text: To identify and assess material risks from cybersecurity threats, our Enterprise Risk Management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. We perform specific cybersecurity risk assessments at least annually to identify and assess material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to further identify risks.

companyName: Bakkt, Inc.

ticker: BKKT


text: To date, the Company has not, to its knowledge, experienced any cybersecurity threats or previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. In the last three years, the Company has not experienced any material cybersecurity incidents and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). However, we can give no assurance that we have detected or protected against all cybersecurity incidents or cybersecurity threats. Please refer to "Item 1A, Risk Factors— Risks Related to Information Technology and Data Security" in this Annual Report for additional information about risks related to cybersecurity matters.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO

secItem: Item 1C


text: Our Board of Directors oversees our overall risk management strategy. Our information security program is managed by our Senior Vice President of People and Technology, who has twenty-five years of experience in IT leadership across a variety of industries including manufacturing, distribution, defense, and financial services, whose team is responsible for maintaining our enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our program is assessed both internally and externally by third parties, including our virtual Chief Information Security Officer ("vCISO") partner. Our Senior Vice President of People and Technology provides reports at least quarterly to our Audit Committee, as well as our Disclosure Committee, which comprises senior management and key stakeholders, as appropriate. The reports provided include updates on our cyber risks and threats, and key updates to our information security systems and programs as well as the current threat environment.

companyName: HF Foods Group Inc.

ticker: HFFG


text: We also maintain a Cyber and Data Incident Reporting Portal, which allows employees to notify our cybersecurity and data protection teams if they believe they have been the victim of a cyber incident or data breach, or have become aware that a third party service provider has suffered a cyber incident or data breach.

companyName: Enstar Group LTD


text: Once a cybersecurity incident is contained, the focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident. They may include returning affected systems to an operationally ready state and confirming that the affected systems are functioning normally.

companyName: Net Lease Office Properties

ticker: NLOP


text: To date, there have been no cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, the Bank, our business strategy, results of operations, or financial condition.

companyName: Provident Bancorp, Inc. /MD/


text: Engagement of Third Parties Our information security program is under nearly constant third-party review as part of Sarbanes-Oxley compliance and the HITRUST certification process, including independent third-party penetration testing of all information technology assets at least annually and assessment of our vulnerability to ransomware. Multiple industry-standard third-party tools are utilized to detect vulnerabilities. Alignment is a member of the Healthcare Information Sharing and Analysis Center (Health-ISAC) operated by the U.S. Department of Health and Human Services and the Department of Homeland Security and is affiliated with the FBI InfraGard program, providing deep, actionable intelligence regarding healthcare security and privacy threats and countermeasures. We continuously monitor the Health-ISAC reporting to anticipate and respond to potential threats.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact U. S. Steel. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CIO and CISO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee, including an annual report regarding specific risks and mitigation efforts within U. S. Steel and a 5-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors, including training by third party experts, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing U. S. Steel's material cybersecurity risks. The CIO and the CISO primarily lead these efforts. The CIO is responsible for the oversight of U. S. Steel's entire global IT operation, including the cybersecurity program, and holds a Bachelor of Science in operations research and industrial engineering and a Bachelor of Arts in economics from Cornell University, as well as a Master of Science in engineering and Master of Business Administration from Massachusetts Institute of Technology. The CIO's previous work experience includes holding the position of CIO at a $25 billion manufacturing conglomerate and a $7 billion energy company. The CISO reports directly to the CIO and has responsibility for leadership of U. S. Steel's global cybersecurity program. She holds a bachelor's degree in Information Systems Management, a master's degree in Internet Information Systems, and a doctorate in Instructional Management and Leadership. The CISO also completed the Chief Information Security Officer Certificate program at Carnegie Mellon University, where she now serves as a coach for the program, and holds a Certified Information Systems Security Professional (CISSP) certification.

companyName: UNITED STATES STEEL CORP


text: To date, we have not experienced any known material cybersecurity incidents. However, there can be no assurance that our systems or those of our service providers will not be compromised in the future. A successful attack could result in the theft or complete loss of our DOG Coin or other digital asset holdings, disruption of planned operations, reputational harm, potential legal liability, and the diversion of resources.

companyName: C2 Blockchain, Inc.

ticker: CBLO


text: Board Oversight of Cybersecurity Risks Our Board of Directors, through the Audit Committee, provides strategic oversight regarding risks from cybersecurity threats through oversight of our overarching cybersecurity posture and risk management practices. The Audit Committee receives periodic updates from our CIO on the current status of our cybersecurity program and risks from cybersecurity threats, and our Board of Directors is apprised of significant cybersecurity matters.

companyName: AMKOR TECHNOLOGY, INC.

ticker: AMKR


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: We have established a Security Governance Framework that defines roles and responsibilities, so that security is taken into account at all levels and in every department or function of the Company. Our framework provides guidance for the organization, governance and implementation of security across the company. Logitech and its infrastructure have been certified for compliance with ISO 27001, an international standard for information security management.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Emerging threats Status of ongoing cybersecurity initiatives and strategies Incident reports and learnings from any cybersecurity events Compliance with regulatory requirements and industry standards; and Results of internal and external testing of cybersecurity controls. In addition to our scheduled meetings, CISO maintains an ongoing dialogue with management and the Board of Directors regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The CISO actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. The CISO conducts a quarterly review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: The Technology Committee, comprised of independent Board members, is responsible for reviewing cybersecurity, privacy, data protection and other major technology risk exposures of the Company, the steps management has taken to monitor and control such exposures, and the Company's compliance with applicable cybersecurity and data privacy laws and industry standards. These reviews are provided at least quarterly. The Technology Committee receives management updates and reports, primarily through the Company's Cybersecurity and Privacy Committee, a multidisciplinary team responsible for the overall governance, decision-making, risk management, awareness and compliance for cybersecurity and privacy activities across the Company.

