text: Main Street and our Adviser maintain, and routinely review and evaluate their and the Company's information technology ("IT") and cybersecurity policies, practices and procedures (the "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of Main Street's Crisis Management Plan. The Cybersecurity Program is administered by Main Street's IT Manager, who is managed on a day to day basis by Main Street's General Counsel and Chief Compliance Officer and overseen by Main Street's IT Steering Committee consisting of Main Street's Chief Executive Officer, Main Street's Chief Financial Officer and Chief Operating Officer and Main Street's General Counsel and Chief Compliance Officer. Main Street's General Counsel and Chief Compliance Officer also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan. Main Street and our Adviser also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of IT and cybersecurity systems, to recommend improvements to the Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in the Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of the external IT and cybersecurity advisers, consultants and experts, are sufficient to manage the Cybersecurity Program.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: Third-party Risk we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: NewHydrogen, Inc.

ticker: NEWH

secItem: Item 1C


text: The internal assessment process and internal tools and SOC related key indicators are reported on a quarterly basis to the Security and Information Security Committee and the Enterprise-wide Risk Management Committee and annually to the Board of Directors.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: We believe cybersecurity is a necessity for operating our business. As a global leader in computational science and artificial intelligence, we face many cybersecurity threats that range from common attack patterns, such as ransomware and denial-of-service, to attacks from sophisticated and persistent adversaries, including nation state actors, that target companies with innovative technology. Our customers, vendors and other third-party partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we carefully execute our cybersecurity operations, strategy and governance.

companyName: Altair Engineering Inc.


text: The responsibility for managing and assessing material risks from cybersecurity threats lies with the Company's IT Steering Committee, which is made up of five members of senior management having legal or corporate finance backgrounds. The committee also includes one lead representative of the third-party IT management and security service providers utilized by the Company to mitigate cybersecurity risks as discussed above. The IT Steering Committee met at least on a quarterly basis during 2023 and intends to meet monthly going forward. Information regarding cybersecurity risks and mitigation efforts is reported periodically by the IT Steering Committee to the Company's chief executive officer, chief financial officer, and Audit Committee. The Audit Committee is primarily responsible for the Board of Directors' oversight of cybersecurity risks.

companyName: Ramaco Resources, Inc.

ticker: METC


text: The Company's senior leadership is responsible for developing appropriate cybersecurity programs, including as may be required by applicable law or regulation. During this process, these individuals may utilize third parties with the appropriate expertise in IT and cybersecurity to develop these programs.

companyName: New ERA Energy & Digital, Inc.

ticker: NUAI


text: Our 'defense in depth' program uses several methods to protect against intrusion by a bad actor, including such techniques as reputational filtering, anti-virus scans, intrusion prevention, multi-factor authentication, and account isolation among others. We also use numerous approaches to detect ransomware and other cyber attacks, including, among others, dark web searches, email sandboxing, endpoint detection, and intrusion detection. The Hartford continues to monitor and enhance its framework to respond to evolving cyber threats and regulations for data privacy, including the European Union General Data Protection Regulation and the California Consumer Privacy Act.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: In an effort to validate the effectiveness of our cybersecurity programs and assess such program's compliance with legal and regulatory requirements, we engage third-party service providers to perform audits, assessments, and penetration tests. These partnerships enable us to access specialized knowledge and insights which we leverage to continuously improve and modernize our cybersecurity programs. We have integrated cybersecurity risk management into our overall risk management system, ensuring that cybersecurity risks are taken into consideration when managing business objectives and operational needs.

companyName: USA Compression Partners, LP

ticker: USAC


text: We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to our Board and Audit Committee by our Chief Information Officer based on materiality. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: We perform various tasks designed to protect the Company from cybersecurity incidents, such as: conducting proactive cybersecurity reviews of systems and applications; performing penetration testing using external third-party tools and techniques; conducting employee training; and monitoring emerging laws and regulations related to data protection and information security. We evaluate risks from cyberattacks and technology threats and check our information systems for possible weaknesses. We use a risk quantification model created by the National Institute of Standards and Technology to find, assess and rank cybersecurity and technology risks and create related security controls and protections. Using third-party organizations and ongoing internal assessments, we regularly review and test our information security program to enhance our security measures and planning. We also engage an external auditor to perform an annual payment card industry data security standard review of our security controls protecting payment information, as well as quarterly third-party penetration testing of our cardholder environment and related systems.

companyName: ARKO Corp.

ticker: ARKO


text: The Company has also implemented technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and vulnerability and patch management.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Our CISO receives reports from our cybersecurity team and monitors the prevention, detection, and mitigation or remediation of cybersecurity risks. Management, including the CISO, regularly updates the Audit Committee and the Board of Directors on the Company's cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies.

companyName: CrowdStrike Holdings, Inc.

ticker: CRWD


text: As of December 31, 2024, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, evolving cybersecurity threats make it increasingly challenging to anticipate, detect, and defend against cybersecurity threats and incidents. For discussion of cybersecurity risks, please see Item 1A, "Risk Factors."

companyName: Invivyd, Inc.

ticker: IVVD


text: The Managing Owner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the Managing Owner, risks are identified and evaluated, with higher risk items receiving priority attention.

companyName: GLOBAL MACRO TRUST


text: At the CISO's direction, the IT Security and Engineering Teams gather intel regarding the incident and take pre-planned steps to mitigate harm, address system weaknesses, and block ongoing threats. For example, our network engineers analyze network traffic for external attacks, search for signs of a firewall breach, and take action to block a suspected intruder's network traffic; our security analysts and engineers look for indications of an attack or suspicious activity by monitoring and reviewing the network activity of our business applications and the audit logs of our mission-critical servers; and our systems administrators examine system logs of our critical systems for any abnormal activity, confirm our mission-critical computers are up to date on all service packs and patches, and ensure backups have been created for our critical systems. The CISO reports the incident to our executive management team, Service Center Board, and ITCC.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: We are a blank check company with no business operations. Since our Initial Public Offering, our sole business activity has been to search for and select a prospective acquisition candidate. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third-party service providers, we parties may be subject to attacks on or security breaches in our or such third parties' systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of such third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident, our management will report to the board of directors and provide updates on its plan for addressing and mitigating any risks associated with such incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have a material adverse effect on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering.

companyName: WinVest Acquisition Corp.

ticker: WINV


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Engineering Officer and acting Chief Information Security Officer, Wade Chambers, reports to our Chief Executive Officer, and is primarily responsible for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Chambers previously served as the Chief Technology Officer and SVP of Engineering at Included Health. He also led engineering at Twitter, TellApart, Proofpoint, Yahoo, Opsware, and Netscape. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Amplitude, Inc.

ticker: AMPL


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third-parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization ("ISO") 27001 and 27002 standards. NIST and ISO standards are internationally accepted and provide best practice recommendations for initiating, implementing, and maintaining information security management systems. Cigna's Information Protection policies and standards are informed by NIST 800-53b, moderate level security control baseline requirements. This includes a myriad of NIST controls/control enhancements which are mapped to Cigna Information Protection policies, standards and control library.

companyName: Cigna Group

ticker: CI


text: Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks, with assistance from third-party service providers. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Dakota Gold Corp.

ticker: DC


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the National Institute of Standards and Technologies cybersecurity framework. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: The Company uses a third-party consultant for monitoring, management and identification of cyber security risks. The Response Team also conducts regular internal testing of the Company's cyber security systems.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: The CIO and CISO, who are well qualified, oversee our information security program and are responsible for assessing and managing our risks from cybersecurity threats. Our CIO has over 25 years of experience serving Fortune 500 companies in the area of information technology, including over 20 years in mortgage and financial services, with roles ranging from overseeing application development and delivery to enhance risk management capability and improve operational efficiency to information technology strategy, architecture, delivery, and management. Similarly, our CISO has over 25 years of experience working for financial services companies in information technology, including roles overseeing e-commerce, technical infrastructure management and architecture, and over 20 years overseeing information security programs.

companyName: Essent Group Ltd.

ticker: ESNT


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect us, including our business strategy, results of operations or financial condition. We and our third-party service providers have frequently been the target of cybersecurity threats and expect them to continue, and for an additional description of these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: EXELIXIS, INC.

ticker: EXEL


text: Related to Cybersecurity Risks Our board of directors is involved in risk oversight as part of our overall business strategy and has delegated oversight of risk assessment and management to the audit committee. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management. Our audit committee discusses cybersecurity threats and our risk management processes at least annually, receives updates on relevant cybersecurity developments, and considers steps that our management has taken to monitor and manage cybersecurity risk. The full board of directors also discusses with management, identified material cybersecurity risks, their potential impact on us, and the steps we take to manage them. Our audit committee and board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: We regularly remind employees of the importance of handling and protecting customer and employee data, including through periodic security training to enhance employee awareness of how to detect and respond to cybersecurity incidents. We also conduct tabletop exercises to simulate response plans to various cybersecurity incidents. Our team of cybersecurity professionals then collaborate with relevant stakeholders within our Company to evaluate and adjust our detection and mitigation strategies.

companyName: ROGERS CORP

ticker: ROG


text: The KKR CISO is a member of KKR's Operational Risk Committee. The Operational Risk Committee is comprised of senior employees from across KKR's asset management business and operating functions. The committee focuses on significant operating and business risks, which includes among others, regulatory, cybersecurity, operational, geopolitical, and reputational risks, and is responsible for ensuring risks are identified, assessed, managed and mitigated effectively. The cybersecurity risk environment for KKR's asset management business, which includes identifying and monitoring KKR's technology risks, including those related to information security, business disruption, fraud and privacy related risks, and also promoting cybersecurity awareness at KKR. The Operational Risk Committee reports to KKR's Risk and Operations Committee, which is comprised of senior employees from across KKR's asset management and insurance businesses and operating functions. KKR's Risk and Operations Committee includes KKR's Chief Financial Officer, Chief Operating Officer, Chief Legal Officer, General Counsel, and Chief Compliance Officer. At least annually, management will present to the Audit Committee and the Risk Committee of KKR's Board of Directors on various topics relating to KKR's technology risks, including KKR's cybersecurity program, the current cybersecurity threat landscape, and risk management.

companyName: KKR Enhanced US Direct Lending Fund-L Inc.


text: To maintain and enhance the strength of our cybersecurity controls while reducing risk exposure, Seadrill conducts vulnerability assessments and penetration testing. As a principal risk, cybersecurity is also included in our rolling Internal Audit & Assurance program and is subject to external ISO 9001 quality management certification, certified by DNV. Oversight of these efforts is provided by the Assurance, Quality & Enterprise Risk Function, which ensures the robustness of key mitigations and controls.

companyName: Seadrill Ltd

ticker: SDRL


text: above. Our cybersecurity risk management program includes tools and activities to prevent, detect and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: CalEthos, Inc.

ticker: GEDC


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Lending Partners


text: Perficient's senior management are members of the Security and Compliance Executive Committee ("SCEC") which meets at least semi-annually to review Perficient's current cybersecurity risks, the effectiveness of current controls, policies and training. Any security-related policy violations or incidents involving Perficient or client data would be included in the SCEC briefing. Perficient senior management also regularly considers the impact of cybersecurity risks when developing its business strategy, financial planning, and capital allocation. Perficient is not aware of any current or past cyber related risks which have or are reasonably likely to materially affect its strategy, operations, or financial condition.

