widely recognized standards for managing cybersecurity risk, including the National Institute of Standards and Technology Cybersecurity Framework, Center for Internet Security Controls and UK Cyber Essentials.

companyName: LITHIA MOTORS INC

ticker: LAD


text: While we maintain a strong cybersecurity posture, we continuously strive for improvement and vigilance to mitigate evolving threats within this dynamic environment and protect our stakeholders' interests. Our organization has not experienced any unauthorized access resulting from cybersecurity incidents with a materially adverse effect on our business, operations, or financial condition and we remain cognizant of the potential impact of insufficient cybersecurity measures on our operations. For further insights into additional organizational risks, please refer to the General Risk Factors section of Item 1(A) Risk Factors.

companyName: EnerSys

ticker: ENS


text: The Sponsor has adopted a cybersecurity strategy focused around a Zero Trust Network model throughout the entire operational environment, operating on the premise that no entity, system or service provider within the Sponsor's IT security perimeter can be inherently trusted. The Sponsor actively monitors its cybersecurity risks and has appointed an internal Cybersecurity Lead and partners with an outside service provider responsible for system monitoring and alerting.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: Nasdaq's brand and role as a critical infrastructure provider for global financial markets, and operator of the Nasdaq Stock Market, make us an attractive target for cybersecurity risks, including from international political opponents, hacktivists and ransomware or other financially motivated criminals targeting the financial sector. Our cybersecurity risks include financial and reputational damage, along with collateral damage from loss of customer confidence in our exchange, products or offerings, as applicable, potential regulatory enforcement actions or litigation, either from governmental authorities or shareholders, or the failure to comply with contractual breach notifications. To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. For further information, see "Our role in the global marketplace positions us at greater risk for a cyberattack" and "Expanded cybersecurity regulations, and increased cybersecurity infrastructure and compliance costs, may adversely impact our results of operations" in "Item 1A, Risk Factors" of this Annual Report on Form 10-K.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Key elements of our Cybersecurity Program, including defending against key cybersecurity threats and risks, are overseen by our Vice President of Cybersecurity, the Information Security and Risk Management (ISRM) organization, and certain legal functions under the office of the General Counsel, which includes subject matter experts focused on identifying and managing cybersecurity threats and consequences where technically feasible and commensurate with risk. Our Vice President of Cybersecurity has over 20 years of experience in cybersecurity gained across numerous leadership roles in Qualcomm's IT and Cybersecurity organization, including security architecture, risk and compliance, incident response, security operations and identity management. That experience is supplemented by the collective experience and expertise across the ISRM organization, which includes the Cyber Security Operations Center, Cyber Defense Engineering Services, Cyber Identity and Architecture, Cyber Governance Risk and Compliance, and Threat Intelligence teams, among others. The Cybersecurity Program is also supported by additional members of senior management, including our Chief Financial Officer and Chief Operating Officer, Chief Technology Officer, Chief Human Resources Officer and General Counsel, through regular reporting and review.

companyName: QUALCOMM INC/DE

ticker: QCOM


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Audit Committee of the Board of Directors. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing reports on data management, security initiatives, significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident, and any disclosure obligations arising from any such incidents.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: 4.Ongoing landscape analysis: We continually evaluate upcoming and changing data privacy regulations and provide thought leadership for our customers on the operational impacts of these regulations and compliance requirements.

companyName: BLACKBAUD INC

ticker: BLKB


text: Our cybersecurity risk management program consists of technical and organizational safeguards aimed at protecting the confidentiality of our systems and the Okta platform. From time to time, we engage external consultants and advisors to perform independent assessments and testing of our program, or otherwise assist with aspects of our program and security controls.

companyName: Okta, Inc.

ticker: OKTA


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Star Holdings

ticker: STHO


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's information technology ("IT") strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's Global Information Security ("GIS") Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board of Directors (the "Board"), the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.

companyName: BRINKS CO

ticker: BCO


text: Security Awareness and Training Through our onboarding process, each new employee is required to complete security training upon employment. Our employees also are required to complete annual security and privacy training to maintain our focus on protecting our information and that of our clients and their employees. This mandatory training educates our employees on safe handling of sensitive information, appropriate responses to a suspected data security breach, and awareness of security responsibilities. We strive to promote a healthy security awareness culture throughout the organization through supplemental education, training courses, videos, internal and external publications, and supporting activities. We also invest in our Information Security professionals with continued information security training and certifications.

companyName: Paylocity Holding Corp

ticker: PCTY


text: Our cybersecurity risk management and strategy is overseen by our Chief Information Officer as well as other members of the senior leadership team at Lovesac. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents and report to the Board on any appropriate items. Our Chief Information Officer has over 35 years of experience managing information technology and cybersecurity matters and is responsible for assessing and managing these cybersecurity risks. Team members who support our information security program have relevant educational and industry experience.

companyName: Lovesac Co

ticker: LOVE


text: Brad A. Lich, age 57, is Executive Vice President and Chief Commercial Officer, with responsibility for the AM segment, including the circular platform, as well as leadership of marketing, sales, supply chain, corporate strategy, and regional leadership. Mr. Lich joined Eastman in 2001 as Director of Global Product Management and Marketing for the Coatings business. Other positions of increasing responsibility followed, including General Manager of Emerging Markets of the former Coatings, Adhesives, Specialty Polymers, and Inks ("CASPI") segment. In 2006, Mr. Lich became Vice President of Global Marketing with direct responsibility for company-wide global marketing functions. In 2008, Mr. Lich was appointed Vice President and General Manager of the former CASPI segment, and in 2012 was appointed Vice President and General Manager of the AFP segment. In January 2014, Mr. Lich was appointed Executive Vice President, with responsibility for the AFP and AM segments and the marketing, sales, and pricing organizations. In March 2016, Mr. Lich assumed executive responsibility for outside-U.S. regional business leadership. Mr. Lich was appointed to his current position effective July 2016.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Our management team, including our IT management team, are responsible for day-to-day implementation, assessment, and management of our cybersecurity risk assessment and management processes. The IT management team has primary responsibility for our overall cybersecurity risk management program, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents, and works in partnership with our other business leaders, including our Chief Operating Officer, Chief Financial Officer and General Counsel. Our IT management team supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Senior Director of IT has served in various roles in information technology and information security for over 25 years.

companyName: AMBARELLA INC

ticker: AMBA


text: Security assessments are an ongoing activity within the Bank, and the Security Assessment Policy identifies security assessment requirements and those individuals accountable for ensuring the assessments comply with the requirements. All assessment activities must be approved by the CRO. The coverage of assessments includes, but is not limited to, physical security assessment, information technology general controls audit, vulnerability assessment, penetration testing, and social engineering testing. Results are shared with the ITSC, executive management and the Board of Directors.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Risk management and strategy Managing Material Risks & Integrated Overall Risk Management We are developing processes, including those intended to follow an internal Information Technology (IT) Security Policy, which seek to assess, identify, and manage material risks from cybersecurity threats to the IT systems and information that we create, use, transmit, receive, and maintain. We also seek to integrate these processes and policies into our overall enterprise risk management system and processes. We also maintain an evolving cybersecurity roadmap for our future cybersecurity plans. The processes for assessing, identifying, and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include our efforts to identify the relevant assets that could be affected, determine possible threat sources and threat events, assess threats based on their potential likelihood and impact, and identify controls that are in place or necessary to manage and/or mitigate such risks. In furtherance of our cybersecurity policies and procedures, our IT team has a monthly IT Steering committee meeting, chaired by our Chief Financial Officer ("CFO") and Chief Strategy Officer, where all new IT projects include a cybersecurity component.

companyName: electroCore, Inc.

ticker: ECOR


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Manager of Cybersecurity. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: Our full Board of Directors oversees enterprise-level risks and has delegated to the Audit Committee of our Board oversight of risks from cybersecurity threats as informed through the ERM program. Our CDO and CISO are standing members of the ERM committee, comprised of members of senior management, and as part of the committee, report on and evaluate cybersecurity threats and risk management efforts, as communicated to them by way of their direct reports and the larger cybersecurity team. The CDO and CISO provides regular cybersecurity briefings to the Board of Directors and the Audit Committee as needed, with a minimum of two briefings per year. The Audit Committee further reviews and provides input on our cybersecurity and information security strategy.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Accordingly, we will continue to review and update our existing governance, policies, and practices to address the following objectives: • Ensure business continuity by protecting Luxfer's technology, data, intellectual property, and information assets; • Increase cyber-resiliency and enhance controls for detecting and mitigating cybersecurity incidents; • Safeguard the availability and reliability of Luxfer's network infrastructure, systems, and services; • Ensure compliance with all applicable regulations and Luxfer policies, controls, standards and guidelines; and, • Comply with requirements for confidentiality and privacy for Luxfer's customers and employees.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: The specialized nature of our blockchain-based authentication system introduces unique security challenges. In addition, hardware or software that we develop or obtain from third parties may contain defects that could compromise information security, cybersecurity, or data privacy. Unauthorized parties may attempt to gain access to our information systems or facilities, or those of third parties with whom we do business, through fraud, deception, social engineering, or other bad acts. Errors or malicious actions by our team members or contractors, faulty password management, smart contract vulnerabilities, and other irregularities could also overcome our security measures or those of third parties with whom we do business and result in a compromise or breach of our or their information systems. Furthermore, the training we conduct as part of our information security, cybersecurity, and data privacy efforts may not be effective in preventing or limiting successful attacks.

companyName: GROOVY COMPANY, INC.


text: At Lucid, cybersecurity risk management is an integral part of our overall enterprise risk management program. We have made significant investments in people, processes, and technology to protect Lucid's connected vehicles, services, confidential business information, and employee and consumer personal data. We have implemented multiple and varied processes and technologies for the avoidance, identification, assessment, mitigation, and remediation of risks from cybersecurity threats and incidents designated to protect against the cybersecurity risk landscape. We regularly assess and enhance our protection, detection, response, and recovery capabilities and engage with the cybersecurity communities including Auto-ISAC, third-party cybersecurity and compliance partners, internal stakeholders, and organizations leading best practices, to support our goals and objectives. Our cybersecurity risk management program integrates multiple teams across the organization, including our IT, digital and physical product, infrastructure, and legal teams, with leadership and oversight by executive management, the Audit Committee of the Board of Directors ("Audit Committee"), and the Board of Directors ("Board").

companyName: Lucid Group, Inc.

ticker: LCID


text: Our cybersecurity program is run by our Chief Financial Officer, who reports to our Board, with support from our specialty IT advisor. Our specialty IT advisor has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our specialty advisor has served in this position since 2023 and is supported by its information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity.

companyName: Perception Capital Corp. IV


text: As of the date of filing this report, we do not believe there are any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Dare Bioscience, Inc.

ticker: DARE


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Management of Third-Party Risks. Our suppliers, subcontractors, and other third-party service providers are subject to cybersecurity obligations and controls. We assess and periodically reassess the cybersecurity posture of third-party service providers who store, process, or transmit our information as a service, or connect to our networks. We also require our suppliers, subcontractors, and other third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase. Many of these third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS). Among other things, mandatory government procurement clauses obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of the implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.

companyName: RTX Corp

ticker: RTX


text: Our management team, including our CISO, CRO and CORO, is responsible for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO works closely with our CRO and CORO, who are responsible for providing effective oversight and challenge to the activities of our CISO.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: The CNH CISO maintains and periodically updates a Cybersecurity Incident Response Plan which is a guide for how to respond effectively and efficiently to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm to our customers, operations, partners, employees and third parties, consistent with our legal obligations. As of the date of this report, we do not believe that risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, we recognize the ever-evolving cyber risk landscape and cannot provide any assurances that we will not be subject to a material cybersecurity incident in the future. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: CNH Industrial Capital LLC


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data includes confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also maintain a third-party security program to identify, prioritize, assess, mitigate and remediate third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: ZeroStack Corp.

ticker: ZSTK


text: Company has engaged an outside contractor to assist it in developing an information security policy and include an incident response plan. The Company is in the process of developing and implementing such policies and obtaining Service Organization Control Type 2 (SOC 2) compliance certification. The SOC II certification process involves a comprehensive assessment conducted by independent auditors to evaluate our systems and controls against established industry standards. As part of the certification process, the effectiveness of the Company's information security policies and procedures to protect against unauthorized access, breaches, and data theft are assessed. The Company expects to achieve SOC 2 certification in the second quarter of 2025.

companyName: CYBERLOQ TECHNOLOGIES, INC.

ticker: CLOQ


text: Management Expertise Our Chief Information Security Officer has nearly 20 years of professional experience in information security, including over 7 years as Fannie Mae's Chief Information Security Officer and 1 year as Fannie Mae's Deputy Chief Information Security Officer. Our Chief Information Security Officer holds a graduate degree in information technology management.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Cybersecurity Governance Management Oversight. The Chief Technology Officer oversees the Information Technology Department which, among other things, is responsible for identifying, assessing and managing material risks from cybersecurity threats and has more than thirty years of experience in the information technology field. The Chief Technology Officer is a member of various management committees and participates in Board of Directors' meetings as well as Audit Committee meetings where the overall status of information technology and security is discussed including the related policies and risk assessments. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for policy and program enhancements.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: We face a number of cybersecurity risks in connection with our business. Failure of any one or more than one of our information technology systems could be caused by internal or external events or parties, such as incursions by intruders or hackers, computer viruses, cyber-attacks, failures in hardware or software, or power or telecommunication fluctuations or failures. For more information about the cybersecurity risks we face, see Item 1A - Risk Factors.

companyName: OLIN Corp

ticker: OLN


text: While we have no knowledge of any material data security breaches to date, any compromise of our data security could result in a violation of applicable privacy and other laws or standards, significant legal and financial exposure beyond the scope or limits of our insurance coverage, interruption of our operations, increased operating costs associated with remediation, equipment acquisitions or disposal, added personnel, and a loss of confidence in our security measures, which could harm our business, athlete experience, reputation or investor confidence. See Item 1A. "Risk Factors" for more information on the Company's cybersecurity-related risks.

companyName: DICK'S SPORTING GOODS, INC.

ticker: DKS


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or government investigations, litigation, fines or damages. For more information, see "Our business and operations may be materially adversely affected in the event of computer system breaches or failures" in Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: Verastem, Inc.

ticker: VSTM


text: We routinely undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents, including an annual risk review, policy reviews and revisions. In addition, we maintain business continuity, contingency, and recovery plans for use in the event of a cybersecurity incident by the administering of local and cloud based back up of files and emails.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: Risk levels and mitigating measures are presented to and monitored by dedicated management-level cybersecurity risk committees. These committees include representatives from management as well as business and control stakeholders who review, challenge and, where appropriate, consider exceptions to its policies and procedures. Significant cybersecurity risks are escalated from these committees to Morgan Stanley's non-financial risk committee. The CIO and the Head of the Operational Risk Department report on the status of the Cybersecurity Program, including significant cybersecurity risks; review metrics related to the program; and discuss the status of regulatory and remedial actions and incidents to Morgan Stanley's non-financial risk committee, the BOTC and the Board, as appropriate.

companyName: Ceres Tactical Commodity L.P.


text: The operation of our business depends on our information technology systems. We rely on our information technology systems to effectively manage sales and marketing data, accounting and financial functions, inventory management, product development tasks, clinical data, customer service and technical support functions. Our information technology infrastructure and products are vulnerable to cyber-based attacks. Cyber-based attacks can include computer viruses, denial-of-service attacks, phishing attacks, ransomware attacks and other introduction of malware to computers and networks; unauthorized access through the use of compromised credentials; exploitation of design flaws, bugs or security vulnerabilities; intentional or unintentional acts by employees or other insiders with access privileges; and intentional acts of vandalism by third parties and sabotage.

companyName: Anteris Technologies Global Corp.

ticker: AVR


text: We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Cybersecurity Program Overview The Investment Adviser has engaged a managed service provider to provide comprehensive information technology services (the "IT MSP"), including services related to cybersecurity. The Investment Adviser, in conjunction with IT MSP, has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, in conjunction with IT MSP, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Brightwood Capital Corp I


text: We have an Incident Response Team ("IRT") that consists primarily of representatives from the CFC, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CSC based on a defined severity matrix. Internal legal and finance stakeholders are responsible for assessing materiality of risks in consultation with the IRT, CSC, the CEO, and external advisors.

companyName: Baker Hughes Co

ticker: BKR


text: With the acquisition of Bloomia on February 22, 2024, the Company will include the IT environment of Bloomia in its cybersecurity processes and oversight at the corporate and board level. Bloomia's cybersecurity is managed by a third party vendor.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: We also have an employee education and training program, offered during onboarding and on a periodic basis thereafter, that is designed to raise awareness of cybersecurity threats across functions as well as to encourage consideration of cybersecurity risks across our Company. As part of this employee training program, we periodically conduct phishing simulations designed to raise employee awareness of such risks.

companyName: Vigil Neuroscience, Inc.


text: To the best of our knowledge, cybersecurity risks and threats have not materially impacted our business to date. However, it is possible that these risks and threats could materially impact our business in the future. Our business depends on the availability, reliability, and security of our information systems, networks, data, proprietary business information and intellectual property. Any disruption, compromise, or breach of our systems or data due to a cybersecurity threat or incident could disrupt our operations, cause customers to lose trust and confidence in us and stop using our products, website and mobile applications, adversely affect our product development and competitive position, and could also result in a breach of our contractual obligations or legal duties to protect the privacy and confidentiality of our stakeholders and other third parties. Such a breach could expose us to business interruption, lost revenue, ransom payments, remediation costs, liabilities to affected parties, cybersecurity protection costs, lost assets, litigation, regulatory scrutiny and actions, reputational harm, customer dissatisfaction, harm to our vendor relationships, or loss of market share. The advertising technology sector may be especially vulnerable to these risks due to our industry's reliance on personal information and the evolving privacy regulatory environment described under the caption "Risks Related to Data Privacy" in Item 1.A above.

companyName: AdTheorent Holding Company, Inc.


text: Chief Financial Officer is responsible for assessing and managing cybersecurity risks, through his oversight of our IT service provider that manages our IT. Our CFO has a Doctorate Degree in Information Technology Management and has specific cybersecurity expertise. The Company has an Information Technology Policy that, among other things, governs and provides cybersecurity policies and processes, including defining safety measures to protect the Company's confidentiality, integrity and availability of data and other intellectual properties, as well as to define the manner in which information is stored, saved and routed in the Company's network. Additionally, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight, especially as the Company moves towards commercialization of its first product.

companyName: Awaysis Capital, Inc.

ticker: AWCA


text: To help associates acquire the knowledge to support the protection of our environment, the Company provides comprehensive annual security awareness training, periodic information updates, and regular testing/training programs. In addition, the Company annually purchases a cybersecurity insurance policy.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: Our management team, including our CTO, CRCO, and CISO, has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over 30 years of technology and finance leadership experience across multiple industries for our CTO, over 30 years of experience in the Legal, Risk and Compliance disciplines for our CRCO, and over 20 years of cybersecurity leadership experience for our CISO.

companyName: KOHLS Corp

ticker: KSS


text: In today's digitally interconnected workspace, we are increasingly vulnerable to cybersecurity threats that can disrupt operations, and compromise sensitive information. Cybersecurity threats are continuously evolving and can vary widely, but some common types of material cyber threats include:

companyName: International Seaways, Inc.

ticker: INSW


text: We maintain both an Incident Response Plan and a Crisis Management Plan (the "Plans") that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Innovation and Technology Committee of our board of directors. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the Chief Information Officer, and key members of management are embedded into the Plans by their design. The Plans facilitate coordination across multiple parts of our organization and are evaluated at least annually. Integral elements of the Plans related to the Company's response to security vulnerabilities include the following.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I, Item1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Personalis, Inc.

ticker: PSNL


text: The Information Security Director, who reports to the CIO, is responsible for establishing basic policies and procedures related to cybersecurity. The Information Security Director is also responsible for selecting the CIRT and the CIC to lead the response to each incident. Established policies and procedures are employed by the CIRT in planning and executing a response to a cybersecurity incident. The CIO and the Information Security Director have over 55 combined years of information technology and program management experience and have served over 31 combined years in the Company's corporate information security organization. They are familiar with the Company's cybersecurity landscape, risks and best practices for mitigation of those risks identified.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: Management is responsible for hiring personnel to support our cybersecurity strategy, as appropriate, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Management is also responsible for approving technology budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: We utilize advanced technical safeguards to defend our information systems. These include firewalls, intrusion prevention and detection systems, anti-malware tools, and stringent access controls. Continuous vulnerability assessments and leveraging cybersecurity threat intelligence ensure these safeguards remain practical and up to date.

companyName: WIDEPOINT CORP

ticker: WYY


text: We review our cybersecurity risk framework and related policies both internally and externally by third parties at least annually. Our risk management program is also reviewed annually as part of SOC 2 and Health Information Trust Alliance, or HITRUST, Common Security Framework audits.

companyName: RESMED INC

ticker: RMD


text: We maintain a risk - based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third - party systems, including any outside auditors or consultants who advise on our cybersecurity systems.

companyName: SEELOS THERAPEUTICS, INC.


text: KULR's Chief Technology Officer ("CTO"), in conjunction with our third-party providers, is responsible for assessing and managing KULR's cyber risk management program, informs senior Management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents, and supervises such efforts. In addition, KULR has made additional investment into cybersecurity by hiring an on-premises Information Technology ("IT") Manager who will dedicate time weekly to supporting the development of KULR cyber related policies and working on enforcement with 3 rd party managed solutions providers.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: Additional information about cybersecurity risks we face is discussed in Part I, Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology and infrastructure used by us, Hess or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.

companyName: Hess Midstream LP

ticker: HESM


text: Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity threats that, if realized, are reasonably likely to materially affect us. These threats include but are not limited to: (i) ransomware and malware attacks; (ii) endpoint attacks; (iii) compromised business email and other social engineering threats; and (iv) vulnerabilities related to inadequate patch management. Our licensees, suppliers, contractors, and consultants also face similar cybersecurity risks, which could have an adverse impact on our business.

companyName: XOMA Royalty Corp

ticker: XOMA


text: We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments. In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system: information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats. We have also implemented an Incident Response Plan and procedures that provide a framework for responding to cybersecurity incidents. The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s). The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom's Chief Information Security Officer ("CISO").

companyName: Zoom Communications, Inc.

ticker: ZM


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology (the "NIST"), the Control Objectives for Information Technologies ("COBIT") framework and the International Organization Standardization 27001, Information Security Management System requirements. We have an annual assessment, performed by our internal audit department, of our cyber risk management program against the NIST and COBIT frameworks.

companyName: W&T OFFSHORE INC

ticker: WTI


text: Our board stays informed on data privacy and information security issues and vulnerabilities that may be applicable to the Company. We outsource most aspects of our information technology management and these third-party providers are available to address any cybersecurity issues that may arise.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: On a quarterly basis, a meeting of the Risk Committee is convened to discuss and evaluate our management of enterprise-wide risks. Each meeting of the Risk Committee is facilitated by our Executive Director for ERM and includes programmatic updates from the CSO. The Risk Committee provides updates to the full Board of Directors regarding the state of the Company's ERM program.

companyName: TRINET GROUP, INC.

ticker: TNET


text: Third-Party Engagement Due to the complexity and ever-changing nature of cybersecurity threats, Nucor engages a range of external experts to assist in its assessment, identification, and management of risks from cybersecurity threats. These include cybersecurity assessors, forensic and incident response experts, and auditors to review the Company's cybersecurity posture and responsive efforts. Our relationships with these external partners enable us to leverage their expertise with the goal of maintaining best practices.

companyName: NUCOR CORP

ticker: NUE


text: We design and assess our program based on the Center for Internet Security ("CIS") 18 Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS 18 Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Bloom Energy Corp

ticker: BE


text: First Solar maintains a cyber risk management program designed to identify, assess, and manage cybersecurity risks. The underlying controls of the cyber risk management program incorporate recognized best practices and standards for cybersecurity, including guidance from the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cyber risk management program includes various risk assessments that are completed on a regular basis, including (i) information security controls assessments with internal and external audit partners, (ii) architectural and technical assessments with third-party experts, (iii) internal and external penetration testing with third-party service providers, (iv) continuous cyber risk register reviews, and (v) risk prioritization with our executive officers. The identification of cybersecurity risks is aided by a technical toolset as well as threat hunting and counterintelligence services provided by third-party service providers. These risk assessments and the technical toolset inform our information security roadmap, which allocates resources toward strategic initiatives to mitigate, transfer, and/or reduce cybersecurity risks. Our associates engage in annual cybersecurity training and periodic phishing simulation exercises with targeted training. Additionally, confidential information protection training is regularly provided to associates who have access to personally identifiable information, reside in certain jurisdictions, or have privileged access.

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: Our management-level Enterprise Risk Committee has delegated to our Chief Information Officer primary responsibility for identifying, assessing and managing cybersecurity-related risks. Our Chief Information Officer has a Bachelor of Science in Computer Science from the University of Kentucky and a Master of Business Administration in Finance from the Wharton School of Business at the University of Pennsylvania. He has served in his current role at EQT since 2019 and has over twenty years of information technology experience within the energy industry.

companyName: EQT Corp

ticker: EQT


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Peapack-Gladstone Bank's internal systems,processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company, including its business strategy, results of operations, or financial condition.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition We rely on our computer networks and systems, some of which are managed by third-parties, to manage and store electronic information (including sensitive data such as confidential business information, personally identifiable data and personal health information), and to manage or support a variety of critical business processes and activities. We may face threats to our networks from unauthorized access, security breaches and other system disruptions. Despite our security measures, our infrastructure may be vulnerable to external or internal attacks. Any such security breach may compromise information stored on our networks and may result in significant data losses or theft of sensitive or proprietary information. A cybersecurity breach could hurt our reputation by adversely affecting the perception of customers and potential customers about the security of their orders and personal information, as well as the perception of our manufacturing partners of the security of their proprietary information. In addition, a cybersecurity attack could result in other negative consequences, including disruption of our internal operations, increased cybersecurity protection costs, lost revenue, regulatory actions or litigation. Any disruption of internal operations could also have a material adverse impact on our results of operations, financial condition and cash flows.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: We intend to review our current reporting structure and may implement other structures governing the day-to-day management and reporting of cybersecurity risks.

companyName: VerifyMe, Inc.

ticker: VRME


text: To mitigate cybersecurity risks linked to our engagement with third-party service providers, we perform security screening and review for prospective vendors that require access to our information systems. Additionally, to further protect our operations and enhance our cybersecurity risk management process, we maintain cybersecurity risk insurance obtained from industry leading underwriters.

companyName: ARGAN INC

ticker: AGX


text: Company management is responsible for assessing and administering the cybersecurity risk program. Specifically, the Chief Information Officer ("CIO") and the ISO are responsible for the prevention, mitigation, detection, and remediation of cybersecurity incidents. The ISO has relevant expertise in cybersecurity, with 19 years of experience managing components of the information technology and information security programs at the Company. The ISO has established expertise and proficiency in cybersecurity, and holds several cybersecurity certifications, including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), and Certified in Risk and Information Systems Control (CRISC). The ISO and CIO work closely with other management positions, including the Chief Risk Officer, Chief Financial Officer, General Counsel, President, and CEO to ensure that the Company has effective communication and understanding regarding its cybersecurity risk and related controls.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: As the leader of our Information Security Team, our Vice President, Cybersecurity, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, requesting and allocating budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our management team, including our Chief Technology Officer and the Chief Technology Officer's team are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes decades of experience across several public companies, including in the IT, cybersecurity, retail, and financial industries.

companyName: Commerce.com, Inc.

ticker: CMRC


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: For additional information on our cybersecurity risks, see "Risks Related to Technology and Information Security." in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: QVC Group, Inc.

ticker: QVCGA


text: Senior management, including the Company's Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: Our Security Operations team, in coordination with our legal and compliance teams, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Our Security Operations team meets monthly with key executives and management to provide updates regarding the Company's cybersecurity efforts. For more information, see the section titled "Risk Factor— Unauthorized disclosure, destruction or modification of data, disruption of our software or services or cyber breaches could expose us to liability, protracted and costly litigation and damage our reputation."

companyName: EverCommerce Inc.

ticker: EVCM


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 26 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service provider(s) to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS


text: Our Vice President of Information Technology ("VP of IT") with assistance from our third-party managed services team, legal, quality, finance and human resources, identifies, assesses and manages the Company's cybersecurity threats and risks. The Company identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example using manual and automated tools, analyzing reports of threat actors, conducting scans of the threat environment, evaluating threats reported to us and coordinating with law enforcement concerning threats.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Periodic risk assessments are conducted that are aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and ASB leverages the results of such assessments to help optimize security investments and advance the cybersecurity program's maturity and security posture over time. The Bank's Risk Committee of the Board annually reviews and approves ASB's Information Security Policy and Gramm-Leach-Bliley Act programs and receives quarterly, or as needed, reporting on any key cybersecurity developments.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We currently manage our cybersecurity risk through practices that are applicable to all users of our information technology and information assets, including our employees and contractors. We notify these users of expectations regarding acceptable use of our information systems and alert them to potential sources of cybersecurity threats. We use a combination of technology and monitoring to prevent security incidents.

companyName: Atlas Lithium Corp

ticker: ATLX


text: Our advisor utilizes a team of dedicated external IT professionals, which leads enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The IT professionals provide periodic reports to our board of directors, our advisor, as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by our advisor and external experts with the results of those reviews reported to senior management and the board of directors. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Pacific Oak Strategic Opportunity REIT, Inc.

ticker: PCOK


text: The board of directors, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The board of directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The board of directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the board of directors and the Audit Committee discuss our approach to cybersecurity risk management with our CISO.

companyName: Marpai, Inc.

ticker: MRAI


text: (6)Team Member Education & Awareness. We remain dedicated to fostering an internal culture of cybersecurity, where all of our team members are trained to identify, respond, and report potential cybersecurity threats that may arise. New hires are required to participate in cybersecurity onboarding training, and current employees are responsible for completing mandatory cybersecurity training annually and phishing awareness training quarterly. Our leadership team participates in advanced, targeted cybersecurity training and exercises to ensure additional security.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our cybersecurity program is based on the ISO 27001 security controls. We maintain an ISO 27001:2022 certification and we undergo routine audits by an independent, certified accreditation body to maintain this certification. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Twist Bioscience Corp

ticker: TWST


text: The Director, Global Information Technology and Financial Systems (the "IT Director"), leads an internal team and works directly with our third-party vendors to manage our cybersecurity risk management program and activities. The internal team monitors our information systems for cybersecurity threats, reviews cybersecurity incidents, analyzes emerging threats, and develops and implements risk mitigation strategies. The IT Director periodically reports on the cybersecurity program to the Company's Chief Financial Officer ("CFO").

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Oversight of information security risk and information technology risk is the operational responsibility of the Information Risk Committee, which is a management committee, with additional oversight from the Enterprise Risk Management Committee, which is also a management committee, and the Risk Committee of the Board of Directors.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: The Technology & Cyber Risk Committee of our board of directors (the "TCRC") is responsible for overseeing and reviewing our cybersecurity program and cybersecurity risk exposure and the steps taken to monitor and mitigate such exposure. The TCRC updates the full board of directors on cybersecurity matters periodically.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: As we progress in the assessment and enhancement of our cybersecurity program, we plan to consider the following areas for enhancement and incorporation into the cybersecurity risk management and governance program in the future:

companyName: FingerMotion, Inc.

ticker: FNGR


text: All customer and user information is stored directly within our own data centers, or Google Cloud and Amazon Web Services platforms, which provides market-leading data security for their centralized servers. On occasion, limited amounts of customer information such as names and emails are exported from these systems solely for the purposes of accounting and filings and is never shared outside of the Company and its contracted accounting consultants, which are under confidentiality agreements. Highly sensitive customer payment information is generally never revealed to the Company in any capacity and is hidden by payment processors for security purposes, with the sole exception being accounts who provide written or digital copies of credit card information for payment processing on agreed upon terms. Such information is secured on Company computers and never distributed.

companyName: CLOUDASTRUCTURE, INC.

ticker: CSAI


text: The CIO and CSIRT, in combination with the Senior Vice President, Technology and Innovation and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: TENNANT CO

ticker: TNC


text: Our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who report to our executive management team, are responsible for identifying, assessing and managing material cybersecurity risks, establishing processes to monitor such risks, putting appropriate mitigation measures in place, maintaining appropriate policies and procedures for our cybersecurity program and providing periodic updates to the Audit Committee of our Board of Directors. To this end, our cybersecurity team conducts annual reviews of enterprise-level cybersecurity risks. Additionally, we maintain company-wide policies and procedures concerning cybersecurity matters, which are subject to annual internal review, or more frequent, as warranted. MasTec's CISO oversees the development and implementation of our information security program and reports on cybersecurity matters to the Audit Committee. Our CIO and CISO each has over 15 years of experience in cybersecurity oversight, and our cybersecurity team is composed of personnel with a broad range of professional cybersecurity experience and expertise, and includes members with cybersecurity certifications, such as the Certified Information Systems Security Professional (CISSP) certification.

companyName: MASTEC INC

ticker: MTZ


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. As needed, the Audit Committee of our Board of Directors provides oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We have developed and implemented an enterprise-wide cybersecurity program, which is part of our overall risk management system and is designed to provide cybersecurity risk management and governance. Our cybersecurity program prioritizes, among other things, proactive detection and mitigation of threats; protection of customer and internal confidential information; minimization of the impact of incidents; and identification, assessment, and management of material risks from cybersecurity threats.

companyName: Sonos Inc

ticker: SONO


text: We have established and maintained an incident response process and have associated policies in place. As of the date of this filing, we are undertaking an update to our network and system and as such our incident response plan is being updated.

companyName: VINEBROOK HOMES TRUST, INC.


text: We recognize the importance of maintaining the trust and confidence of our customers, business partners and employees and we believe that security of our information systems and data is important to our business. We focus on preserving the confidentiality, security and availability of the information that we collect and store and have designed and implemented processes to assess, identify and manage material risks from cybersecurity threats. Our information security policies, processes and practices are integrated into our overall risk management programs and processes as a public company. As part of our risk management programs, we have developed and implemented several technical and organizational measures to help protect the security of our information systems and data. These measures include physical access controls, logical access controls, and other measures.

companyName: MARIN SOFTWARE INC


text: Response Planning: We maintain a breach reporting and resolution plan that includes defined processes, roles, communications, responsibilities and procedures for responding to cybersecurity incidents and other events that impact our operations. Our incident response plans are tested and evaluated on a regular basis.

companyName: VEEA INC.

ticker: VEEA