companyName: DEXCOM INC

ticker: DXCM


text: Our Vice President, Digital Operations & Facilities, who reports directly to the Chief Operating Officer and has over 12 years of experience managing information technology and cybersecurity matters, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework that is overseen by our Audit Committee of our board of directors and our board of directors. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" for additional information on cybersecurity risks we face.

companyName: Viridian Therapeutics, Inc.\DE

ticker: VRDN


text: The company has processes that aim to validate security controls and engages third parties to design or assess security architecture, and certifications. This includes assessing the potential fourth-party risks related to employee, business, and customer data. During the third-party procurement and contracting process, the company incorporates contract provisions that are designed to align with applicable regulations and industry benchmarks.

companyName: MIDDLEBY Corp

ticker: MIDD


text: Our management team has also established a Cybersecurity Incident Response Team (the "CSIRT"), which is comprised of our Chief Executive Officer, the Chair of the Audit Committee of our Board, our General Counsel, our Chief Administrative Officer, and our Senior Vice President of Human Resources. The CSIRT is also responsible for responding to cybersecurity incidents.

companyName: MAXCYTE, INC.

ticker: MXCT


text: however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: RenX Enterprises Corp.

ticker: RENX


text: The Company actively engages with key vendors and industry participants, and monitors and analyzes intelligence and law enforcement community security publications as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its cybersecurity processes. The Company also regularly engages with external parties to perform: • periodic cybersecurity assessments, such as maturity assessments against the National Institute of Standards and Technology Cybersecurity Framework; • managed detection and response for certain public cloud environments; • penetration testing; • continuous proactive threat hunting; • cyber threat intelligence services including dark web monitoring; and • audits against industry standards including Systems and Organization Controls 2 ("SOC 2"), ISO 27001, PCI, and the HITRUST CST.

companyName: LIVEPERSON INC

ticker: LPSN


text: We have implemented security measures and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks. All employees receive cybersecurity training and other education regarding their use of computers, information technology, and sensitive data. We utilize third parties to support our information technology, or IT, resources, including disaster recovery intended to safeguard our ability to access and use our IT resources during a disaster or cyber incident. Our business continuity plans are evaluated against evolving security and service level standards, which includes evaluating those cybersecurity threats associated with our use of key third party service providers.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: An incident response plan has been established which provides detailed information on actions to take in the event of an incident. The incident response plan includes the scope of the plan, establishes the incident response team, details the incident response lifecycle, and provides templates to make the process easier to document and follow. Timelines, communication methods, and notification information are included in the plan to ensure the process can be followed in high pressure situations which can occur during incidents.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Our CISO, CIO, and CLO collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: Cybersecurity Risk As a fully integrated electric and gas utility, we operate and participate in regional markets and are interconnected with other entities. The operation of these systems depends on information technology systems we own and operate as well as third party systems and service providers. Strategic business partners are also leveraged to support our mission. As an operator of critical infrastructure, nefarious actors may find us a valuable target if they wish to disrupt our operations and negatively impact our customers. The systems and partnerships described above are all potential targets for a cyber-incident. Any significant interruption or failure of our information systems due to cyber-attacks, hacking or internal security breaches could prevent us from fulfilling our critical business functions including delivering energy to our customers, and sensitive, confidential, and other data could be compromised. This could adversely affect our business, our financial condition, operating results or liquidity. For the year ended December 31, 2023, there have been no cybersecurity incidents with a material impact on our business strategy, operations, or financial condition.

companyName: NorthWestern Energy Group, Inc.

ticker: NWE


text: Board of Directors' Oversight of Cybersecurity Risks Our Board is responsible for overseeing the Company's risk management process. The Board focuses on the Company's general risk management strategy, including the most significant risks facing the Company, and ensures that appropriate risk mitigation strategies are implemented by management. The Audit Committee oversees the Company's cybersecurity risk mitigation efforts. The Audit Committee reports to the full Board as appropriate, including when a matter rises to the level of a material risk.

companyName: HEALTHCARE SERVICES GROUP INC

ticker: HCSG


text: Lumen periodically engage both internal and external auditors and consultants to assess and enhance our program. These independent external auditors and consultants are accredited under various information security standards, including those administered by the International Organization for Standardization and the PCI Security Standards Council. These engagements typically include penetration testing, third-party certifications, compliance assessments, audits, and assessments of vulnerabilities and emerging threats. We also periodically deploy our Internal Audit processes to conduct additional reviews and assessments. We also mutually exchange threat intelligence with government agencies, cyber analysis centers and cybersecurity associations.

companyName: QWEST CORP

ticker: CTBB


text: Our cybersecurity program is managed by a global internal team that addresses potential risks, implements processes to support our cybersecurity program and responds to potential cyber incidents. The team has decades of experience with varied certifications and includes our Director of Cybersecurity who has over 25 years' experience as an IT professional engaged in network architecture and cybersecurity, and is led by our Vice President, IT, a CPA with 10 years' experience leading IT, who reports to our Senior Vice President, Chief Financial Officer. The internal team is supported by third party providers to expand coverage, expertise and responsiveness.

companyName: BARNES GROUP INC


text: We regularly engage independent third parties to periodically assess our cybersecurity posture. These assessments include penetration tests, purple team activities, health checks and point-specific technical cybersecurity assessments of key systems. Some of these assessments are performed with internal audit oversight and tested in regular intervals.

companyName: Fat Brands, Inc

ticker: FATAQ


text: The audit committee of our Board of Directors has responsibility for oversight of the Company's cybersecurity risk management and receives cybersecurity updates from management at regularly scheduled meetings.

companyName: AVADEL PHARMACEUTICALS PLC

ticker: AVDL


text: Under the direction of the CIO, the CSO is responsible for global cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, physical security, fraud and security awareness and training. The CSO has over 20 years of security experience and holds a degree in IT and cybersecurity, along with maintaining certifications in risk, information security, data privacy, legal investigations, and audit, among other disciplines. The other members of the company's security organization also have extensive cybersecurity, business, and technology experience and all hold certifications in their area of expertise.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management process; the information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: CERUS CORP

ticker: CERS


text: We face risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain.

companyName: CapForce Inc.

ticker: OPGN


text: We are not aware of any weakness in our systems or malware embedded in our systems that are likely to would materially affect, or are reasonably likely to materially affect, our operations.

companyName: AIR INDUSTRIES GROUP

ticker: AIRI


text: Our CISO oversees our cybersecurity risk management program in partnership with our CIO and other business leaders, including our General Counsel. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: JUNIPER NETWORKS INC


text: Unisys recognizes the importance of overseeing and identifying material risks from cybersecurity threats associated with our use of third-party service providers. We have a Third Party Risk Management (TPRM) program, which is integrated into our procurement process and involves cybersecurity risk oversight and identification components. Our TPRM program includes policies and standards requiring that we perform cybersecurity due diligence reviews on our vendors based on the risk profile of a particular supplier or service provider or the service they provide. We also monitor certain of our principal suppliers and service providers on an ongoing basis by using an outside-in, hacker perspective of a company's cybersecurity posture through an external service provider. Whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Unisys, including its business strategy, results of operations, or financial condition and if so, how.

companyName: UNISYS CORP

ticker: UIS


text: In late 2023, the Company began the process of a periodic formal cybersecurity risk assessment conducted by an expert third party. The findings from that formal assessment will inform the ongoing cybersecurity roadmap which is updated at least annually. The Audit Committee plays a key role by ensuring that the prioritization of the roadmap supports the Company's business objectives, and by making decisions, when called upon, of whether specific cybersecurity risks should be mitigated or if that risk is acceptable to the business.

companyName: Third Harmonic Bio, Inc.


text: In order to protect our customers' data - and any other data we manage or handle - we have adopted a number of safeguards and security measures. For example, we have implemented firewalls, endpoint protection, detection and response solutions, intrusion detection systems, access controls including multi-factor authentication, vulnerability scanning, software static analysis, dynamic analysis, third- party independent penetration testing, independent third- party control audits, a public bug bounty program. In addition, we have developed and maintained a robust Incident Response Plan ("IRP"), which is designed to equip our employees and managers with the necessary tools to detect, respond to, and ultimately prevent cybersecurity incidents affecting the platform.

companyName: ContextLogic Inc.


text: The Company recognizes the importance of developing, implementing and maintaining cybersecurity measures to better safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: Matador Resources Co

ticker: MTDR


text: Recognizing the threat of security breaches and cyberattacks globally, we have developed a cybersecurity program, overseen by our Chief Information Security Officer (CISO), that is designed to protect patient trust, defend the Moderna brand, and reduce the risk and impact of cyber-attacks. Our cybersecurity program is informed by industry standards and includes periodic risk assessments and security testing supported by cybersecurity technologies, including third-party security solutions, vulnerability management, and monitoring tools, designed to monitor, identify, and manage risks from cyber threats. In addition, we have implemented employee security and awareness training.

companyName: Moderna, Inc.

ticker: MRNA


text: As described under Item 1A in this Form 10-K, the Combined Company is subject to risks from cybersecurity threats, including risks relating to maintaining customer and employee data. Cybersecurity is a key focus at multiple levels of the organization, and management has developed policies and procedures to assess, identify and manage risks from cybersecurity threats.

companyName: Six Flags Entertainment Corporation/NEW

ticker: FUN


text: Our Chief Information Officer (CIO) and Corporate Director of Information Technology Security (CDIS), in coordination with our Information Technology Department and other appropriate personnel, are responsible for assessing and managing our risks from cybersecurity threats. The CIO has served various roles in information technology and information security for over 25 years, including Corporate Director, Technology & IS Strategy and Director of Applications and Technology, has been in his current role for more than 10 years, and holds a BS degree in Computer Science. Our CIO has various industry certifications, including being a Microsoft Certified Professional (MCP) and holding the Project Management Professional (PMP) certification, offered by the Project Management Institute (PMI).

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: We undertake activities to prevent, detect, and minimize the effects of cybersecurity incidents including an annual risk review. We also have policies and procedures to oversee and identify the risks from cybersecurity threats associated with our use of third-party service date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition. However, an actual or perceived breach of our security could damage our reputation and prevent us from attracting potential Acquisitions or subject us to third- party lawsuits, regulatory fines or other actions or liabilities, any of which could adversely affect our business, operating results or financial condition.

companyName: Global AI, Inc.

ticker: GLAI


text: We and our operators increasingly rely on information technology systems to operate our respective businesses, and the oil and natural gas industry depends on digital technologies in exploration, development, production, and processing activities. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with the employees of the Operating Partnership and third party customers and services providers. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, gathering, misuse, loss or destruction of proprietary and other information, fraud, extortion, harm to employees or customers, violation of data privacy or security laws and disruption of other business activities.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: Our cybersecurity program interfaces with other functional areas within our company, including but not limited to, our company's business segments and information technology, legal, risk, human resources and internal audit departments, as well as external third-party partners, to identify and understand potential cybersecurity threats. We regularly assess and update our processes, procedures and management techniques in light of ongoing cybersecurity developments.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: The Company's cybersecurity risk management program is supervised by our CISO, who reports directly to the Company's Chief Information Officer ("CIO"). The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our current CISO received his Master of Business Administration degree from Columbia University and has over 25 years of cybersecurity experience, including relevant prior senior leadership positions held with three other large companies.

companyName: COCA COLA CO

ticker: KO


text: Our cybersecurity risks and associated mitigations are evaluated by our IT team, including our VP of Technology Operations and Information Security, as part of our enterprise risk assessments that are reviewed by our management team. Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents, which include: internal briefings from relevant personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. However, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.

companyName: Intellicheck, Inc.

ticker: IDN


text: IT and cybersecurity are a standing Board agenda item, with quarterly presentations to the Board from the IT leadership quarterly. Our Audit Committee assists the Board in its oversight responsibilities regarding our systems, policies, and procedures relating to technology and cybersecurity. The Audit Committee's charter mandates that the Audit Committee reviews our technology and cybersecurity systems, policies, and procedures (including those relating to our assessment of third-party provider cybersecurity controls) with management. The Audit Committee is further tasked with discussing with management the policies with respect to risk assessment and risk management, including those related to technology and cybersecurity. An IT and Cybersecurity presentation is made to the Audit Committee quarterly and additionally as needed, to inform it of any new or emerging cybersecurity threats or risks.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Oversee Third-party Risk The Company has implemented a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: To date, we have not (to our knowledge) encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Report.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer and Chief Accounting Officer ("CAO"), meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Cybersecurity is an important part of our risk management processes and an area of focus for senior management. Our Board of Directors has oversight of our strategic and business risk management, and has delegated cybersecurity risk management oversight to the Audit Committee. Members of the Audit Committee receive updates on an as-needed basis, but at least annually, from senior management. This includes existing and new cybersecurity risks, how management is assessing and addressing such risks, status on key information security initiatives, and cybersecurity incidents, if any, and responses. Members of our Board of Directors also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management program.

companyName: Karat Packaging Inc.

ticker: KRT


text: The Company also has certain processes in place to manage cyber risks associated with third-party service providers which include various technical as well as contractual measures. For more information on cybersecurity risks and how they affect our business, operating results and financial condition, please refer to Item 1A., "Risk Factors – The Company's Business Operations May Be Materially Adversely Affected by Information Systems Interruptions or Intrusion, Including those Arising From Cybersecurity Attacks or Incidents or Violations of Laws Regulating Privacy and Data Security." Based on our analysis at this time, we have not identified any risks from a cybersecurity threat or incident that we believe has or is reasonably likely to materially affect the Company. Governance, Oversight and Leadership.

companyName: IDEX CORP /DE/

ticker: IEX


text: The CISO, in coordination with the Risk Management Committee, which includes, among others, our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), CIO and General Counsel ("GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and reports significant (including potentially material) threats and incidents to executive leadership.

companyName: LKQ CORP

ticker: LKQ


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our information technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: HMN FINANCIAL INC


text: The Company has not experienced a material information security breach in the last five years, nor has it incurred any expenses or penalties or paid any settlements related thereto. The Company is not currently facing any cybersecurity threats reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.

companyName: Turtle Beach Corp

ticker: TBCH


text: The CISO and his team evaluate quantitative and qualitative factors to determine if a cybersecurity threat or incident needs to be escalated to other members of management and ultimately to the Board of Directors. The factors evaluated include but are not limited to: actual or potential monetary damages, number of impacted employees or customers, nature of the records compromised, potential impact on customer relationships, public knowledge and likely effect on L&W's reputation. Depending on the severity of the impact on these factors, management, including the CISO, Chief Compliance Officer, Chief Accounting Officer ("CAO") and Chief Legal Officer, meets as part of a management committee to determine if an incident is material. In the event the management committee determines that a cybersecurity incident or threat is material, the incident or threat is elevated and reviewed with our Board of Directors. The management committee reports all incidents requiring a materiality assessment to the Chief Legal Officer, regardless of whether such committee ultimately determines a cybersecurity incident to be material.


text: Roles and Responsibilities Cybersecurity is an important part of our risk management processes and an area of focus for Ecovyst's management and Board of Directors. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure and the information they contain.

companyName: Ecovyst Inc.

ticker: ECVT


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats and reporting on such risks to the Audit Committee. Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.

companyName: STAAR SURGICAL CO

ticker: STAA


text: The CISO reports to the Chief Technology and Information Officer and leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups.

companyName: PVH CORP. /DE/

ticker: PVH


text: Risk Management Strategy Responsibility for cybersecurity risk management comes from a collective effort, with day-to-day oversight and management from our executive and information technology ("IT") teams. Additionally, the Audit Committee continues to take a more active role in setting both proactive and reactive strategies, with the overall Board overseeing our efforts and helping to guide our strategy.

companyName: Portillo's Inc.

ticker: PTLO


text: Our Vice President of Information Technology and Director of Risk Management regularly evaluate the Company's cybersecurity risk profile and lead the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Vice President of Information Technology and Director of Risk Management each have approximately 25 years of experience in their respective fields, and our Vice President of Information Technology holds certifications in cybersecurity from accredited information technology certification providers.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: The Critical Threat Committee is also responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Chairman of the Board to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Managing Third-Party Cybersecurity Risk We recognize the potential cybersecurity risks associated with the use of third parties that provide services to us, process information on our behalf, or have access to our informational or operational technology systems, and we have processes in place to oversee and manage these risks. For example, we evaluate third-party service providers' cybersecurity policies, procedures, and practices annually to ensure sufficiently reasonable security measures are in place. We also seek to mitigate third-party cybersecurity risk through contractual safeguards, and/or regular review of the internal control reports of such third parties, and incorporating third-party risk into our incident response plans.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: Our experienced information technology management team has over 50 years of experience in the technology industry and play pivotal roles in incident identification, analysis, and response. This process includes notifying executive management when a cybersecurity breach or incident takes place, and taking necessary containment and mitigation steps to address the incident. Our comprehensive approach is designed to provide minimal impact on our operations and maintain the confidentiality and integrity of the personal information we handle.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: Information Security and Governance Oversight The Vice President of IT is responsible for Li-Cycle's information security program. In this capacity, the executive oversees the enterprise-wide cybersecurity strategy, ensuring the development of policies and standards, the implementation of processes, and the management of architectural elements. The Vice President of IT is responsible for assessing and managing material risks from cybersecurity threats, and is supported in delivering this function with a dedicated internal IT team. The Vice President of IT has over eight years of leadership experience as a Chief Information Officer and Chief Technology Officer, with experience overseeing information security, risk management, and compliance functions. The Cybersecurity Steering Committee convenes no less than quarterly to evaluate and address significant risks stemming from cybersecurity threats.

companyName: Li-Cycle Holdings Corp.


text: Implementation of the IR Policy requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Policy are spread across the entire organization of the Bank's senior leadership and chief credit officer.

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: Although both we, and the third parties who provide services to us, commit resources to the design, implementation, monitoring, and protection of the information systems we own or use, there is no guarantee that either our or those third parties' cybersecurity measures will effectively manage the multitude of cyber risks to which we are exposed. For more information regarding the risks from cybersecurity threats that may impact our business strategy, results of operations, or financial condition, see Part I, "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Schneider National, Inc.

ticker: SNDR


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards, and practices are intended to align with recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing, and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks, and incidents when required.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Threat Management Process. In addition to regular and routine vulnerability scanning, we rely on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. With the assistance of third-party vendors, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment.

companyName: FNB CORP/PA/

ticker: FNB


text: Board of Directors holds oversight responsibility over our Group's risk management and strategy, including material risks related to cybersecurity threats. This oversight is executed directly by our board of directors and through its committees. Our audit committee oversees the management of our Group's major financial risk exposures, the steps management has taken to monitor and control such exposures, and the process by which risk assessment and management is undertaken and handled, which would include cybersecurity risks, in accordance with its charter. The audit committee holds regular meetings and receives periodic reports from management regarding risk management, including major financial risk exposures from cybersecurity threats or incidents.

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors, of this Form 10-K.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers. The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, distributed denial-of-service and other protections to secure the company's critical infrastructure. The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts. The SOC also initiates incident response protocols, including escalating threats as needed to the IRT, including the Chief Information Security Officer ("CISO"), who can further escalate to other members of senior management and the Board, as may be appropriate. Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises and incident response exercises are used to test the effectiveness of the overall cybersecurity control environment. In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.

companyName: EVEREST REINSURANCE HOLDINGS INC


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Star Holdings

ticker: STHO


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Our information security function is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Principal Financial and Accounting Officer and information security function are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Turnstone Biologics Corp.


text: Our Cybersecurity Oversight Team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment. Pursuant to our Incident Response Plan (IRP), all of our employees are trained to report a suspected cybersecurity incident or breach to our information technology team. Reporting guidelines under the IRP describe how to report an incident and what details to include. As a first step under the IRP, our information technology team assesses the reported risk or breach and escalates it to our Incident Response Team (IRT), as appropriate. The IRT is comprised of the members of our Cybersecurity Oversight Team and other critical business function leaders, including members of our legal and communications teams. Following notification from our information technology team, the IRT is responsible for continuing to assess the suspected risk or breach to determine its potential impact on our organization, systems and data. Based on that assessment, the IRT may raise the incident or breach to other members of management or the audit committee for further review and triage.

companyName: Nuvalent, Inc.

ticker: NUVL


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, the ITSC and Chief Technology Officer provide reports and updates to the Board of Directors, or a Committee thereof on a quarterly basis.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: For instance, we utilize our existing information security measures to oversee operational landscapes, address suspicious events, and generate necessary reports shared during our monthly meetings. Additionally, as deemed necessary, we request third-party service providers to furnish System and Organization Controls ("SOC ") reports. Simultaneously, we are in the process of revising and formulating new IT policies, standards, and procedures in harmony with certain measures from the National Institute of Standards and Technology Cybersecurity framework and security requirements that may be applicable under privacy law, such as the General Data Protection Regulation (GDPR).


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Our Vice President of Information Technology regularly reports to our IT Governance Committee, which oversees our IT strategy, programs and risks, including the cybersecurity practices, procedures and controls management used to identify, assess and manage our key cybersecurity programs and risks, ensure the protection of the confidential intellectual property, information and data of the Company and its customers and ensure compliance with applicable data protection laws and regulations. Our Vice President of Information Technology has relevant experience of more than 25 years in information technology and cyber and information security, and he oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. He also holds multiple certifications including Computer Information Systems Security Professional (CISSP), Certified in Information Systems Management (CISM), Certified in Information Systems Audit (CISA), Certified in Risk and Information Systems Control (CRISC), and CompTIA Advanced Security Practitioner (CASP+). Our Vice President of Information Technology monitors and stays informed about prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT department, and through the use of technological tools and software and results from third party assessments.

companyName: ATECH (PARENT) RESOLUTION CORP.


text: In addition, we maintain processes to assess and manage risks relating to third-party service providers, including based on the nature of the engagement with the third party and based on the information and information systems to which the third party will have access. We conduct due diligence before onboarding new service providers and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: Insight Molecular Diagnostics Inc.

ticker: IMDX


text: Our individual employees also play an important role in our information security systems. All employees are required to familiarize themselves with the Company's information security policies and, at least annually, employees are required to participate in an information security training program, which is designed to help employees identify potentially threats and train them on how to respond. Throughout the year, the IT department conducts phishing campaigns and other simulated hacking attacks with employees as a way of reminding them of their security obligations and ensuing that our SETA (security education and training awareness) has been effective.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: Chord Energy Corp

ticker: CHRD


text: To the extent our processes for overseeing risks are effective in eliminating cybersecurity threats or mitigating the impact of an unforeseen incident, we generally do not expect these risks to have a material impact on our business strategy, financial position, or results of operations. However, as mentioned in Part I, Item 1A. Risk Factors, we do not carry insurance specifically for cybersecurity incidents. If we were to incur a significant liability for which we were not fully insured, it could have a material adverse effect on our financial position, results of operations and cash flows.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Head of the Information Technology Systems, or ITS, department who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Our management committee on cybersecurity oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which o ur management committee on cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include regular communication and reporting from our IT manager, alerts and warnings through the use of technological tools and software and the results of cybersecurity systems testing from a third-party consultant.

companyName: AXT INC

ticker: AXTI


text: Third-Party Cyber Risk Management Recognizing the potential vulnerabilities posed by third-party relationships, Kroger has implemented a comprehensive TPCRM program. The TPCRM program is designed to assess third-party cybersecurity risks by employing third-party cyber risk assessments, vendor tiering, and a dedicated team tasked with recommending holistic improvements to strengthen Kroger's cybersecurity posture, sourcing, and contracting processes. Kroger's Information Security Operations Center ("iSOC") responds to known third-party incidents on a continuous basis. The iSOC is a part of the Corporate Information Security ("CIS") department and is responsible for detecting, responding to, and escalating security incidents. We partner directly with business stakeholders and technology custodians to determine an appropriate response to manage incident risk to minimize the effect to the business. This response process is a regular and critical function of the iSOC and is defined in a separate appendix to the IR Plan. Any material risk identified from these incidents is escalated and communicated using formal severity and impact criteria as defined in the IR Plan.

companyName: KROGER CO

ticker: KR


text: Our Board of Directors oversees cybersecurity risk and receives updates, at a minimum, twice a year from the CISO or designee regarding cybersecurity, which updates include a review of our Adviser's global security program and cybersecurity, including risks and protections for us and our Adviser. The Global Operational Risk Management Committee, one of our Adviser's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. In addition, the CISO provides quarterly updates to our company's enterprise risk management committee, which in turn provides quarterly updates to our Board of Directors, and members of our management team are included in our Adviser's incident response process in the event a cyber security incident occurs that could materially impact us.

companyName: Invesco Commercial Real Estate Finance Trust, Inc.


text: Depending on the environment, system, and data, we implement and maintain certain technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response procedures, vulnerability management process, disaster recovery/business continuity plans, encryption, network security controls, user access controls including multifactor authentication and role-based access, data segregation, asset management, systems monitoring, vendor risk management program, employee training, penetration testing, cybersecurity insurance, and dedicated cybersecurity staff.

companyName: PagerDuty, Inc.

ticker: PD


text: We deploy technical and non-technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. We operate a security operations center which monitors our environment in a continuous manner.

companyName: Shockwave Medical, Inc.


text: Our board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Compliance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program, maintains a strategic role in coordinating cyber risk initiatives and policies, and confirming their efficacy.

companyName: ARDELYX, INC.

ticker: ARDX


text: We also have engaged a nationally recognized third party to assist with a tabletop exercise to test our readiness in respect to certain of the preceding events and risks. When risks or threats are identified to the Company by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.

companyName: SANFILIPPO JOHN B & SON INC

ticker: JBSS


text: Our management is generally responsible for the oversight of risks from cybersecurity threats, if any. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: TMT Acquisition Corp.


text: Our enterprise risk management program addresses risks facing Columbia from cybersecurity threats impacting our internal systems and/or systems supported by third-party software providers. Our Chief Digital Information Officer ("CDIO") and Chief Information Security Officer ("CISO") are responsible for identifying, assessing and managing these risks. Our CDIO has served in various information technology and digital engineering roles for nearly 30 years. See Item 1 in this Annual Report on Form 10-K for further discussion of our CDIO's background. Our CISO has served in various information technology and information security roles for over 20 years, including management of information security programs in the Department of Defense, private and public companies, as well as holds multiple industry certifications in information security. We leverage certain third-party providers and our internal Incident Response Team to alert us when a cybersecurity event occurs. Cybersecurity events may include unauthorized access, attacks on our resources, compromised accounts, malware, or ransomware. Upon alert of an event, we estimate the level of severity, create a response plan, and communicate to management as needed. Based on the estimated level of severity, timing of incident communication to management may range from immediate to quarterly. Our risk assessment process related to cybersecurity threats is subject to change in the future as threats may evolve over time.

companyName: COLUMBIA SPORTSWEAR CO

ticker: COLM


text: We engage in frequent and comprehensive monitoring of our systems, including network, systems, and application security monitoring integrated into a Security Information and Event Monitoring (SIEM) system. In addition, should a cybersecurity incident occur, our response plan is based on the NIST Special Publication 800-61 Revision 2 Computer Security Incident Handling Guide, and requires the following steps:

companyName: Petco Health & Wellness Company, Inc.

ticker: WOOF


text: Risks from Cybersecurity Threats Refer to the risk factor captioned "A failure in the Company's operational systems or infrastructure or those of third parties, including security breaches or cyber-attacks, could disrupt the Company's business, its reputation, and / or cause losses which would have a material effect on the Company's business operations and financial results" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks that could materially impact the Company's business strategy, results of operations or financial condition.

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Our Board of Directors has delegated to the Audit Committee the oversight responsibility to review and discuss with management the Company's privacy and data security, including cybersecurity, risk exposures, policies and practices, and the steps management has taken to detect, monitor and control such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The full Board and Audit Committee regularly receives reports and presentations on privacy and data security, which address relevant cybersecurity issues and risks and span a wide range of topics. These reports and presentations are provided by officers with responsibility for privacy and data security, who include our Chief Information Security Officer (CISO), Chief Technology Officer (CTO) and AT&T's Legal team. In addition to regular reports to the Audit Committee, we have protocols by which certain security incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Audit Committee.

companyName: AT&T INC.

ticker: T


text: Our corporate cybersecurity program is led by our chief information officer (CIO), who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CIO has extensive information technology and program management experience and leads a team that has many years of experience with our organization. Our cybersecurity risks are also reviewed and tested annually through third party assessments and internal and external information technology audits. Our information technology team reviews enterprise risk management level cybersecurity risks annually. Our CIO reports to our chief executive officer.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: Role of the Board Our Board of Directors exercises direct oversight of our strategic risks through its oversight of our enterprise risk management function. The Audit Committee of the Board of Directors in particular is responsible for reviewing our IT security controls and the adequacy of our IT security program, compliance and controls with management. As part of such oversight, the Board of Directors, including members of the Audit Committee, receives periodic reports from our Chief Information Officer and Vice President, Infrastructure to assess the primary cybersecurity risks we face. Our Chief Accounting Officer reports directly to the Board of Directors on our company-wide enterprise risk management, which includes an evaluation of cyber risks and threats.

companyName: Summit Materials, LLC


text: As noted above, the Company relies on the Information Systems in connection with the Company's day-to-day operations. The Company relies on the MSSP's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: Our CISO and CIO serve as members of our Compliance Committee, which is a management committee consisting of leaders from key functions, including legal, internal audit, finance and compliance. The Compliance Committee receives regular updates from the CISO and CIO on cybersecurity risks and threats.

companyName: Enpro Inc.

ticker: NPO


text: Orchestra BioMed, ("Orchestra" or "Company") maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology environment including systems, hardware, software, data, people, and processes.

companyName: Orchestra BioMed Holdings, Inc.

ticker: OBIO


text: • Education and Awareness: The Company provides annual mandatory global information security training and certification for personnel regarding cybersecurity threats. This training is offered in 20 languages to maximize associate accessibility and comprehension. Additionally, the Company administers monthly targeted trainings and phishing simulations for our associates. These activities are designed to develop a mature and vigilant, risk-aware culture among our associates.

companyName: REGAL REXNORD CORP

ticker: RRX


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Investcorp AI Acquisition Corp.

ticker: IVCAF


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use recognized commercially reasonable measures, tools, and methodologies to manage cybersecurity risk, which are tested regularly. We also monitor and evaluate our cybersecurity posture on an ongoing basis through regular malware scans, penetration tests, and third-party reviews. Specific controls that are used to some extent include endpoint threat detection, identity and access management (IAM), privileged access management (PAM), logging and monitoring, multi-factor authentication (MFA), firewalls and intrusion detection and prevention, and vulnerability and patch management.

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: Overall

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: While we follow IoT cybersecurity standards and regulations, our products and information systems are potentially subject to cyber risks of data leakage and operational damages. To protect our products and information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, annual cyber testing, internal auditing, monitoring and detection tools, and a bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors. Any reported vulnerability is analyzed and reported to our Chief Information Security Officer ("CISO").

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: As leaders of the DTI organization and CDT function, respectively, the Company's CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company's internal cybersecurity reporting structure. Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents. Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents. When members of the CDT team detect a cybersecurity threat or incident or are made aware of a cybersecurity incident encountered by a third-party service provider, the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function. The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO.

companyName: AMGEN INC

ticker: AMGN


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) depending on the offering, region of use, and other factors.

companyName: Johnson Controls International plc

ticker: JCI


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, the Company implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing review to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Our board of directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. Our board of directors receives an update on Bandwidth's risk management process at least annually, and receives quarterly cybersecurity updates from our Chief Information Officer ("CIO").

companyName: Bandwidth Inc.

ticker: BAND


text: The Company's board of directors has appointed an Information Security Officer (the "ISO"), who has cybersecurity expertise primarily related to cybersecurity assurance, compliance, digital forensics, investigations, process design and collegiate instruction who holds various certifications in areas relevant to cybersecurity risk monitoring. The ISO, working together with the Company's Chief Information Officer and Chief Risk Officer, handles the development and implementation of the Information Security Policy and Program and, together with the Company's information technology staff and third-party vendors and other outside resources, the ISO monitors the Company's information technology systems for threats and implements changes to those systems in an effort to protect the systems from attack. The ISO also coordinates the risk assessment process, facilitates annual employee training, and prepares an annual report to the Company's board of directors that contains a summary of any cybersecurity incidents occurring during the report year, and an analysis of the results of the Information Systems Audit and the Company's performance against the Information Security Policy and Program. The ISO reports directly to the Bank's Chief Risk Officer, independent of the Company's technology department, and the responsibilities of this role are in conjunction with security, fraud and other special projects concerning risk and operational issues identified. The Bank's Chief Risk Officer reports directly to the Chief Executive Officer.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: In the last fiscal year, Noble has not identified any known cyber security threats, incidents, or exposures that have materially affected Noble's business strategy, results of operations, or financial condition, but Noble faces certain ongoing cyber security risks that, if realized, could materially and adversely affect Noble. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Potential cyber security risks to Noble are shared in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Noble Corp plc

ticker: NE


text: We have documented processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that may result in adverse effects on the confidentiality, integrity, and availability of our information systems and the information residing therein. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data we collect, process, store, and transmit as part of our business. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor or customer.

companyName: FLOWSERVE CORP

ticker: FLS


text: Our cybersecurity program includes risk assessment and identification processes that are aligned with our overall enterprise risk management ("ERM") program. As part of the annual integrated risk assessment process, the cybersecurity team works with our ERM, internal audit and legal compliance functions to assess and identify cybersecurity and related risks to our business. These risks are then included, as appropriate, in the updated ERM profile, and with top risks being addressed in the cybersecurity yearly plan. As part of that process, we utilize both internal and third-party resources to identify risks. In addition, Internal Audit regularly conducts operational audits of the cybersecurity processes.

companyName: Anywhere Real Estate Group LLC


text: Our cybersecurity risk management program includes operational, technical and physical controls to protect against and respond timely to cybersecurity threats. To address evolving cybersecurity risks and corresponding regulations, our policies and procedures are benchmarked to industry, regulatory and cybersecurity frameworks (including the National Institute of Standards and Technology). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we may use industry, regulatory, and cybersecurity frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats, which include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or patients, and violation of data privacy or security laws. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our Board of Directors. Our cybersecurity policies and practices are aligned with relevant industry standards and are designed to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Key components of our cybersecurity program include governance, risk management, access and authentication controls, change management, audit and assessment, awareness and training, contingency planning, recovery, media handling, incident response, personnel and physical security, and communication integrity.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: Our cybersecurity and information security risk management program: (a) is developed by, and in conjunction with, a third-party managed security service provider (MSSP), who helps audit, assess, administer and monitor implementation; (b) once developed, is then integrated into our overall enterprise risk management program, and shares common: methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas; and (c) consists of leveraging a third-party vendor to routinely and periodically stress test our program for system vulnerabilities (including cyber penetration, vulnerability assessment, NIST framework score and compliance) across our cybersecurity and information security risk management program environment.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: Following cybersecurity incidents, GIS, in conjunction with members of management of CRH's operating companies and business units as necessary, conduct post-incident analysis and exercises designed to strengthen CRH's cybersecurity practices. The Risk Committee and Global Leadership Team are briefed on the occurrence, mitigation and remediation of cybersecurity incidents on a regular basis, including ad-hoc briefings covering significant or potentially material incidents.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: management program, the Board devotes time and attention to cybersecurity and data privacy-related risks, with the Audit Committee of the Board of Directors responsible for overseeing information technology risk exposures, including cybersecurity, data privacy and data security.

companyName: Accenture plc

ticker: ACN


text: As part of the assessment of the protections we have in place to mitigate risks from cybersecurity threats, we engage third parties to conduct vendor risk assessments. To assess the effectiveness of our program, we also have engaged consultants to conduct penetration testing and other vulnerability assessment.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from, and reporting cybersecurity events.

companyName: LXP Industrial Trust

ticker: LXP


text: A third party Managed Security Service Provider (MSSP) manages Oaktree's Security Operations Center to provide 24/7 monitoring of its global systems and to coordinate the investigation of alerts of potential security incidents. Alerts are then escalated to the Oaktree Cybersecurity team for investigation and remediation, if necessary. Cyber partners are a key part of Oaktree's cybersecurity infrastructure. Oaktree partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Oaktree engages with these partners to monitor and maintain the performance and effectiveness of products and services that are deployed in Oaktree's environment. A Managing Director in Oaktree's information technology department heads Oaktree's cybersecurity team. This individual reports to Oaktree's Chief Information Officer, and is responsible for assessing and managing Oaktree's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of collective experience selecting, deploying and operating cybersecurity technologies, initiatives and processes and relies on threat intelligence as well as other information obtained from governmental, public and private sources, including external consultants engaged by Oaktree.

companyName: Brookfield Oaktree Holdings, LLC

ticker: OAK-PA


text: We face various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the CEO on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Pony Group Inc.

ticker: PNYG


text: We rely heavily on our supply chain to deliver our products and services, and a cybersecurity incident at a supplier, subcontractor or business partner could materially adversely impact us. We require that our subcontractors report cybersecurity incidents to us so that we can assess the impact of the incident on us. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Silo Pharma, Inc.

ticker: SILO


text: The Board of Directors has delegated oversight of the Company's cybersecurity program to the Audit Committee of the Board of Directors. As provided in the Audit Committee Charter, the Audit Committee is responsible for reviewing reports on data management and cybersecurity initiatives and significant existing and emerging cybersecurity risks, including cybersecurity incidents, the impact on the Company and its stakeholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents. Our Senior Director, Information Technology ("IT"), who reports directly to our Chief Financial Officer, has primary responsibility for the day-to-day management of our cybersecurity risk management program. The individual currently operating as our Senior Director, IT has approximately thirty-four years of experience with information technology, including seventeen years of experience managing cybersecurity risk management programs. Our Senior Director, IT is supported by our internal IT team and external IT consultants, and their responsibilities include assessing, monitoring, and managing our cybersecurity risks.

companyName: Fusion Pharmaceuticals Inc.


text: Our Board of Directors ("Board") is responsible for our risk oversight, with the Audit Committee specifically overseeing management's cybersecurity risk management program. In this role, the Audit Committee receives quarterly updates from members of management, including the vice president, information technology and CIO, who oversees our information technology function ("CIO") and another vice president who supports the CIO in implementing, monitoring and updating the cybersecurity risk management program, as well as addressing existing and emerging cybersecurity threats and managing cybersecurity incidents ("Head of Information Security"). The Board receives regular reports from the Audit Committee, as well as an annual cybersecurity report or materials from management, including the CIO, highlighting key activities of the Company's cybersecurity team, including internal initiatives and updates and external engagements with third party cybersecurity firms, recent incidents throughout the industry and the emerging threat landscape.

companyName: SKYWORKS SOLUTIONS, INC.

ticker: SWKS


text: We are committed to combating the threat of cyber-attacks and to securing our business through our information security programs and developing a deep understanding of cybersecurity risks, vulnerabilities, mitigations, and threats. We have a global cybersecurity process applicable to all subsidiaries and business lines.

companyName: BGC Group, Inc.

ticker: BGC


text: Our Board of Directors has delegated oversight of the Company's enterprise risk management processes, including those related to cybersecurity risks, to the audit committee of the Board of Directors (the "Audit Committee"). Our General Counsel, following consultation with our Chief Technology Officer, provides updates to the Audit Committee concerning our cybersecurity program at its regular meetings, and the General Counsel and Chief Technology Officer provide a deeper review of the cybersecurity program, including information concerning areas of potential critical risk, to the Audit Committee approximately annually. The chair of the Audit Committee provides an overview of these updates to the Board following these sessions. In addition, the management team would escalate awareness of any material incidents to the Audit Committee promptly, should such an event occur.

companyName: Doximity, Inc.

ticker: DOCS


text: The Company's third-party risk management program oversees and identifies cybersecurity threats associated with service providers. While visibility into third-party operations is limited, risk-based evaluations are conducted. These evaluations involve reviewing security assessment questionnaires, testing summaries, audit reports, and information security policies.

companyName: California BanCorp \ CA

ticker: BCAL


text: Our cybersecurity program assists in the management of risks associated with the confidentiality, integrity and availability of data and systems within the company environment to effectively support our business objectives and customer expectations. The program provides guidance to business stakeholders on cybersecurity risks as input into their risk management processes that balance cybersecurity risk with other important risks that may include strategic, regulatory, economic and financial considerations.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: We believe cybersecurity is critical to us because we are conducting material operations. Cybersecurity threats have not affected our business strategy or results of operations. The Board of Directors will continue to assess the potential threat to future operations as such operations develop. The Board of Directors will oversee management's processes for assessing, identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity and help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity. In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: SUNRISE REAL ESTATE GROUP INC

ticker: SRRE


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. In the event we experience a cybersecurity incident we consider to be material, we will disclose such incident consistent with the requirements of Item 1.05 of Form 8-K.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: Although the Company has implemented policies and procedures to try to protect against cyber-attacks, there can be no assurance that they will be effective in avoiding disruption and business impacts. See Item 1A, Risk Factors for related discussion.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND