text: • Board of Directors, IOC, and Audit Committee—In providing oversight of risks from cybersecurity threats, the Board, IOC and Audit Committee are informed of cybersecurity risks by way of frequent reports on such topics as personnel and resources to monitor and address cybersecurity threats, technological advances in cybersecurity protection, rapidly evolving cybersecurity threats that may affect us and our industry, cybersecurity incident response and applicable cybersecurity laws, regulations and standards, as well as collaboration mechanisms with intelligence and enforcement agencies and industry groups to assure timely threat awareness and response coordination. In addition, risks associated with cybersecurity incidents, or potential incidents, are escalated by senior management promptly to the Board outside of regularly scheduled meetings, if appropriate.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: Our CISO has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The CISO has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The CISO holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.

companyName: Lyft, Inc.

ticker: LYFT

secItem: Item 1C


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct assessments, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.

companyName: BORGWARNER INC

ticker: BWA


text: Board of Director Governance The Board of Directors (the "Board") includes members with substantial cybersecurity expertise, ensuring informed oversight of cybersecurity risks. Documentation of the Board's involvement in cybersecurity oversight is maintained, highlighting the frequency and topics of discussions related to cybersecurity risks and incident response. The Board is regularly updated on cybersecurity risks and incidents through established reporting mechanisms, ensuring they are well-informed to make strategic decisions regarding the Company's cybersecurity posture.

companyName: T Stamp Inc

ticker: IDAI


text: Additionally, we maintain a proactive cyber risk management framework to identify, assess, and mitigate potential risks. Our cybersecurity policies and practices are regularly reviewed and updated to address emerging threats. We work closely with industry experts and third-party vendors and leverage advanced technologies to enhance our effort to continually provide adequate cyber defenses.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: Our Corporate Sustainability and Risk Management Committee of the Board of Directors has been delegated the power and authority to oversee and make recommendations to the Board with regard to our overall approach to risks relating to business operations, including with regard to information technology and cybersecurity. In an annual presentation, the committee received a presentation from our Chief Technology Officer regarding our approach to cybersecurity, which included the following topics: the confidentiality of nonpublic information and the integrity and security of our information system, the cybersecurity policies and procedures, material cybersecurity risks to us, and the overall effectiveness of our Company's cybersecurity program.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Cyber risk management is a core component of the Company's governance structure. We utilize the National Institute of Standards and Technology's Cybersecurity Framework as a guide in cyber risk management to identify, assess, and assist the CSO in managing cybersecurity risks. Cyber risk management encompasses partnerships among teams that are responsible for cyber governance, prevention, detection, and remediation activities within the Company's cybersecurity environment. As part of our cyber risk management efforts, we conduct periodic reviews and collaborate with enterprise-wide risk assessments to assess and manage cybersecurity risks. Our cybersecurity team also provides enterprise-wide cybersecurity training for employees to continuously improve our mitigation against human-driven vulnerabilities.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: See Item 1A. "Risk Factors — Risks Related to our Data Platform, Information Systems and Other Technology — Security incidents and other network and information systems disruptions could affect our ability to conduct our business effectively, cause us to incur significant costs, subject us to significant liability and/or damage our reputation" and "— Failure to comply with laws and regulations with respect to privacy, data protection and consumer marketing and subscriptions practices could adversely affect our business" for a discussion of cybersecurity risks that may impact us.

companyName: NEW YORK TIMES CO

ticker: NYT


text: Notwithstanding our cybersecurity efforts, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. – Risk Factors for a discussion of cybersecurity risks.

companyName: WORLD KINECT CORP

ticker: WKC


text: To manage cybersecurity risks related to third-party service providers, we conduct security assessments of certain third-party providers before engagement and have established monitoring procedures related to data breaches or other security incidents originating from third parties. To assist in this effort, we may from time to time engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate certain potential cybersecurity incidents as appropriate.

companyName: Vista Outdoor Inc.


text: This comprehensive cybersecurity solution offers advanced threat detection, prevention, and response capabilities, including real-time monitoring, threat intelligence, behavioral analysis, endpoint detection and response, malware prevention, and automated response actions. Additionally, the comprehensive cybersecurity solution also provides access to cybersecurity experts, who provide proactive threat monitoring and incident response support to effectively detect, investigate, and remediate security incidents.

companyName: Lightstone Value Plus REIT V, Inc.


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party consultants, designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve issues timely.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents as appropriate.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: We believe our cybersecurity program is reasonably designed to materially protect the integrity and availability of our information and technology. This program addresses security governance, security awareness, employee training, relevant access and end-point security, vulnerability management, penetration testing, security monitoring and incident response. We use technologies to optimize our security risk detection and response capabilities, in addition to access controls and anti-malware protections. We believe our practices align with the NIST Cybersecurity Framework in meeting and exceeding the industry average in cybersecurity practice.

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: Our Chief Information Officer and his team are responsible for leading our cybersecurity strategy, policy, standards, architecture, and processes. Our information security leadership team has more than 20 years of combined experience in cyber and information security matters. Our information security program is also supported by our Chief Compliance Officer and other members of senior management. We conduct periodic reviews of our program by internal and external experts with the results of those reviews reported to senior management and the Board. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners. For example, we require certain third-party service providers and other business partners to provide us with SOC II reports that demonstrate compliance with security standards. We also actively engage with industry participants, as well as intelligence and law enforcement communities as appropriate, as part of our continuing efforts to evolve our cybersecurity governance.

companyName: Monster Beverage Corp

ticker: MNST


text: Our IT security department, which assesses and manages our risks from cybersecurity threats, is led by our SVP IT Infrastructure & Security, who reports to our Senior EVP IT. Additional oversight for assessing and managing cybersecurity risk include Executive sponsors, Information Technology, Human Resources, IT Governance Risk and Compliance, Internal Audit, and Legal, as well as members of our Information Security Risk Council, IT Risk Committee, and Enterprise Risk Management teams.

companyName: FASTENAL CO

ticker: FAST


text: These operational risks are managed within a governance structure that consists of defined roles and responsibilities, formal governance bodies, and processes, policies and standards.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to participants in preclinical studies and clinical trials involving certain of our product candidates (Information Systems and Data).

companyName: Climb Bio, Inc.

ticker: CLYM


text: Our process for identifying and assessing material risks from cybersecurity threats operates within our broader overall risk management program. As part of this program, our Chief Information Officer ("CIO") and Vice President of Internal Audit collaborate with subject matter specialists throughout the Company, as necessary, to gather insights for identifying and assessing material risks throughout the Company, including cybersecurity threat risks.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: In conclusion, by prioritizing cybersecurity, we aim to protect the interests of our stakeholders, promote business continuity, and uphold the trust that our customers place in us. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Chevron's business and proprietary information, information technology (IT) and operational technology (OT) networks are essential to its success. The company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by identifying and appropriately managing and mitigating risks while ensuring business resiliency. This program is integrated within the company's Enterprise Risk Management (ERM) process, which is the company's systematic approach to identifying, managing and assessing major risks and safeguards, including cybersecurity risks. Chevron uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.

companyName: CHEVRON CORP

ticker: CVX


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our Chief Information Security Officer, or CISO, and Chief Information Officer, or CIO, periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: ProAssurance's Information Systems Security department, with assistance from third-party security vendors, continually monitors the Company's systems for indicators of attack or compromise to mitigate the risk of cyberattacks. The Company regularly enhances its cyber and information security in order to identify and neutralize emerging threats and improve its ability to prevent, detect and respond to attempts to gain unauthorized access to the Company's data and systems. ProAssurance regularly adds additional security measures to its computer systems and network infrastructure to mitigate the possibility of cybersecurity breaches, including firewalls and penetration testing. The Company encrypts sensitive information and data and utilizes stringent access controls. Team members are required to complete quarterly security training which encompasses a wide range of cybersecurity topics. This training informs all team members of the processes and procedures to follow in the case they encounter a possible cybersecurity threat. This training is reinforced through periodic simulated phishing tests. Further, all team members are required to read and acknowledge the Company's guidelines for the use of publicly available generative artificial intelligence tools. The Company's guidelines explain how to protect the Company from risks that can arise if legally protected, proprietary or confidential information is shared with these tools.

companyName: PROASSURANCE CORP

ticker: PRA


text: As part of the above processes, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. As of 2024, our Information Security Management System has been certified to conform to the requirements of ISO/IEC 27001:2013.

companyName: Tesla, Inc.

ticker: TSLA


text: The Company's management also has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. These processes include, but are not limited to: • Maintaining an inventory of all third-party vendors engaged by the Company and assessing each vendor's level of access to the Company's IT and OT systems and information; and • Implementing access controls that restrict vendor access to only specific Company systems and information necessary to perform their service.

companyName: Summit Midstream Corp

ticker: SMC


text: Although the Company endeavors to mitigate cybersecurity risks, we face cybersecurity risks, threats and attacks that could have a material adverse effect on the Company's business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Legal, Tax and Regulatory Risks."

companyName: Lovesac Co

ticker: LOVE


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our data and information systems are effectively secured and prepared for information security risks by internal and external threat actors. Our program involves regular monitoring of our internal IT assets, data inventories, and potential security exploits and/or threats to those assets' confidentiality, integrity, and availability. We employ a range of technical security tools and external security services, including regular network and endpoint monitoring, compliance audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk posture, remediation plans and cybersecurity investments.

companyName: Hyperfine, Inc.

ticker: HYPR


text: The Board has ultimate oversight of cybersecurity risk. The Board reviews management's assessment of our key enterprise risks and its strategy with respect to each risk, including cybersecurity risks, and receives a corresponding risk management update annually. The Information Technology Committee reviews the effectiveness of our cybersecurity controls and procedures, including procedures to identify and assess internal and external risks from cybersecurity threats; controls to prevent and protect from cyberattacks, unauthorized access or other malicious acts and risks; procedures to detect, respond to, mitigate negative effects from and remediate cybersecurity attacks; and controls and procedures for fulfilling applicable regulatory reporting and disclosure obligations of the risks and costs of cybersecurity incidents. Our Chief Information Security Officer ("CISO") briefs or provides a report to the Information Technology Committee on our cybersecurity and information security posture and program at least quarterly, including penetration test results and related remediation and significant cybersecurity incidents, and also provides an annual cybersecurity update to the full Board.

companyName: ASSURANT, INC.

ticker: AIZ


text: Our cybersecurity incident response policy and plans are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. The Director of Information Technology (IT) works with the Company's incident response team, which consists of members of IT, legal, compliance, human resources, and others as applicable) to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy and plans include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: Artiva Biotherapeutics, Inc.

ticker: ARTV


text: As needed, the Adviser collaborates with J.P. Morgan to engage third-party assessors or auditing firms with industry-recognized expertise on cybersecurity matters to review specific aspects of its cybersecurity risk management framework, processes and controls.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: We are a SPAC with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluating suitable target businesses. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Angel Studios, Inc.

ticker: ANGX


text: Assessing, identifying, and managing cybersecurity related risks are also integrated into our enterprise risk management (ERM) program. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the Company on an annual basis. Risks are discussed with appropriate members of management, who manage risk coverage, monitoring and reporting in the relevant risk function, including our cybersecurity program, and incorporate those activities as part of developing our strategic plan. The ERM program's annual risk assessment is presented annually to our Board of Directors.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Our information security program is managed by a CISO, whose team is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CISO has more than 20 years of experience directing disparate teams across application and product security, cyber defense, risk management, information governance, information technology compliance, information technology training and sales. Our CISO is appointed by the RACC, which also oversees the implementation, monitoring and testing of our information security program. Our CISO and CRO provide periodic reports to the RACC, at least quarterly. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen our information security posture, assessments of the information security program, and the emerging threat landscape. Our CISO and CRO also regularly meet separately with the chair of the RACC to provide similar updates. Our information security program includes incident response procedures designed to facilitate escalation of actual or potential cybersecurity incidents initially to members of our security team, and as appropriate to senior management and the RACC, to allow proper consideration, mitigation and remediation of, as well as evaluation of potential disclosure obligations with respect to, actual or potential cybersecurity incidents. Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the RACC. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.

companyName: Q2 Holdings, Inc.

ticker: QTWO


text: Our Head of Information Technology and Security, or Head of IT, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of information technology professionals to monitor cybersecurity risks on behalf of TScan. Our Head of IT has over 15 years' experience with information technology and cybersecurity risk management programs.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our Chief Executive Officer is responsible for assessing and managing cybersecurity risks, responding to any cybersecurity incidents and reporting any such incidents to our Board of Directors, and periodically briefs our Board of Directors on our cybersecurity and information security posture and on any cybersecurity incidents deemed to have a moderate or higher business impact. In the event of a material cybersecurity incident, our cybersecurity consultant has extensive information technology and program management experience. We believe that we have implemented a governance structure and processes that are equipped to assess, identify, manage and report cybersecurity risks. Refer to "Item 1A. Risk Factors" for a discussion of certain of the cybersecurity risks that our business is subject to. As a smaller reporting company, with respect to compliance with Form 8-K incident disclosure requirements, we are required to comply with the reporting requirements beginning June 15, 2024.

companyName: Sphere 3D Corp.

ticker: ANY


text: We also maintain a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: PubMatic, Inc.

ticker: PUBM


text: Apollo's Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are fully integrated into its ERM framework through its reporting, risk management and oversight channels and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Infrastructure Co LLC


text: Protection is ensured through weekly oversight from the CEO and Accounting Supervisor and quarterly oversight from the Board of Directors.

companyName: BrewBilt Brewing Co


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's Enterprise Risk Management Program ("ERMP"), and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERMP and are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a systematic, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents if they should occur.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Management updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of senior management, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the Company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: ULTRALIFE CORP

ticker: ULBI


text: We aim to proactively identify sources of risk, areas of impact, and relevant events that could give rise to cybersecurity risks, such as changes to our infrastructure, service providers, or personnel.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Board of Directors Our cybersecurity program is overseen by the independent Audit Committee of our Board. Our Chief Information Security Officer ("CISO") presents a quarterly report of cybersecurity updates to the Audit Committee. Each quarter, the Board receives a report from the Audit Committee chair on items covered during that quarter's meeting. In 2023, the topics included our focus on cybersecurity resilience, our approach to responsible use of Artificial Intelligence and the new cybersecurity disclosure rules. Our Board's and Audit Committee's inputs are key components in the development of our long-term cybersecurity strategy, aligning the program's goals within our risk tolerance.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: Our CFO leads the IT department and together with IT management they have more than 30 years of combined experience in the IT profession.

companyName: Smart Sand, Inc.

ticker: SND


text: Once hired, we expect our permanent CISO to continue strengthening our information security posture, assist with incident response and any remediation plans, and provide quarterly reports to the Audit Committee, as we transition from using a Virtual CISO.

companyName: Compass, Inc.

ticker: COMP


text: Risk Management and Strategy Aemetis' cybersecurity and information security framework includes physical, administrative and technical safeguards, as well as plans and procedures we believe are reasonable to help Aemetis prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact our operations, facilities and employees. These plans are based upon our assessment of risk considering our industry, specific operations, cyber perimeter, social exposure, information confidentiality and tertiary stakeholders.

companyName: AEMETIS, INC

ticker: AMTX


text: Our ISC has expertise in the following areas which assist in assessing and managing applicable cybersecurity risk: 27 years of IT experience including endpoint detection, security, incident management and response, vulnerability management and response, event management and response, and network security segmentation. The ISC provides regular reports on ongoing risk and mitigation practices, including information about cyber risk management governance and status updates on various projects intended to enhance the overall cybersecurity posture of the Company, to our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, and General Counsel, who then report to the Audit Committee and the Board.

companyName: PULSE BIOSCIENCES, INC.

ticker: PLSE


text: Risk Management and Strategy Assessing, Identifying, and Managing Material Cyber Threats We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, and managing material risks from cybersecurity threats. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy. We use a team of outside vendors and government services specializing in IT and cybersecurity that provide expertise, tools, and methodologies to identify and assess vulnerabilities and potential threats. Automated tools and AI-based user behavior analytics also support identification and management of cyber threats. Response to a broad category of threats is immediate and automatic. Security personnel and members of our management are alerted when cyber threats or anomalies are detected. Persistent threats or issues that, in the opinion of management, are material are immediately brought to the attention of our board of directors.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: The company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The company's cybersecurity function is led by the company's director of information security, who reports to the CIO. The director of information security and CIO (collectively, the Cybersecurity Leaders) are actively involved in assessing and managing cybersecurity risks, and are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are as follows:

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our contracted IT Director, who has over 24 years of IT management experience for public companies including Synergy Pharmaceuticals, Inc.

companyName: Turnstone Biologics Corp.


text: Our Chief Information Security Officer provides frequent briefings to management regarding the Company's cyber security risks and risk-mitigation efforts, which may include recent incidents and related responses, newly identified risks, changes to the security program, and activities of third parties and vendors, as appropriate. Management provides cybersecurity updates to executive management and the Board through meetings and materials shared in connection with those meetings, as well as ad hoc updates when there are material developments or changes.

companyName: Life360, Inc.

ticker: LIF


text: The Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In fiscal year 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: AMAZE HOLDINGS, INC.

ticker: AMZE


text: Our cross-functional cybersecurity team, composed of experts with decades of combined experience, supports the CIO and Director in implementing our cybersecurity program. This team consults with legal, HR, and IT specialists to assess the materiality of cybersecurity risks and incidents, using a well-established Incident Response Plan that includes clear escalation measures.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels on at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating, and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.

companyName: Waste Connections, Inc.

ticker: WCN


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO who has over 18 years of experience in the field of cybersecurity, including at Civeo and previously for a Fortune 500 company. The CISO implements and oversees processes for the monitoring of our information systems, which includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The CISO also oversees our cybersecurity governance programs, assists with testing our compliance with applicable standards, leads our efforts to remediate known risks and leads our employee training program.

companyName: Civeo Corp

ticker: CVEO


text: Refer to the risk factor captioned "Failure to maintain and properly safeguard an adequate technology infrastructure may limit our or our Affiliates' growth, result in losses or disrupt our or our Affiliates' businesses" in Part I, Item 1A. "Risk Factors" for more information regarding cybersecurity risks and potential related impacts on AMG.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: One of the key functions of our Board is informed oversight of our risk management process. Our Board does not have a standing risk management committee, but rather administers this oversight function directly through the Board, as well as through various standing committees of our Board that address risks inherent in their respective areas of oversight. The Board as a whole regularly (and no less than annually) reviews management's annual enterprise risk assessment, business continuity process and cybersecurity posture. Our Audit Committee is responsible for overseeing the management of risks associated with our financial reporting, accounting and auditing matters, as well as business related risks (such as leadership, continuity, cybersecurity and matters relating to our commercial activities), reviewing as required our processes around the management and monitoring of such risks, as well as conducting a risk assessment review. Our Audit Committee charter sets forth the responsibilities of the Audit Committee consistent with the rules and regulations of the applicable SEC and the Nasdaq rules, including reviewing the Company's approach to risk mitigation with respect to IT and cybersecurity. An information security update is provided quarterly, or as needed, to the Audit Committee, with a detailed review provided at least annually, or as needed.

companyName: Aurinia Pharmaceuticals Inc.

ticker: AUPH


text: The Company’s Chief Information Security Officer (“CISO”) is responsible for cybersecurity at the executive level and oversees a team of cybersecurity professionals responsible for assessing and managing our material risk from cybersecurity threats. The CISO works closely with and reports to the Chief Information Officer. Our CISO has over two decades of cybersecurity experience, including responsibilities in technical risk management, information security, cyber investigations, incident response, and cyber strategy. In addition to the CISO’s professional background, the CISO maintains relevant industry credentials.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Morgan Stanley and Company Management's role in assessing and managing material risks from cybersecurity threats Morgan Stanley's Cybersecurity Program is operated and maintained by its management, including the Chief Information Officer ("CIO") of Cyber, Data, Risk and Resilience and the Chief Information Security Officer ("CISO"). These senior officers are responsible for assessing and managing the Firm's cybersecurity risks, which includes cybersecurity risks faced by the Company. Morgan Stanley's Cybersecurity Program strategy, which is set by the CISO and overseen by the Morgan Stanley's Head of Operational Cyber, Technology, and Information Security Non-Financial Risk ("Head of NFR CTIS"), is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. Morgan Stanley's Cybersecurity Program also includes processes for escalating and considering the materiality of incidents that impact the Firm and the Company, including escalation to senior management of Morgan Stanley, the MS Board, and management of the Company.

companyName: North Haven Private Income Fund LLC


text: We employ a risk management strategy for the assessment, identification and management of material risks stemming from cybersecurity threats. Our methodologies involve a systematic evaluation of potential threats, vulnerabilities, and their potential impacts on our organization's operations, data, and systems. Our cybersecurity risk management program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, and our IT environment; • The use of third-party service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management through the use of third-party providers for regular mandatory trainings; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • We design and assess our program using the National Institute Cybersecurity Framework ("NIST CSF") as a set of guiding principles.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: Our policies and procedures also address the oversight, identification, and mitigation of cybersecurity risks associated with our use of third-party service providers. Our policy stipulates that each third-party service provider go through a mandatory IT Security Governance review and obtain formal approval by our IT Security Governance group before it can be used.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: We have adopted a cybersecurity governance structure to identify, assess, and manage material risks from cybersecurity threats that include a framework to respond to and assess internal and external threats to the security, confidentiality, and integrity of Arvana's data and information systems. Under which framework management is responsible for assessing and managing material risks that arise from cybersecurity threats. We have not engaged third-party qualified contractors or claim any management expertise from which to draw in the event of cybersecurity threats.

companyName: ARVANA INC

ticker: AVNI


text: We use managed detection and response services to monitor our network infrastructure and associated endpoints for possible cybersecurity threats. In addition, we engage third parties to perform penetration testing and to assess the effectiveness of our cybersecurity practices. We conduct a cybersecurity risk assessment by identifying critical assets, recognizing potential threats and vulnerabilities, and implementing strategies to mitigate these cybersecurity risks and their possible impacts. We also actively engage with key vendors and industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and third party consultants, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We also provide employee training to support identification of and how to respond to cyber attacks. The results of these assessments are reported to the Audit Committee of the Board.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: In addition, we maintain a global privacy program to identify, assess, and manage privacy risks related to how we are collecting, using, sharing, storing, and otherwise processing personal data.

companyName: STARBUCKS CORP

ticker: SBUX


text: We maintain a security incident response plan that designates an incident response team comprised of information technology leadership and cybersecurity personnel as well as relevant third-party service providers. The objective of the plan is to provide for the timely diagnosis and mitigation of cyber events. The incident response team, in conjunction with the Company's legal counsel, is responsible for determining whether a cybersecurity incident is material and requires reporting to our cyber insurance carrier and/or reporting pursuant to the disclosure requirement of the SEC.

companyName: SURMODICS INC

ticker: SRDX


text: We have an enterprise risk assessment process which specifically addresses risks associated with cybersecurity. Additionally, we have a cyber security incident response plan that outlines the structure, roles, responsibilities and operating procedures to utilize during potentially significant events that could negatively impact the Company. Our cybersecurity incident response plan provides a documented framework for handling high severity security incidents and includes facilitated coordination across multiple functions of the Company. Our incident response plan also includes identifying and responding to material risks from cybersecurity threats associated with our use of third-party service providers. We invest in threat intelligence and are active participants in industry and government forums to strive to improve our overall capabilities with respect to cybersecurity. We routinely perform reviews of threat intelligence and vulnerability management capabilities, while performing simulations and drills at both technical and management levels. Our formal cybersecurity program is modeled after industry best practice global standards and best practices. We incorporate external expertise in all aspects of our program utilizing best practice guidance from third-party cybersecurity advisors to provide objective assessments of our capabilities. We maintain a cyber liability insurance program, although the coverage may not be sufficient in some circumstances. We also have policies and practices in place to address data privacy regulations. Our cybersecurity program is reviewed and assessed by external information security specialists or by our internal audit group at least annually. Further, we conduct annual cybersecurity awareness training for employees and targeted training for high-risk functions of the Company. We also conduct phishing exercises and correlated education with our employees.

companyName: Vera Bradley, Inc.

ticker: VRA


text: As part of the Corporation's overall risk management processes, the board of directors has established both a senior management Risk Management Committee and a separate senior management Information Technology Steering Committee. Each of these Committees meets regularly and consists of the Corporation's senior management department heads, plus the Chief Executive Officer and the President and Chief Financial Officer of the Corporation (each of whom also serves as a director of the Corporation). The Information Technology Steering Committee reports directly to the board of directors, with the Corporation's Chief Information Officer ("CIO") presenting to the board a detailed report on information systems and cybersecurity matters at least once annually. The board of directors also receives and reviews copies of minutes of all meetings of both the Risk Management Committee and the Information Technology Steering Committee.

companyName: PENNS WOODS BANCORP INC


text: Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, derived from industry standards and best practices. These policies are intended to identify cybersecurity threats that may be associated with both internally managed systems and systems managed by third-party service conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against best practices. Our internal audit function provides an independent assessment on the overall operations of our cybersecurity program and the supporting framework.

companyName: Investview, Inc.

ticker: INVU


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the section referred to as: "If our information technology systems or data, including the personal information and other sensitive information we process, or the information technology systems or data of third parties upon whom we rely, are or were comprised or affected by a cybersecurity incident, we could experience adverse consequences, including, but not limited to, additional costs, loss of revenue, significant liabilities, harm to our brand, material disruption of our operations and other adverse consequences."

companyName: CS Disco, Inc.

ticker: LAW


text: The IPRC is the management-level governance body that oversees our management of cybersecurity threats and data privacy risks and supports the strategic goals of our information security programs. The IPRC also oversees the appropriate remediation and response to cybersecurity incidents in accordance with applicable legal and regulatory requirements as well as our Information Security Incident Response Plan. The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, CTO, and General Counsel and Corporate Secretary. The IPRC members include our CISO, the senior attorney in the privacy function, the senior attorney in the corporate and securities function, the Chief Accounting Officer, and the Managing Director, Travel and Membership. The CISO leads a team of information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading "Cybersecurity Risk Management and Strategy."

companyName: Travel & Leisure Co.

ticker: TNL


text: We are committed to protecting our information assets and systems. We have an enterprise-wide information security program designed to identify, protect against, detect, and respond to and manage reasonably foreseeable cybersecurity risks and threats. We have installed privacy/security protection systems and devices on our network in an attempt to prevent cyberthreats and other unauthorized access to information.

companyName: Envista Holdings Corp

ticker: NVST


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. During the reporting period we have not experienced any material cybersecurity incidents nor any series of immaterial cybersecurity incidents that would require to be disclosed in this year end report.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: (iii) Whether such persons or committees report information about such risks to the board of directors or a committee or subcommittee of the board of directors.

companyName: Energy & Water Development Corp

ticker: EAWD


text: Our CIO is the management position with primary responsibility for the development, operation and maintenance of our information security program. He reports directly to our CEO. Certain of the CIO's direct reports have extensive expertise in the area of cyber risk management.

companyName: NuStar Energy L.P.


text: The Chief Information Security Officer (CISO), reporting to the Chief Risk Officer, is responsible for information security and cybersecurity risk management. The CISO has over 20 years of experience in cybersecurity in Financial Services and is a Certified Information Systems Security Professional (CISSP) and holds a SysAdmin, Audit, Network and Security Global Information Assurance Certification (SANS GCIA).

companyName: Independent Bank Group, Inc.


text: The potential impact of risks from cybersecurity threats are assessed on an ongoing basis, and how such risks could materially affect our business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: PhenixFIN Corp

ticker: PFX


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO's and VP of Information Security's collectively have over 25 years of experience in leading information technology and security functions across strategy, architecture, engineering, and operations.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: Our Chief Digital and Information Officer has over 30 years of experience at multinational companies, including six years of service at our company in his current position as a digital leader and executive, including experience managing and responding to cybersecurity risks. He holds a bachelor's degree in computer science. Our Senior Director, Global Information Security has over two decades of service at multinational companies and a federal government agency, including over one year of service at our company in his current position dedicated to information technology and cybersecurity, and possesses significant experience in protecting critical data and building cybersecurity-resilient organizations. He holds a bachelor's degree in telecommunications management and a master's degree in cybersecurity, as well as a current Certified Information Systems Security Professional (CISSP) certification.

companyName: Ingredion Inc

ticker: INGR


text: Our information technology team consists of professionals with deep cybersecurity expertise across multiple industries. Our executive leadership team, along with input from the above professionals, are responsible for our overall enterprise risk management process and regularly consider cybersecurity risks in the context of other material risks to the Company.

companyName: BioCardia, Inc.

ticker: BCDA


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; and.

companyName: CREATIVE REALITIES, INC.

ticker: CREX


text: Our cybersecurity team collaborates with leaders from each department to ensure cybersecurity risks are considered alongside operational, financial, and strategic risks. We conduct regular cybersecurity risk assessments as part of our enterprise risk management program, ensuring that the cybersecurity risks are tracked, rated, and managed with the same rigor as all other company risks.

companyName: Powerfleet, Inc.

ticker: AIOT


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Bank's Information Technology Steering Committee as well as the board of directors. The Incident Response Plan is coordinated through the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of the Bank's organization and is evaluated at least annually.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: The Company's Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing the Company's risk management and information technology programs of which cybersecurity is a critical element. Management is responsible for the administration of the Company's cybersecurity policies, standards, procedures and practices. The Company's cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices. The Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they arise.

companyName: Xencor Inc

ticker: XNCR


text: Our cybersecurity risk management processes are integrated into our overall risk management strategy. As part of our risk management strategy, our cybersecurity framework encompasses the following key processes:

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We have an information technology ("IT") security team, led by our chief information security officer, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. We seek to address cybersecurity risks through a cross-functional approach, including relevant training for applicable associates and regular reviews and tests of our cybersecurity program that leverage audits performed by our internal audit team. In addition to our in-house cybersecurity capabilities, at times we also engage consultants or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: GameStop Corp.

ticker: GME


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack. Our cyber risk coverage includes assistance in the timely remediation of material cyberattacks and incidents.

companyName: RPC INC

ticker: RES


text: Our executive leadership exerts operational oversight of our cybersecurity as part of our overall risk management function. We engage an expert IT and security provider to assist us with managing security risk and responding to cybersecurity threats or incidents. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and utilize back-up and recovery systems where appropriate. We also use other technology-based tools that are designed to mitigate and detect cybersecurity risks. In addition, we provide our employees with cybersecurity training, including topics such as phishing, password protection and reporting cyber incidents.

companyName: Edesa Biotech, Inc.

ticker: EDSA


text: The Audit Committee of the Company's Board of Directors, which is wholly comprised of independent directors, is tasked with oversight of the Company's enterprise risk assessment and risk management policies and guidelines, including cybersecurity. The Audit Committee receives quarterly cybersecurity updates from the Chief Information Officer and/or the CISO. Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries. The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management. The Audit Committee updates the Board of Directors as appropriate.

companyName: Strategic Education, Inc.

ticker: STRA


text: As cybersecurity threats continue to evolve, we remain committed to strengthening our cybersecurity governance model, enhancing transparency and implementing best-in-class security measures. Our approach reflects a proactive commitment to protecting our digital infrastructure, ensuring business continuity and upholding the trust of our stakeholders.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: Our Company's cybersecurity team, overseen by our Chief Information Security Officer ("CISO") is responsible for assessing and managing our risks from cybersecurity threats, including defining our security policy and furnishing related information for Board reporting. The CISO approves all security policies and oversees the identification, assessment, and management of security risks. The CISO regularly reports to management's SOX Committee which may elevate cybersecurity issues to the Board at any time.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: Our CFO oversees our cybersecurity policies and procedures, including those described in "Risk Management and Strategy" above. Under such policies and procedures, our CFO is responsible for reporting to our board of directors regarding any cybersecurity incident including the results of cybersecurity risk assessments.

companyName: Empery Digital Inc.

ticker: EMPD


text: Our management team has formed a dedicated group, including our General Counsel, Chief Technology Officer, and key information technology team members from our information technology security, compliance, vendor management office and our project management office, that is responsible for assessing and managing our material risks from cybersecurity threats. This group meets on a monthly basis to discuss the results of our cybersecurity and privacy matters and to evaluate new technologies from a security, operational, and regulatory perspective prior to their implementation. Their findings are summarized in a comprehensive report that is reviewed by our Audit Committee. Our Chief Technology Officer has over 30 years of experience in cybersecurity related to infrastructure (on-premise and cloud based), security (managed both internally and by third-party providers), and development (agile and waterfall methodologies). Our Chief Technology Officer is supported by a team of information security and compliance professionals and third-party partners.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: Suspicious activity within Company networks and systems are investigated and assessed by the Director of IT and then reported to the executive management team. Verified incidents are also communicated to the Board of Directors. On a quarterly basis, the Director of IT reports cybersecurity monitoring updates to the CEO, coordinates with our newly appointed Board Member to implement our information technology and cybersecurity programs, as well as with our HR Manager to ensure that the Company's employees have the adequate training on cybersecurity best practices.

companyName: Snail, Inc.

ticker: SNAL


text: The Company leverages a combination of the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Center for Internet Security (CIS) Critical Security Controls as the scale against which to assess its information security program and invest in its ability to proactively defend against security risks within its environment. Domino's conducts annual risk assessments, both internally and through the use of third parties, to evaluate the effectiveness of its security controls and identify new threats and vulnerabilities and appropriate controls to mitigate risks and supplements these regular assessments with ongoing monitoring. Additionally, Domino's participates in ongoing and periodic assessments of its external platform and applications to include running a responsible disclosure program to ensure that vulnerabilities that are discovered can be reported and appropriately remediated. Domino's has been certified as compliant with the Payment Card Industry Data Security Standard ("PCI DSS") standards and has several dedicated teams of specialists within its information security department that routinely conduct internal and external vulnerability and penetration assessments in accordance with both PCI DSS and industry accepted practices. This team keeps the Company's management informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents and leads the Company's processes to oversee and identify risks from cybersecurity threats associated with the Company's use of its third-party service providers. The Company additionally has established and maintains a dedicated Security Operations Center (SOC) team that is responsible for quickly identifying and treating events that could pose risk to its technology environments and that has a documented incident response plan in place.

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: CALIX, INC

ticker: CALX


text: Our Board of Directors, including through its audit committee, oversees our enterprise risk management processes, including our cybersecurity risk exposure and the steps management has taken to monitor, control, and address such exposure. The audit committee regularly reviews and discusses with our senior management, our internal audit team, and our independent auditor, our policies and processes designed to identify, monitor, and address enterprise risks, including risks from cybersecurity threats and incidents. This oversight and review of our risks from cybersecurity threats includes, among other things, our SVP, Chief Security Officer (CSO) providing regular quarterly briefings to our Board of Directors regarding cybersecurity threats, processes for preventing and/or addressing current threats, ongoing cybersecurity initiatives and strategy and regulatory compliance; our internal audit team reporting on a quarterly basis to the audit committee regarding cybersecurity and other enterprise risk management efforts and related audits and management action plans to mitigate risks by internal audits; and periodic other updates to our Board of Directors by our CEO and CSO in the event of specific critical cybersecurity threats.

companyName: Cloudflare, Inc.

ticker: NET


text: We have in place a cybersecurity incident response plan, reviewed by the Audit Committee, which establishes incident response processes, policies and procedures. Under the plan, our CFO, as incident response leader, works with the Company's SIRT to help the Company mitigate and remediate cybersecurity incidents of which they are notified.

companyName: NGM BIOPHARMACEUTICALS INC


text: We monitor potential cybersecurity risks through tracking. These key risks are characterized by various factors such as the likelihood of us experiencing a particular type of cybersecurity incident, the speed at which each type of cybersecurity incident could impact the Company, and management's assessment of the Company's ability to respond quickly and efficiently.

companyName: Hawkeye Systems, Inc.

ticker: HWKE


text: Our risks of security breaches, improper access to or disclosure of our data, our customers' data or their end users' data, other hacking attacks on our systems or the third-party systems that we use, or other cyber incidents and privacy breaches could harm our reputation and adversely affect our business, are further disclosed in Item 1A. RISK FACTORS. To date, there have been no cybersecurity incidents which have materially affected, or have been reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. Further, we have a cyber risk insurance policy designed to help us mitigate risk exposure by providing top-tier external cybersecurity firms, as needed, and offsetting certain costs that may be involved with response, recovery and remediation after a cybersecurity breach or similar event.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: As described above, we have engaged a third-party IT and cybersecurity firm to which we have delegated primary responsibility to oversee, implement and manage our processes and controls to assess, identify and manage risks from cybersecurity threats. Management receives monthly reports from the third-party IT and cybersecurity firm regarding cybersecurity incidents and any necessary remedial actions, data security posture and cybersecurity risk management processes and strategies. Management also meets quarterly with the third-party IT and cybersecurity firm to discuss technology and cybersecurity policies and procedures and risks and remediation actions.

companyName: Broad Street Realty, Inc.

ticker: BRST


text: Management's Role in Cybersecurity Risk Management The Adviser's management, including the Director of IT, are responsible for assessing and managing material risks from cybersecurity threats. The Director of IT reports into Stone Point's Risk and Compliance Committee on cyber matters. The Adviser's management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as extensive experience in managing compliance risks in the financial sector, including those related to cybersecurity. The Director of IT has deep expertise in information technology and cybersecurity. The Adviser's management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with information technology, legal and compliance personnel of the Adviser.

companyName: Stone Point Credit Corp


text: Risk Management and Strategy Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. The Cybersecurity Program has various tools and programs in place to monitor and address potential threats and incidents impacting the Company's operations and to determine the materiality of and ensure timely public disclosure of such threat or incident, if appropriate.

companyName: BORGWARNER INC

ticker: BWA


text: GOVERNANCE. NeurAxis' Board of Directors is responsible for oversight of cybersecurity risk. The Board receives reporting about NeurAxis' practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from NeurAxis' Chief Regulatory Officer/Privacy Officer and VP of IT/Security Officer.

companyName: Neuraxis, INC

ticker: NRXS


text: The company's cybersecurity program is managed by the Canada Information Technology (IT) Manager, with support from cross-functional teams led by IT and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: Cyber Incident Response Plan Our Cyber Incident Response Plan outlines the processes for detecting, identifying, prioritizing, and analyzing information security events. Depending on the incident's scope, business impact, and potential material risk, our CISO, legal counsel, and business stakeholders are engaged. This cross-functional team assesses the appropriate response and mitigation pathway. Once security events are identified through our enterprise detection and monitoring ecosystem, the Incident Response Plan establishes a prioritization and decision workflow to determine the scope, business impact, and potential material risk, implemented in collaboration with the CISO, legal counsel, and business stakeholders.

companyName: EGAIN Corp

ticker: EGAN


text: Our VP of IT provides quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, emerging threats and updates, cybersecurity systems testing, activities of third parties, and the like. Our audit committee and VP of IT provide regular updates to the Board on such reports. In the event of an actual cybersecurity threat or incident, management and the audit committee are notified in accordance with the Company's cybersecurity response plan detailed above.

companyName: Arq, Inc.

ticker: ARQ


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response process; conducting risk assessments; encrypting certain of our data; segregating certain of our data; implementing network security controls; maintaining access and physical security controls; asset management processes for managing, tracking, and disposing of assets; monitoring our corporate systems; and providing security awareness training to employees.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: We established a cyber incident management team that consists of our Sponsor's CIO, CISO, CFO, CLO and our CEO, CFO, General Counsel and Head of Marketing that is responsible for determining if a cybersecurity incident is material to us and requires disclosure.

companyName: JLL Income Property Trust, Inc.


text: As part of its collective risk management process, our Manager engages a third party information technology consultant ("IT Consultant") to evaluate risks associated with the Manager's information and technology system(s), network and physical devices. Our Manager's cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of our Manager. Our Manager also has annual certification requirements for employees, including employees who provide services to us pursuant to our Management Agreement with respect to certain policies supporting the cybersecurity program including Chicago Atlantic's Information Security and Electronic Communications policy, Data Protection Policy and Privacy Policy. Our Manager undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of our Manager and our critical third-party vendors and other partners. Our Manager also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: Chicago Atlantic Real Estate Finance, Inc.

ticker: REFI


text: We have established a robust cybersecurity governance framework to manage and mitigate risk. Our approach includes: • Maintaining a comprehensive International Organization for Standardization-based Information Security Policy. The Information Security Policy is reviewed and certified by our Vice President of Information Technology. • Inclusion of Sarbanes-Oxley Information Technology General Controls in our Risk and Control Matrix, which are routinely tested by our Internal Audit team. • Regular risk and vulnerability assessments to identify and address potential weaknesses in our systems. We primarily utilize in-house resources for assessing, identifying and managing cybersecurity threats. • Engaging external cyber security firms, as needed, leveraging their expertise as part of our ongoing effort to evaluate and enhance our cybersecurity program. They help with cybersecurity defense capabilities and recommending steps to mitigate threats, enhance our cybersecurity posture and meet our evolving needs. • Routine screening of potential and existing third-party vendors to assess their cybersecurity posture and the incremental risk that they may pose to us. Third-party vendor access to critical information systems is subject to regular review and assessment by management, and management evaluates the cybersecurity risks and safeguards of potential third-party vendors prior to engaging such vendors. • Mandatory employee cybersecurity training to equip our employees with the tools and knowledge to enhance the cybersecurity posture across the organization. • Continuous monitoring of networks and systems for suspicious activity, leveraging firewalls, intrusion detection and prevention systems, endpoint anti-virus and anti-malware solutions, and a privileged access management system. • A comprehensive incident response plan, which has been developed to enhance the Company's ability to respond to, and recover from, cybersecurity incidents.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: We have developed and implemented robust processes for identifying, assessing and managing risks from cybersecurity threats. Cybersecurity risk is included in AAM's "Top Risks Assessment" under our enterprise risk management program as identified and monitored by our Risk Management Working Group. This group is comprised of leadership from the major functions within AAM and the enterprise risk management program includes the identification and continuous evaluation of the risks associated with the systems and information most critical to AAM and the processes and controls in place to protect the systems and information.

companyName: Dauch Corp

ticker: DCH


text: We have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers. As part of these processes, we conduct cybersecurity due diligence where deemed advisable with respect to third-party service providers that will be accessing our information technology systems, including access to view or store sensitive data, prior to their engagement. Moreover, we have processes designed to oversee and identify material cybersecurity risks associated with the information systems of third-party service providers. In addition, third-party service providers that have access to our information technology systems, including access to view or store sensitive data, are contractually obligated to report cybersecurity incidents to us so that we can assess the impact of any such incident on our business.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility. Our Chief Information Officer ("CIO") spearheads the assessment and management of cybersecurity risks, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape. Supporting this effort, we have a cross-departmental approach to cyber security management. This ensures that our executive leadership team receives comprehensive quarterly updates on cybersecurity from various teams within the organization. Such updates are instrumental in promoting stakeholder engagement across all levels and enhancing management's oversight of cybersecurity. The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards. Our CIO and our Chief Financial Officer report risks to the Audit Committee on a quarterly basis.

companyName: TRANSCAT INC

ticker: TRNS


text: We are committed to maintaining robust governance and oversight of our information technology and security systems to maintain our facilities' physical security and to protect the security of proprietary and confidential information, including that of our customers, suppliers and employees. Information about information technology and security risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "A breach of our information technology and security systems could materially adversely affect our business."

companyName: NLIGHT, INC.

ticker: LASR


text: The Bank maintains documented processes, procedures, and controls for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity threats are identified utilizing risk assessments, detection tools, information gathering and performing internal, external, and third-party contracted security assessments.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer and Chief Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security, integrity and confidentiality of customer records and information, and prohibit unauthorized access to our critical operating systems. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: Primerica has processes in place to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. The Company maintains a policy governing information security, which includes risk assessment policies and procedures relating to third-party vendors, as well as a data loss prevention policy. The Company's policies address technical requirements needed to protect the environments in which data is processed, as well as how it is maintained, governed, and protected. Primerica also imposes mandatory privacy and information security controls and data security protection requirements on the independent contractor sales force. We train all regular employees in information security and privacy-related risks and we perform regular tests to determine whether our employees can recognize phishing emails. Similarly, our annual compliance training for the independent sales representatives includes training on maintaining data security and privacy. e-TeleQuote operates under certain of its own separate policies and procedures related to physical and information security. These policies and procedures are similar in nature to the ones discussed above.

companyName: Primerica, Inc.

ticker: PRI


text: Board Governance The members of the Boards of Directors of the Company and the Bank are identical. The Bank's Board of Directors oversees cybersecurity risk management and strategy for both entities through management updates regarding the policies, practices and security results related to the Gramm-Leach-Bliley Act, IT risk management, IT security metrics, penetration testing, tabletop exercises, IT risk assessments, disaster recovery testing, and security awareness testing and training. Management is responsible for designing and implementing policies, processes and procedures, and deploying physical and virtual technology and safeguards to measure, monitor, and control cybersecurity risk. The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents. The Bank's Chief Technology Officer provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any. Cyber incidents with (i) the potential of materiality; (ii) anticipated publicity; or (iii) anticipated written notices to a significant number of customers; have been promptly reported to the Board with ongoing updates during regular Board meetings. The Bank's Chief Information Officer presents updates on new security measures, programs and services to ITOC. The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal. The Bank's Information Security Officer provides the Board of Directors an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc. This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses. The Board of Directors also participates in an annual evaluation of risk and is presented with management's assessment of the top risks, which generally includes several cybersecurity components.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Our management periodically evaluates information on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we have not had any cybersecurity incidents in 2024, and through the date of filing of this Form 10-K.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Weatherford's cybersecurity program has been developed by the CIO and the information security team with oversight from our Board of Directors and in coordination with key members of our finance, assurance and legal teams. The information security team is comprised of specialists with a mix of government and public-sector cybersecurity experience, combined, they have years of experience selecting, deploying and operating cybersecurity technologies and initiatives globally. Many of our professionals hold university degrees in cybersecurity, information technology, management of information systems and related fields, along with industry-recognized certifications such as CISSP, CASP+, CEH and other related certifications. The team leverages a risk-based approach in an effort to facilitate protection, detection and rapid response to threats. We seek to validate our approach through NIST Cyber Security Risk Assessments conducted by third parties and tested through penetration tests and tabletop exercises, as well as internal and external audits.

companyName: Weatherford International plc

ticker: WFRD


text: We consider cybersecurity and privacy to be important issues affecting the enterprise both in terms of reputational risk and economic risk. To effectively assess, identify, and manage material risks from cybersecurity threats, we maintain a cybersecurity risk management program, which is led by our Chief Technology, Logistics & Stores Officer ("CTO") and our Vice President, Information Security & IT Risk ("VP, IT"), as a part of the Company's overall risk management and compliance programs. To keep pace with ever-evolving threats and industry best practices, we have made, and will continue to make, sizable investments in building and developing cybersecurity talent and expertise and implementing state-of-the-art systems and tools, to detect, identify, classify and mitigate cybersecurity and other data privacy risks within our environment. We employ benchmarking to understand best practices and industry trends. We conduct security and compliance assessments throughout each year to validate the efficacy of our programs and practices. We also engage an independent third party expert to assess our cybersecurity maturity periodically against the retail industry. The results of these assessments inform our cybersecurity development roadmap going forward and are presented to the Audit Committee and the Board of Directors. We also maintain cybersecurity insurance as part of our comprehensive insurance portfolio.

companyName: Childrens Place, Inc.

ticker: PLCE


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has extensive experience in critical infrastructure protection, including multiple years of experience with the Department of Defense. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown cybersecurity threats.

companyName: XCEL ENERGY INC

ticker: XEL


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process to oversee and identify cybersecurity risks for our use of service providers, suppliers, and vendors.

companyName: Arteris, Inc.

ticker: AIP


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and overseen by our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular exercises and tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Generation Bio Co.

ticker: GBIO


text: During the reporting period, we have not had a cybersecurity incident that has materially affected, or was reasonably likely to materially affect, the Company, including our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including as discussed in " Item 1A. Risk factors – A failure in cyber security systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively," although we do not currently believe that such a result is reasonably likely.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: The number and sophistication of attempts to disrupt or penetrate our systems continues to grow, specifically including the rapid increase of attempts against healthcare companies that was observed in early 2022. To combat the ever-increasing sophistication of cyberattacks, we continuously work to improve methods for detecting and preventing attacks. We have implemented policies and procedures and developed specific training for our employees, including regular updates and reminders, to help prevent and mitigate any issues that may be caused by any attacks. Further, we regularly engage independent third-party cyber experts to test for vulnerabilities in our environment. We also conduct our own internal simulations to help assess and strengthen our defenses.

companyName: CHEMED CORP

ticker: CHE


text: The ISGC's responsibilities encompass: • Review and approval of the ISP-related documents, including policies, strategies, plans and risk assessments; • Monitoring of control statuses and program gaps, including findings from audit reports and assessments; • Participation in program assessments, such as risk and business impact assessments; • Providing input on mitigation of current issues and threats; • Reporting, at least quarterly, to the Enterprise Risk Management Committee on ISGC activities and risk impacts on the Risk Appetite Statement. • Reporting, at least annually, to the Board on the status of the ISP, covering compliance, risk management, vendor management, audit and testing results, breaches and incidents, and recommended updates to the ISP.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Cybersecurity Risk, Strategy and Governance The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: The Company has an Information Governance, Privacy & Security Committee responsible for management oversight of cybersecurity risk, which includes the CISO and key members of management and meets quarterly.

companyName: TAPESTRY, INC.

ticker: TPR