companyName: PERFICIENT INC


text: Board Oversight of Cybersecurity Risks The Board of Directors of the Company provides oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Company's Chief Compliance Officer (" CCO ") regarding the overall state of the Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Audax Credit BDC Inc.


text: As part of our overall risk management system, we regularly monitor and test our safeguards and train our personnel on these and other safeguards, in collaboration with our human resources, business technology, and management teams. Personnel across the company are made aware of our cybersecurity policies and procedures through training.

companyName: Samsara Inc.

ticker: IOT


text: In addition, plans have been authored to assist our security, legal, and finance functions in assessing and managing Argo's material risks from cybersecurity threats, and we conduct tabletop exercises and training sessions at least annually to help ensure effectiveness of said plans. Additionally, we also utilize outside resources to assist and participate in the determination of materiality of incidents stemming from cybersecurity threats.

companyName: Argo Group International Holdings, Inc.


text: Reviewing the IRP at least annually, or whenever there is a material change in the Company's business practices that may reasonably affect its cyber incident response procedures. Report up to the Executive Incident Response Committee, as needed.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Our VP of Engineering, who reports to the CEO, leads our cybersecurity function and is responsible for managing our cybersecurity risk and the protection of our networks, systems, and data. The VP of Engineering uses both internal and external resources to execute this process including our own INTRUSION Shield technology, to help prevent, identify, escalate, investigate, and resolve security incidents in a timely manner. The Company, with the oversight of the CTO, also requires all employees to complete an annual cybersecurity training course.

companyName: INTRUSION INC

ticker: INTZ


text: We have processes to oversee and identify cybersecurity risks associated with the use of third party service providers in our organization's operations. Third party cybersecurity risk management engagement also includes activities such as penetration testing, independent audits or consulting on best practices to address new challenges. We include security and privacy addendums to our contracts where applicable.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President, Information Technology, who has over 20 years of technology experience which includes extensive cybersecurity implementation and oversight.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Trustees' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Trustees (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.

companyName: Ellington Credit Co

ticker: EARN


text: Our CISO meets quarterly with the Enterprise Risk Management Committee of the Board of Directors to discuss management's ongoing cybersecurity risk management programs. He provides information about the sources and nature of risks the Company faces, how management assesses such risks – including in terms of likelihood and severity of impact, progress on vulnerability remediation and current developments in the cybersecurity landscape. This presentation is shared with the full Board of Directors to enable discussion of cybersecurity risk management at the full board level.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and monitor the effectiveness of our safeguards. We devote resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Risk Officer, to manage the risk assessment and mitigation process. Our Chief Information Security Officer works closely with a team of cybersecurity professionals with extensive experience and expertise in cybersecurity control development, threat assessments, detection & incident response and mitigation.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Our cybersecurity team implements measures designed to ensure that Atkore can quickly identify and mitigate cybersecurity risks. Our controls are designed to restrict access to locations that house significant physical information technology assets. Other controls include the use of multifactor authentication, various third-party tools, network security technologies, and a crisis playbook. Our notification policies and processes are escalated to the appropriate personnel on a timely basis to support effective review, response, and compliance with legal requirements. Data is also aggregated to support the identification of trends for forward looking oversight.

companyName: Atkore Inc.

ticker: ATKR


text: Our Vice President of Finance and/or representatives from our management committee on cybersecurity provide periodic briefings to our Board of Directors regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Cyclo Therapeutics, Inc.


text: Other processes in place to further manage any additional security risk to the organization include: • identifying, reporting and correcting information system flaws, security alerts and advisories; • monitoring inbound and outbound communications for unusual or unauthorized activity; • designing and implementing application systems to include sound backup and recoverability principles, such as periodic data backups in the case of a disaster; • mechanisms designed for the physical protection of IT resources; and • use of all third party and cloud computing services are reviewed and evaluated for material risks of cybersecurity threats by the IT security department before being formally authorized for use. Use of services must comply with all laws and regulations governing the handling of personally identifiable information, corporate financial data, controlled unclassified information, or any other data owned or collected by the company.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Data integrity, privacy, availability, and security are critical to the corporate information technology, communication networks, accounting and financial reporting platforms, and related systems which are necessary for the operation of our business. These systems are used to manage our vendor relationships, for internal communications, for accounting and record-keeping functions, and for many other key aspects of our business including site security. Our business operations rely on the data privacy and security necessary to safeguard and protect secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: CANNAPHARMARX, INC.

ticker: CPMD


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with legal obligations and attempt to mitigate brand and reputational damage. We have business continuity plans that we periodically review and update in line with our evolving applications architecture.

companyName: Summit Therapeutics Inc.

ticker: SMMT


text: Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impacted our strategic plan, operations, or financial standing. For additional information, see " Risk Factors. "

companyName: Planet 13 Holdings Inc.

ticker: PLNH


text: We recognize the critical importance of developing, implementing, assessing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Senior Management, in collaboration with the Information Technology and Risk Departments, is responsible for the implementation and oversight of the Bank's Cybersecurity Risk Management Program.

companyName: BCB BANCORP INC

ticker: BCBP


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated Grid University training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Vice President of Information Technology has over 10 years of experience managing information technology and cybersecurity matters. The Vice President of Information Technology, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.

companyName: INTERPACE BIOSCIENCES, INC.

ticker: IDXG


text: Our Head of IT, who leads our cybersecurity risk management and strategy processes, has over ten years of information technology and cybersecurity work experience. This risk management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: g. Third-party risk assessment and management for vendors and third-party service providers; and h. Cyber incident tabletop exercises for our Board of Directors and management.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing or processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: We employ a risk management framework aligned with relevant laws, regulations, and industry standards to manage cybersecurity risks across our products and services, infrastructure, and organization. Our internal risk assessment processes incorporate various factors, including tracking threat intelligence and identified first- and third-party vulnerabilities, evaluating evolving regulatory requirements, and analyzing internally observed cybersecurity threats and incidents. We regularly conduct an internal risk assessment to evaluate the effectiveness of the security of our systems and of our processes, identify areas for remediation, and explore opportunities for enhancement, such as cloud and endpoint security enhancements, application programming interface (API) security, and contractor access management. We utilize third-party security experts and consultants on an annual basis to assess and improve our cybersecurity risk management tools and processes and to benchmark against industry standards.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Company's IT department is directly responsible for cybersecurity matters and routinely reports to the senior management. In the event of a cybersecurity incident, the IT department will initially report to the Company's senior management, including our Chief Executive Officer. If the incident is assessed as a material threat or incident to our information systems, our senior management will escalate the issue to the Board of Directors. Given that our core operations are in manufacturing and involve limited network-related activities, we believe that our existing cybersecurity measures are adequate. The Company's Board of Directors and senior management are committed to continuously evaluating and upgrading our cybersecurity prevention, detection, and mitigation strategies in line with the evolution of our business needs and cybersecurity risks.

companyName: CBAK Energy Technology, Inc.

ticker: CBAT


text: Our management team, including our Chief Information Security Officer and Chief Compliance and Data Privacy Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II. The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. We engage external experts, including cybersecurity assessors and consultants, to evaluate cybersecurity measures and risk management processes. We engage and depend on service providers to actively monitor the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. Our finance and compliance personnel identify and oversee risks from cybersecurity threats associated with our use of such service providers.

companyName: PhenixFIN Corp

ticker: PFX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and approved medications ("Information Systems and Data").

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Processes to oversee and identify such cybersecurity threat risks associated with third party service providers The Company performs risk assessments on critical third party service providers, software and other tools used in the Company's operations that may have the potential to create material cybersecurity threats to our business.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: In the last two fiscal years, the Company has not experienced any material cybersecurity incidents, and expenses incurred from cybersecurity incidents were immaterial. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business, results of operations or financial condition, refer to Item 1A. Risk Factors - "Our business and operations would suffer in the event of system failures or, cyber-attacks or a deficiency in our cyber-security," which is incorporated by reference into this Item 1C. (Role of Management/Role of the Board)

companyName: Biofrontera Inc.

ticker: BFRI


text: We have established a robust framework for the assessment, identification, and management of material risks arising from cybersecurity threats. Our approach to cybersecurity risk management includes ongoing assessments of potential threats and vulnerabilities, coupled with the implementation of safeguards and controls to mitigate these risks. We maintain vigilance over the cybersecurity landscape to identify emerging threats, adapting our strategies accordingly. Our cybersecurity risk management process includes: Regular risk assessments to systematically identify and prioritize cybersecurity risks; Implementation of advanced technical controls, encryption, and intrusion detection systems to safeguard sensitive data; Employee training and testing programs designed to enhance awareness about cybersecurity best practices;

companyName: URBAN ONE, INC.

ticker: UONE


text: Our security team, managed by our Chief Technology Officer ("CTO") who works with a team of security professionals to help identify, assess and manage our cybersecurity threats and risks. Our security team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools; conducting vulnerability scans; penetration tests conducted internally and by third parties; leveraging threat intelligence feeds; reports and services that identify cybersecurity threats; and working with third parties who conduct threat assessments of our platform and APIs.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: Third-Party Engagement The Company engages a range of third-party advisory service providers, including cybersecurity assessors, and consultants to conduct recurrent evaluations of its cybersecurity controls. These reviews are a critical component of the ongoing risk assessment process within the cybersecurity function and include periodic evaluations of internal controls aimed at mitigating cybersecurity threats. These assessments often include penetration tests, evaluations of the Company's cyber program maturity, and assessments of progress toward future-state cyber initiatives, among other considerations. The results of these assessments are reviewed with management and the Board.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: In our business, we recognize the risk that cybersecurity threats pose to our operations, and as such, cybersecurity is an important component of our overall risk management strategy. We have adopted and implemented an approach to identify and mitigate cybersecurity risks utilizing the National Institute of Standards and Technology's Cybersecurity Framework ("NIST CSF") as a guideline to help management identify, assess, reassess, and manage cybersecurity risks. We have developed and implemented cybersecurity programs and processes, including risk management and assessment programs, network segmentation, deployment of detection tools across our network, systems and databases, security and event monitoring capabilities, a detailed incident response plan and an incident response team. Our incident response team is led by our Chief Information Officer, who has over 22 years of experience in information technology leadership and information security, serving in roles of increasing responsibility within private and public companies, and also includes our General Counsel and our Chief Financial Officer.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: As part of our cybersecurity risk management program, we also conduct cybersecurity and privacy assessments on all third parties who integrate with Stryker's data, network, systems and products. We use a combination of internal and external tools to confirm that these third parties meet our security requirements. We leverage standard industry threat model and privacy impact assessment concepts to confirm that data minimization and adequate data protections are in place. We perform supplemental reviews as necessary, commensurate with the risk associated with each vendor. Dollar amounts in millions except per share amounts or as otherwise specified.

companyName: STRYKER CORP

ticker: SYK


text: Management's Assessment and Management of Cybersecurity Threats. Members of Manhattan's executive management team, along with others from Company senior management, and others with varying areas of expertise, are engaged as part of our Cyber Program: • Chief Financial Officer and Chief Information Officer – Direct management of our Cyber Program falls within our Information Technology department, which reports up through our CIO, who reports to our CFO. Both our CIO and CFO have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors such as Manhattan. The CFO is a member of our Disclosure Committee, which is responsible for determining whether a cybersecurity incident is "material" for purposes of publicly reporting cybersecurity incidents, and is a member of our "Core Response Team" under the Company's Crisis Response Program. Our CFO also chairs our management Cybersecurity Committee. • Chief Legal Officer – Our CLO has experience providing legal advice regarding cybersecurity-related programs as well as engaging with outside advisors and insurance brokers and underwriters on cybersecurity coverage, claims, and loss mitigation. Our CLO also is member of the Disclosure Committee and the Core Response Team. • Senior Director, Global Security – Our Senior Director, Global Security, has managed our Cyber Program for eight years. He manages its day-to-day operations, oversees our security analysts and engineers, and leads our Cybersecurity Committee meetings. He is trained in cybersecurity strategy, planning, and execution and holds industry recognized security certifications, including Certified Information Systems Security Professional (CISSP) from the International Information System Security Certification Consortium (ISC2) and Certified Information Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA). • Cybersecurity Committee – Members include, in addition to the CFO and SD, Global Security, business representatives of Manhattan's material business lines and administrative departments, cyber-risk operational heads from our material business lines, and our VP, Contracts and Administration (or their designee). The Cybersecurity Committee's purpose is to review cybersecurity risks, discuss emerging threats, prioritize cybersecurity efforts, and make recommendations to leadership. • Crisis Response Team – Pursuant to our Crisis Response Program, our Crisis Response Team, which comprises the CLO, CFO, Chief People Officer and Chief Marketing Officer, and an expanded team from our material business lines and administrative departments, as well as outside advisors/experts (cyber forensics, external legal counsel, law enforcement, public relations), is charged with managing the Company through a cybersecurity incident (or other event or series of events) that rise to the level of a Company "crisis." The Program includes protocols by which the CLO, on behalf of the Team, will report to or engage the CEO and the Chairman of the Board if and when an incident becomes a crisis or potential crisis.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: At the employee level, the New Manager maintains an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. The New Manager also holds employee trainings on privacy and cybersecurity, as well as records and information management, and it conduct phishing tests. We generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: We rely on third parties for a significant portion of our information technology functions and conduct periodic risk assessments with assistance from a third-party consultant. We also rely on third-party hardware, software, network infrastructure, storage systems and vendors to maintain and upgrade our technology systems in order to support our business operations. Computer viruses, hackers, employee misconduct and other external hazards can expose our information systems to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our business. As previously disclosed, in May 2023, we experienced a network intrusion in which an unauthorized third party accessed and exfiltrated certain information from specific systems. In response to this incident, we secured our digital assets within our computer systems, promptly shut down our financial reporting systems on a temporary basis and commenced an investigation with assistance from an outside cybersecurity firm. In connection with this incident, we have incurred certain incremental one-time costs of $ 0.3 million during the 2023 fiscal year related to consultants, experts and data recovery efforts, and expect to incur additional costs related to cybersecurity protections in the future. Although we have not been the subject of any legal proceedings involving cybersecurity incidents, it is possible that we could be the subject of claims from persons alleging that they suffered damages from such incidents.

companyName: Falcon's Beyond Global, Inc.

ticker: FBYD


text: As of the date of this Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Processes designed to monitor for cybersecurity incidents are also intended to protect our data. Our cybersecurity safeguards, including those provided by third parties, are designed to monitor for unauthorized access, extraction, and deletion of certain sensitive data, large quantities of data, and other anomalous network traffic. These services are designed to monitor for both internal and external threats. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences to our business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: Our Board of Trustees is responsible for understanding the primary risks to our business. The Board of Trustees is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board of Trustees, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board of Trustees or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: Our cybersecurity program is designed to protect our information assets and operations from both internal and external cyber threats, while simultaneously ensuring business resilience. We rely on information systems and related technologies for critical internal functions, including secure data storage, processing, and transmission, as well as for interactions with key business partners such as customers and vendors.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: On at least a quarterly basis, the IS Director and other members of management inform Seaboard's full Board of new risks or changes to risks, the status of projects to strengthen Seaboard's information security systems, assessments of Seaboard's security program and the emerging threat landscape. The Board provides feedback on management's plans and allocates resources for plan expenditures. Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receives prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: monitoring and mitigating cybersecurity threats and risks with a defense structure to provide a third-party cybersecurity oversight program to effectively discover, analyze and understand oversight of our information security program by senior management, our board-level Information Security Committee, and our Board of Directors;

companyName: Bancorp 34, Inc.

ticker: BCTF


text: OneMedNet manages cybersecurity and data protection through a continuously evolving framework. The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve. Our cybersecurity program is managed by our Director Product Management, Head of Data. The Audit Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit receives regular updates from the Director Product Management, Head of Data on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Company's framework includes an incident management and response program that continuously monitors the Company's information systems for vulnerabilities, threats and incidents; manages and takes action to contain incidents that occur; remediates vulnerabilities; and communicates the details of threats and incidents to management, including the Director Product Management, Head of Data, as deemed necessary or appropriate. Pursuant to the Company's incident response plan, any incidents are to be reported to the Audit Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.

companyName: OneMedNet Corp

ticker: ONMD


text: Our SDIS, who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is the management position responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.

companyName: Regional Management Corp.

ticker: RM


text: As part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to the Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including our Adviser and Main Street, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See Item 1A. Risk Factors — General Risk Factors — The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our and our Adviser's disaster recovery systems and management continuity planning could impair our ability to conduct business effectively.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: Our cybersecurity risk assessment and management processes are maintained by certain Company management, including the members of our Information Security Steering Committee, which meets quarterly to review cybersecurity matters. Our Information Security Steering Committee is comprised of our Chief Information Security Officer ("CISO"), CEO, Chief Financial Officer, Chief Accounting Officer, COO, Chief Legal Officer, Vice President of Human Resources and Vice President of Global Information Technology. At the management level, our CISO, who reports to our Chief Information Officer ("CIO"), is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cybersecurity with years of experience in leading security teams, developing security strategies, and managing risk across various industries. Our Vice President, Global Information Technology serves as our CIO, and has over 25 years of information technology and cybersecurity risk management experience, including at other public companies.

companyName: Enovix Corp

ticker: ENVX


text: Our IRP contains tools and guidance related to cybersecurity events and is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents as well as comply with applicable legal obligations. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber-attacks and other related breaches.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: SKINVISIBLE, INC.

ticker: SKVI


text: Our Chief Information Security Officer (CISO) is primarily responsible for assessing, monitoring and managing our cybersecurity risks. With over 23 years of experience in the field of information technology and cybersecurity, the CISO brings a wealth of expertise to his role. His background includes experience as a military cybersecurity officer and system security engineer, resulting in extensive knowledge and experience in developing and executing cybersecurity strategies. The CISO holds a graduate degree in Information Resource Management from the Air Force Institute of Technology, Wright-Patterson, Air Force Base, Ohio and holds a Certified Information Systems Security Professional certification, awarded and maintained since 2010.

companyName: V2X, Inc.

ticker: VVX


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises, including an expansive cybersecurity exercise in 2023, to test and improve response plans.

companyName: CHEVRON CORP

ticker: CVX


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Cyngn Inc.

ticker: CYN


text: We have relationships with or access to a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including a security operations center (SOC) provider, specialists in backup and recovery, a forensic investigation firm, a ransomware recovery vendor, insurance providers, communications and public relations firms, and various law firms.

companyName: Playa Hotels & Resorts N.V.


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity risk management program ("Cybersecurity Program").

companyName: Uber Technologies, Inc

ticker: UBER


text: Following the 2025 Cybersecurity Incident, management provided briefings to the Audit Committee and the full Board of Directors regarding incident status, operational impacts, response and recovery efforts and enhancements to our security program and business continuity plans.

companyName: Inotiv, Inc.

ticker: NOTV


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to monitor such potential cybersecurity risk exposures, putting in place appropriate mitigation measures and maintaining the cybersecurity program. Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others. Management, including the CIO and CISO, update the Audit Committee on a regular basis on our cybersecurity program, material cybersecurity risks, mitigation strategies, cybersecurity metrics, developments in cybersecurity and proposed updates to our cybersecurity program.

companyName: STERIS plc

ticker: STE


text: Our Chief Financial Officer and Head of IT and Cybersecurity, a consultant, are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our Chief Executive Officer and Head of IT and Cybersecurity have assistance from service providers, other consultants and third parties. Our Chief Financial Officer has served as an executive officer for over twenty-five years, including over fifteen years as an executive officer of public companies. Our Head of IT and Cybersecurity has served as an information technology professional for over nine years and has held senior IT positions at multiple companies, where his primary responsibilities included maintaining direct oversight over his companies' cybersecurity risks.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Management's Role in Cybersecurity Risk Oversight The Adviser's CISO and dedicated internal cybersecurity team are responsible for the cybersecurity program applicable to us (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes). Our Chief Compliance Officer ("CCO") is responsible for monitoring and reporting to the board about the Adviser's compliance with its responsibilities for the Adviser's and our cybersecurity program. The Adviser's CISO has over 15 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures in both US Government Intelligence agencies and Financial Services firms. The Adviser's CISO reports to the Chief Financial Officer of the Adviser and works closely with our management to administer, assess, discuss, and prioritize our cybersecurity efforts. Our CCO has been responsible for this monitoring and reporting as CCO to us for 3 years and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risks applicable to us.

companyName: HPS Corporate Lending Fund


text: Over the past several years we have invested significantly to enhance our cybersecurity governance. We have expanded our control access to data and systems, invested in firewalls and security systems, elevated internal awareness through trainings and exercises, and upgraded our systems, programs and intrusion monitoring.

companyName: WESTWOOD HOLDINGS GROUP INC

ticker: WHG


text: Management's Risk Management Role Our VP of Technology plays a pivotal role in informing the Board on cybersecurity risks. As necessary, he provides briefings to the Board encompassing a broad range of topics, including: • the current cybersecurity landscape and emerging threats; • the status of ongoing cybersecurity initiatives and progress on remediation efforts; and • compliance with regulatory requirements and industry standards.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. Our Board of Directors has delegated to the AFC oversight responsibility for cybersecurity and data privacy, including periodically evaluating the Company's cybersecurity and privacy programs and receiving information on cybersecurity and privacy compliance. The chair of the AFC reports to the full Board of Directors following its regularly scheduled meetings.

companyName: COTY INC.

ticker: COTY


text: We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and ongoing testing by our red team. We employ external services to conduct tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning across Match Group's businesses. The results of these assessments are reported to the Audit Committee of our Board of Directors.

companyName: Match Group, Inc.

ticker: MTCH


text: Overall Risk Approach The Board is responsible for oversight of our risks, including establishing our risk appetite and overseeing our risk management framework. The Board recognizes that effective risk oversight is important to the success of our strategy and is an integral part of exercising its fiduciary duties with respect to the Company and our stockholders. The Board believes our current leadership structure facilitates its oversight of risk by combining independent leadership through the Board with executive management members who have an intimate knowledge of our business, industry, and challenges.

companyName: CSG SYSTEMS INTERNATIONAL INC

ticker: CSGS


text: Our cybersecurity governance committee led by our management team and our CIO with 16 years of experience in cybersecurity and a CISSP certification, bears the primary responsibility for assessing and managing material cybersecurity risks. Regular meetings are held to review security performance metrics, identify security risks, assess the status of security enhancements, and make recommendations on security policies, procedures, service requirements, and risk mitigation strategies.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: We consult with our outside legal counsel as appropriate, including on materiality analysis and disclosure matters. Senior management makes the final materiality determination and disclosure decisions. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.

companyName: Karat Packaging Inc.

ticker: KRT


text: We work to continually evolve our systems to meet the constantly changing digital environment and continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. There have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. The nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business, financial conditions or results of operations. For more information about the cybersecurity risks we face, refer to the Risk Factors in section "Information Technology and Cybersecurity Risks" in Part I, Item 1A, "Risk Factors".

companyName: STONERIDGE INC

ticker: SRI


text: Cyber partners are a key part of CBIZ's cybersecurity infrastructure. CBIZ partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. CBIZ engages with these partners to monitor and maintain the performance and effectiveness of third-party products and services that are deployed in CBIZ's environment, to scan for potential vulnerabilities and to conduct penetration testing.

companyName: CBIZ, Inc.

ticker: CBZ


text: GECM has implemented an information security policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and employee information that it stores or processes and the maintenance of critical services and systems. This program is based on recognized industry standards that we use to help us identify, assess and manage cybersecurity risks and is supported by both management and our Board. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks. GECM's policies and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, spam and phishing email filtering, and transmission of data over private networks. GECM's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: (1) cybersecurity risks associated with its physical and digital devices and infrastructure, and (2) cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information.

companyName: Great Elm Group, Inc.

ticker: GEG


text: Our cybersecurity program is overseen by our CIO, who has been a Caterpillar employee for nearly twenty-five years. Prior to her current appointment as our CIO in September 2020, she was the Chief Information Officer for the Company's Financial Products Division. Her extensive background in IT includes global leadership for large-scale systems transformations, cybersecurity, cloud and application management, global data center management, worldwide network, servers and storage, database management and end-user services. Our CIO leads a cross-functional cybersecurity team comprised of professionals from our product, cybersecurity, legal and compliance organizations who focus on managing the security of our connected solutions. This team manages the Company's global IT systems, IT risk management, cybersecurity, global infrastructure and IT transformations.

companyName: CATERPILLAR INC

ticker: CAT


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. The Audit Committee of our Board is responsible for the oversight of cybersecurity-related risks. The Audit Committee regularly receives reports from management on our cybersecurity threat risk management and strategy processes, including on topics such as our data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, incident response plans, and cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks. The Audit Committee received reports from our Chief Information Officer ("CIO") and/or CISO five times in 2024.

companyName: GE HealthCare Technologies Inc.

ticker: GEHC


text: We have not experienced any cybersecurity incidents that have been determined to be material in the past, however, like other life sciences technology companies, we have experienced cybersecurity incidents and may continue to experience them in the future. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including, for example, the risk factor entitled " Our business and operations would suffer in the event of computer system failures or security breaches.."

companyName: Cyclo Therapeutics, Inc.


text: Our executive management has overall responsibility for risk oversight in performing this function. Our executive management assesses cybersecurity and information technology risks and the controls implemented to monitor and mitigate these risks. Our cybersecurity program is overseen by our Global Information Technology Manager, who meets regularly with executive management to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents. Executive management is charged with reviewing our cybersecurity processes for assessing key strategic, operational, and compliance risks.

companyName: MIND TECHNOLOGY, INC

ticker: MIND


text: Our board of directors and management exercise oversight over our cybersecurity program, which represents an important component of our overall approach to enterprise risk management.

companyName: Alpha Teknova, Inc.

ticker: TKNO


text: We also implemented a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security and mobile device usage. We communicate these and other pertinent security issues or compliance changes through our regular internal communications cadence. Additionally, the Company has mandatory security awareness training addressing cybersecurity, privacy and confidential information.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Material Effects of Cybersecurity Incidents Except as disclosed in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K, including, without limitation, the risk factor under the heading "If our internal information technology systems, or those used by our CROs, CMOs, clinical sites or other contractors or consultants upon which we rely, are or were compromised, become unavailable or suffer security breaches, loss or leakage of data or other disruptions, we could suffer material adverse consequences resulting from such compromise, including, but not limited to, operational or service interruption, harm to our reputation, litigation, fines, penalties and liability, compromise of sensitive information related to our business, and other adverse consequences", risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: Our CISO has over 25 years of experience working in security and infrastructure for SaaS and hosted services. She has a master's degree in cybersecurity and has maintained an active CISSP certification since 2012.The CISO reports to the Chief Technology Officer, who has overseen the cybersecurity team since 2020 and has led infrastructure teams at the Company for over 12 years.

companyName: HUBSPOT INC

ticker: HUBS


text: Management of Cybersecurity Risks and Cybersecurity Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: We have established a process to review and assess major software vendors' security practices prior to onboarding, which includes review of the vendors' responses to cybersecurity questionnaires and security audit reports and certifications, as applicable. Our process also includes contractual requirements for major vendors that process data on our behalf to maintain data protection safeguards.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: T he Director of Information Security, along with management, including the CIO and CCO, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition. We will continue to monitor and assess our cybersecurity risk management program as well as invest in and seek to improve such systems and processes as appropriate. If we were to experience a material cybersecurity incident in the future, such incident may have a material adverse effect on our reputation, as well as our operations, business strategy, operating results, and financial condition.

companyName: Jet.AI Inc.

ticker: JTAI


text: Primarily responsible for overseeing the Company's risk management program related to cybersecurity. The Audit Committee provides feedback on the Company's framework for assessing, prioritizing and mitigating cybersecurity risk and receives periodic updates based on this framework, including from third-party and internal audit assessments. Receives periodic updates from external advisors regarding cybersecurity risk management and reporting.

companyName: US Foods Holding Corp.

ticker: USFD


text: An educated workforce needs a governance framework to guide and monitor its activities. PTC has processes and policies in place to try to anticipate security risks and facilitate compliance with applicable contractual obligations, regulations and standards, as well as address any incidents or violations. PTC focuses on continuous improvement and is constantly maturing its processes to keep pace with the rapidly evolving cybersecurity threat landscape.

companyName: PTC INC.

ticker: PTC


text: oversight for information security and cyber security risk management activities and approval of the overall cybersecurity risk management program, and the Bank's overall risk management program at large. In addition to full Board oversight, the Risk Management Committee oversees the Bank's cybersecurity risks in accordance with the Bank's risks tolerance. Additionally, the Operations and Technology Committee oversees the Bank's cybersecurity risk management program, and reviews and validates that the direction of the program is in support the Bank's objectives. The Audit Committee of the Board is also involved with ensuring that the internal audit team has an audit plan and resources adequate to evaluate the Bank's cybersecurity risks and controls.

companyName: Federal Home Loan Bank of Chicago


text: In assessing cybersecurity risks, we adopt a risk-based approach, particularly concerning third-party vendors integral to our operations. Vendors meeting specific criteria, including ownership and operation of information technology networks critical to our operations, undergo evaluation across various domains such as data security and operations management. Effective communication channels with these vendors are maintained to enable timely notification of any cybersecurity incidents that could impact our company.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: We maintain a comprehensive Incident Response and Recovery Plan (IRR Plan) designed to guide our preparation for, detection, response to, and recovery efforts in the event of cybersecurity incidents. The IRR Plan establishes clear roles and responsibilities for a cross-functional team (IR Team) tasked with handling cybersecurity incidents. The plan outlines a structured approach to managing incidents from the technical perspective, including monitoring, identification, investigation, assessment, containment, remediation, and mitigation. Additionally, the IRR Plan also addresses compliance with legal and reporting obligations, including any required notifications to affected parties, regulatory agencies, or the public, and reporting requirements with the SEC. Cybersecurity incidents are evaluated based on their severity, potential impact, and likelihood of escalation, and are prioritized for response, remediation, and disclosure as necessary. The IRR Plan is regularly reviewed and updated as necessary to incorporate improvements and enhance the organization's overall incident response capabilities.

companyName: Karat Packaging Inc.

ticker: KRT


text: The Company relies on its Executive management and internal technical experts to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, dedicated personnel are deployed with the expertise to address cybersecurity threats and to respond to cybersecurity incidents if and as they occur. The expertise of such dedicated personnel is primarily derived from prior employment and training in the information technology and/or cybersecurity space. Members of the Security leadership team have served in various leadership roles across the security, intelligence, and cybersecurity domains for over 20 years. Their previous experience spans across the military and private sector, previously leading global cybersecurity intelligence & defensive operations at a fortune 500 enterprise. They hold various security credentials, certifications, and memberships in cybersecurity leadership organizations. Their professional education includes business management, computer science, and computer applications expertise. Through ongoing communications with these teams, members of management monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time, and report such threats and incidents to the Audit Committee when appropriate.

companyName: BRC Inc.

ticker: BRCC


text: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and manage risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity. Our information security program is overseen by our Chief Information Officer ("CIO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat prevention, threat detection, and incident response processes. Our CIO has over 15 years of information technology and information security experience and he and his team have experience in cybersecurity and risk management, including assessing, designing, building and operating security platforms, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation and compliance initiatives. The information security team provides periodic reports to our CIO, Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate. Our CIO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, including the results of security breach simulations, and the emerging threat landscape. Our Board of Directors will be informed of all material cybersecurity incidents and our information security program includes procedures for calling a special session of the Board of Directors in the event of a high or critical-risk cybersecurity incident. The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.

companyName: XPO, Inc.

ticker: XPO


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."

companyName: Arteris, Inc.

ticker: AIP


text: Education and Awareness. Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley's evolving information security policies, standards, processes and practices. We also require employees in certain roles to complete additional role-based, specialized cyber and information security training.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

companyName: Q32 Bio Inc.

ticker: QTTB


text: We aim to incorporate industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. Our cybersecurity program is designed to be aligned with applicable industry standards. We work with a third-party provider to monitor threats and potential cybersecurity breaches.

companyName: MetaVia Inc.

ticker: MTVA


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board (the "Audit Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives reports at least annually from management on our cybersecurity risks and would be informed of any cybersecurity incidents that management considers to be significant or potentially significant.

companyName: AN2 Therapeutics, Inc.

ticker: ANTX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, in areas such as legal, compliance, strategic, operational, and financial risk.

companyName: ARDELYX, INC.

ticker: ARDX


text: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. We understand the importance of securing our data and information technology systems and networks, as well as the data customers and other stakeholders entrust to us. We have established policies, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats which are integrated into our overall risk management program and based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization ("ISO") and other applicable industry standards. Despite this, there can be no guarantee that our policies and procedures will be effective. Refer to " Risk Factors " for additional detail about the material cybersecurity risks we face. Our cybersecurity program includes the following:

companyName: SPX Technologies, Inc.

ticker: SPXC


text: While our Information Security team uses some third-party resources as part of its efforts to assess, identify and manage material risks from cybersecurity threats (e.g., certain third-party software tools, threat intelligence and periodic penetration testing), our cybersecurity efforts are predominantly conducted through our internal resources.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: We engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes. Where we engage or rely on third parties, including suppliers, vendors, and service providers, our information security personnel have processes in place to identify and manage risks from cybersecurity threats associated with our use of such third parties.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: The Company recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB