text: The Company relies on the Investment Adviser to engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on the Investment Adviser's risk management program and processes, which include cyber risk assessments.

companyName: Steele Creek Capital Corp


text: The Manager has developed and implemented additional programs that assist in reducing risk and providing additional protection of confidential information including:

companyName: RIDGEWOOD ENERGY A-1 FUND LLC

secItem: Item 1C


text: Zebra takes a comprehensive approach to managing cybersecurity risk, starting with the integration of cybersecurity risk into our overall enterprise risk management framework, among other significant risks to the Company.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations (CROs), contract development and manufacturing organizations (CDMOs) and supply chain resources. We assess vendors using a risk-based approach to manage cybersecurity risks associated with our use of certain of these providers. Through these practices, we may conduct risk assessments of vendors, provide and review security questionnaires, review vendors' written information security programs and security assessments, and impose contractual obligations related to information security on our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: The Board of Directors has oversight responsibility for cyber risks affecting the Company. The Board has delegated risk oversight with respect to operational, compliance, and financial matters, including cybersecurity and information technology risk, to the Audit Committee.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: We also have a vendor risk assessment process consisting of the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO's international standard for Supply Chain Security Management ("ISO 28001"), the NCSF, and the Customs-Trade Partnership Against Terrorism), and evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk Factors" in this Annual Report for additional information about risks related to cybersecurity.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: Material Cybersecurity Risks, Threats & Incidents Evolving cybersecurity threats have and will continue to pose difficulties in preventing, detecting, mitigating, and remediating cybersecurity incidents. While we have not experienced any material, or reasonably likely material, cybersecurity threats or incidents during the reporting period, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.

companyName: Innovex International, Inc.

ticker: INVX


text: We have a dedicated team focused on cybersecurity and we maintain a cybersecurity program designed to protect our systems, technology infrastructure, operations and the data entrusted to us by our employees and counterparties. Our cybersecurity program is led by our Chief Technology Officer, who is a part of our senior leadership team and works closely with our team to develop and advance our cybersecurity strategy and regularly reports to our board of directors and the audit committee of our board of directors on cybersecurity matters.

companyName: Royalty Pharma plc

ticker: RPRX


text: We engage with a range of external experts, including cybersecurity assessors, consultants, and auditors, in evaluating and attesting to our risk management systems, including an annual Systems and Organization Controls 2, or SOC 2, audit with respect to the security, availability, and process integrity trust services criteria, or TSC. Our collaboration with these third-party service providers includes regular audits, threat assessments, and consultation on cybersecurity strategy and enhancements. Recognizing the risks associated with these and other third-party service providers, we also conduct risk assessments on selected systems and third-party service providers on an ongoing basis.

companyName: Natera, Inc.

ticker: NTRA


text: The "Risk Factors" section includes further detail about the material cybersecurity risks we face. We believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have no t materially affected our business to date.

companyName: OOMA INC

ticker: OOMA


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Audit Committee has the primary responsibility to oversee effective governance in managing risks associated with cybersecurity threats. At each quarterly Audit Committee meeting, Management presents a cybersecurity update, which includes results of testing by third-party vendors and any suspected cybersecurity incidents.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Roles and Responsibilities Cybersecurity is an important element of our risk management processes and an area of particular focus for Reliance's Board of Directors and management. The Company's CIO serves as single point of communication and coordination for protecting the Company and its digital information. The CIO performs an initial assessment of each reported cyber incident and escalates all non-trivial cybersecurity incidents and risks to the CRC. The CRC is primarily responsible for assessing and managing material risks from cybersecurity threats and is comprised of a cross-functional team including the CIO, as well as senior representatives from the Company's risk management, finance and legal functions. The CIO has 15 years of experience in managing of cybersecurity.

companyName: RELIANCE, INC.

ticker: RS


text: The Chief Risk Officer is responsible for overseeing the assessment and management of the Company's information security program. The Chief Information Officer is responsible for execution, management, and administration of the information security tools and defenses of the program.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: As part of our cyber incident response plan, our CISO is responsible for escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines. In addition, outside advisors would be engaged as deemed necessary. The CEO, CFO, and Board are informed if the incident is deemed potentially material.

companyName: TAPESTRY, INC.

ticker: TPR


text: Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence, Board of Directors Oversight

companyName: Clubhouse Media Group, Inc.


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures to safeguard our information systems, shield our operational technologies in our manufacturing plants and protect the confidentiality, integrity and availability of our data.

companyName: HUNTSMAN INTERNATIONAL LLC


text: We measure our security performance using the International Organization for Standardization 27001 Framework and Enterprise Risk Management strategies. We implement policies and practices to mitigate risks to organizational data and operational processes.


text: Further, to enhance cybersecurity awareness, reduce vulnerability, and foster consideration of cybersecurity threats, our employees and the Board of Directors attend annual trainings. Specific role-based trainings are mandatory for certain employees, tailored to their duties.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our processes for assessing, identifying, and managing material risks from cybersecurity threats are part of our overall enterprise risk management system and processes. Enterprise risks, including cybersecurity risks, and their associated mitigations are reviewed at least annually by senior management and the Board of Directors. Throughout the year, we regularly assess our cybersecurity program and continue to invest in hardening and maturing our cybersecurity measures as further described below.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: We use, store and process data for and about our customers and employees. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: A comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Manager's systems, as well as the systems of third-parties that could adversely impact the Fund and its investors in the event of a cybersecurity incident affecting those third-party systems.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: We also rely on data-hosting companies and other third parties for certain business operations. We mitigate the associated cybersecurity risks through a third-party risk management program, which may include vendor risk assessments, security questionnaires, reviews of vendor security programs, and contractual obligations for vendors to maintain specific security measures.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We currently have one full-time employee who manages our day-to-day information technology systems and the third-party vendors engaged to assist in such management, including monitoring and addressing cybersecurity matters and reports to our Chief Financial Officer. Our cybersecurity vendor, which has a SOC 2 Type II Report and is ISO 27001 certified, utilizes industry-leading processes to monitor in real-time cybersecurity threats and risks to our systems. Our in-house IT resource receives immediate notification of incidents and engages regularly with our cybersecurity vendor through weekly and monthly reports and quarterly meetings to address any issues identified through their processes and communicates such issues in accordance with our incident response plan.

companyName: vTv Therapeutics Inc.

ticker: VTVT


text: The Company's Chief Information and Digital Officer (the "CIDO"), who reports directly to the Senior Vice President, Chief Financial Officer, is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management programs, in partnership with business and functional leaders across the Company. The CIDO has 23 years of experience in the information technology and cybersecurity field, including previous roles in security architecture, audit, compliance, and governance.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: As part of our overall enterprise risk management approach, the Company's cybersecurity program framework is focused on the following key areas:

companyName: FARO TECHNOLOGIES INC


text: We describe whether and how risks from cybersecurity threats are reasonably likely to affect our business, results of operations and financial condition, under the heading "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business" included as part of our Item 1A. Risk Factors of this Annual Report on Form 10-K, which is incorporated by reference into this Item 1C.

companyName: MiNK Therapeutics, Inc.

ticker: INKT


text: We execute a comprehensive approach to cybersecurity risk management, helping ensure the data customers and other stakeholders entrust to us remains safe and secure. Our board of directors (the "Board"), Compliance Committee, and Information Security Program leaders are actively involved in the oversight of our cybersecurity risk management program. As described in more detail below, we have established standards, policies, practices, and processes focused on identifying, assessing, managing, mitigating, and responding to material risks from cybersecurity threats. To date, the Company is not aware of risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategies, results of operations, financial condition, or cash flows. However, while we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure, we cannot provide absolute assurance that any potential future cybersecurity threats or incidents will not materially affect us or our business strategies, results of operations, financial condition, or cash flows. For further discussion on cybersecurity related risks, see the "Risk Factors" section of Item 1A of this annual report on Form 10-K.

companyName: O REILLY AUTOMOTIVE INC

ticker: ORLY


text: Risk Assessment: No less frequently than annually, our Adviser completes an assessment to identify potential cybersecurity threats and vulnerabilities to better prioritize and mitigate the Company's cybersecurity risk. The assessment includes, among other things, evaluating the nature, sensitivity and location of information the Company collects, processes and stores and the resiliency of the underlying technologies, the validity and effectiveness of the Company's security policies, controls and processes and the cybersecurity preparedness of the third-party vendors used by the Company and our Adviser. To supplement our Adviser's internal assessment, our Adviser also periodically engages third-party consultants to assess system configurations through configuration review and penetration testing.

companyName: NexPoint Residential Trust, Inc.

ticker: NXRT


text: Tal Hornstein, our Chief Information Security Officer (CISO), leads our cybersecurity program and oversees teams supporting security functions across the company. Mr. Hornstein holds a CISSP certification from ISC2 and has over 20 years of experience in multiple cybersecurity and technology-related roles. He joined Hippo in late 2021 and has been instrumental in designing and executing our entire cybersecurity stack.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Cyber Risk Management and Strategy We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program in accordance with our risk profile, which is informed by, and incorporates, elements of recognized industry standards. We leverage the support of third-party information technology and security providers, including for cybersecurity audits and risk assessments. We implement technical controls, such as multi-factor authentication and we deploy cybersecurity tools through a leading third-party cybersecurity firm to protect our systems from cybersecurity related risks. We have an enterprise risk management program and we maintain written information security policies, including an incident response plan, which is designed to establish our processes for identifying, responding to, and recovering from cybersecurity incidents. The incident response plan is exercised on an annual basis. Finally, we have implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through the use of vendor security questionnaires. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, like other companies in our industry, we and our third-party vendors may, from time to time, experience threats and security incidents that could affect our information or systems. For more information, please see Item 1A - Risk Factors.

companyName: Cerence Inc.

ticker: CRNC


text: The cybersecurity program at Cars Commerce is part of our enterprise risk management program. At Cars Commerce, we believe cybersecurity risk management is of the utmost importance. As a result, Cars Commerce has implemented an information security management system (the "ISMS") designed to protect our infrastructure from potential threats and to allow us to assess, identify and manage material risks from cybersecurity threats as described in more detail below. The ISMS supports the security safeguards that are designed to protect the confidentiality, integrity, availability, and contractual compliance of the Cars.com Inc. (d/b/a Cars Commerce, Inc.) entities, which include Cars.com LLC, Accu-Trade, LLC, CreditIQ, LLC, DealerRater.com LLC and Dealer Inspire Inc. which is inclusive of the In-Market Video and NewCars brands. In addition, we engage with external resources to contribute to, and provide independent evaluation of, our existing cybersecurity practices. As a result, in 2023, Cars Commerce engaged an independent auditor to conduct an audit of the ISMS, and Cars Commerce completed the certification to meet International Organization for Standardization 27001 requirements for the above-stated entities. In October 2024, Cars successfully completed its ISO 27001 surveillance audit. In November 2023, Cars Commerce, through its subsidiary, completed the acquisition of D2C Media. During the due diligence, Cars Commerce completed an evaluation of its cybersecurity risk management process and plans to integrate D2C Media into the ISO 27001 certification process.

companyName: Cars.com Inc.

ticker: CARS


text: Education and Awareness The Company provides regular training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Axsome Therapeutics, Inc.

ticker: AXSM


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats. Our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Chief Executive Officer.

companyName: Southern States Bancshares, Inc.


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: We rely on Prudential, of which both the Manager and Subadviser are subsidiaries, for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Prudential has provided to us regarding its cybersecurity program that are relevant to us.

companyName: PGIM Private Credit Fund

ticker: PGIM


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. Such processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: We expect to utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing. We intend to utilize well-known cloud-based technologies and service providers, such as Amazon AWS, Microsoft Office and Google enterprise to provide protection against cybersecurity threats.

companyName: Rapid Line Inc.

ticker: RPDL


text: Additionally, in order to reduce cybersecurity risks related to our use of third-party service providers, Rithm (i) obligates our service providers to adhere to strict privacy and cybersecurity measures and (ii) performs risk assessments of each new service provider during onboarding based on, among other things, the nature of their business and the type of information we provide to such service providers. Each service provider is assigned a tiered risk rating, which determines the frequency and extent of evaluation for the service provider. Furthermore, Rithm collects and evaluates SIG, SOC 1 reports and Business Continuity and Disaster Recovery documents for our key service providers.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: Our Board of Directors considers cybersecurity risk a part of its overall risk oversight function. The VP of IT/CISO reports to the CFO, who regularly reports to the Board of Directors and Audit Committee regarding cybersecurity risks and our risk management program.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: h.we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents; and i.we perform periodic simulations of attack scenarios by an internal "Red Team" to test the efficacy of both security controls and our tactical incident response procedures.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Leveraging our cybersecurity risk management processes, cybersecurity risk factors were identified, which are inherent to our business and industry. The risk factors discussed in this section should be considered together with information included elsewhere in this Annual Report on Form 10-K and should not be considered the only risks to which we are exposed. Additionally, mitigation of these risk factors is tracked by management as part of our cybersecurity maturity roadmap.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: In 2023, we conducted an enterprise risk assessment that included an assessment of cybersecurity risk in context with other enterprise-level risks. Furthermore, our CISO and our General Counsel regularly discuss cybersecurity risk mitigation. We carry errors and omissions insurance that provides some protection against the potential losses arising from a cybersecurity incident. For additional information regarding potential cybersecurity risks, see relevant business and operational risks under Item 1A, "Risk Factors", of this Annual Report on Form 10-K.

companyName: TELOS CORP

ticker: TLS


text: Our security operation center monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: Our Cybersecurity Committee consists of four (4) members: the Chief Information Officer, the Chief Financial Officer, the Director of Internal Audit and the Director of IT, Infrastructure and Flight Systems. Together with our Executive Leadership Team and the Board, the Cybersecurity Committee assists with prioritizing our cybersecurity programs as well as providing oversight around cybersecurity practices and guidance in responding to cyber incidents. Members of the Cybersecurity Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks in our industry. Committee members are also experienced and knowledgeable across Information Technology disciplines including strategy, governance, infrastructure, applications, data management, audit controls & compliance, risk management, disaster recovery, business continuity, and incident response planning.

companyName: Bristow Group Inc.

ticker: VTOL


text: Our Board has active oversight of risk management, which includes cybersecurity. Several members of our Board have cybersecurity experience gained through direct responsibilities, oversight or other relevant education and experience. Our Board has delegated primary responsibility of cybersecurity risk to the Audit Committee.

companyName: TAPESTRY, INC.

ticker: TPR


text: Our Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to senior management and the Board of Directors. The Security Incident Response Plan requires management to assess materiality of the threat or incident for purposes of public disclosure.

companyName: Federal Home Loan Bank of Des Moines


text: The processes by which the relevant members of management are informed about and manage the prevention, detection, mitigation, and remediation of cybersecurity incidents include conducting cybersecurity risk assessments, establishing network access controls, creating a vulnerability management program, and continuous monitoring for threats.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. Such uses of information systems and technology give rise to cybersecurity risks, including system disruption, security breach, ransomware, theft, espionage, and inadvertent release of information. Our business involves the storage and transmission of numerous classes of sensitive and/or confidential information and intellectual property, including customers' and suppliers' information, private information about employees, and financial and strategic information about the company and its business partners. Further, as we pursue new initiatives that improve our operations and cost structure, we are also expanding and improving our information technologies, resulting in a larger technological presence and increased exposure to cybersecurity risk. If we fail to properly assess and identify cybersecurity risks, we may become increasingly vulnerable to such risks.

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: Board executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and the Board has authorized the Audit Committee to oversee risks related to cybersecurity threats. Our Audit Committee has primary oversight responsibility for cybersecurity and information security risk management and controls. As part of its oversight function, the Audit Committee oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the overall data protection program.

companyName: CorMedix Inc.

ticker: CRMD


text: Cleco's CSIRPs help ensure a timely, consistent, and compliant response to actual or attempted cybersecurity incidents impacting Cleco. These response plans include detection, analysis, containment, eradication, recovery, post-incident review, and timely notice to relevant stakeholders, including Cleco's Audit Committee, once an incident is deemed to be potentially significant or material.

companyName: Cleco Corporate Holdings LLC


text: Our information security processes are overseen by our IT Manager and our Chief Accounting Officer, and supported by a cybersecurity monitoring service provider, who work to help identify, assess and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our Board has ultimate cybersecurity and data privacy risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Compliance Committee ("Audit Committee"). The Audit Committee oversees our cybersecurity and technology risks, along with our data privacy risks, all of which are integrated into our overall ERM program. The Audit Committee actively reviews and discusses our cybersecurity and technology risk management programs and regularly reports out to the full Board on our relevant strengths and opportunities. The Audit Committee also reviews our data privacy risk management programs and reports out to the full Board on our relevant strengths and opportunities.

companyName: STARBUCKS CORP

ticker: SBUX


text: The Company's management is responsible for identifying, managing and mitigating cybersecurity risk and communicating cybersecurity risks facing the Company to the Audit Committee and Board of Directors.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: The Company's cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Company's President and Chief Executive Officer, Chief Financial Officer, and General Counsel (collectively, "Executive Management"). Executive Management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Board for certain cybersecurity incidents.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Enterprise-wide, proactive cybersecurity risk mitigation is imperative to the Company. The Company's cybersecurity efforts and programs align with the National Institute of Standards and Technology's Cybersecurity Framework and meet or exceed the requirements set forth by the BPU. We also utilize the Cybersecurity Capability Maturity Model, or C2M2, from the U.S. Department of Energy to evaluate and improve our cybersecurity processes and programs for our critical infrastructure.


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) and to provide for the availability of critical data and systems to maintain regulatory compliance. These controls include the following activities: • Closely monitoring emerging data protection laws and implementing needed changes to our processes to maintain compliance; • Conducting annual cybersecurity management and incident training for all employees of the organization; • Requiring employees and third parties who provide services on our behalf to treat customer information and data with care; • Leveraging the HITRUST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • Carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident, although our insurance coverage may be insufficient to cover all losses from a cybersecurity incident or our insurer may deny coverage for a claim.

companyName: AMEDISYS INC


text: We are dedicated to safeguarding our invaluable assets and ensuring the well-being of personnel, as demonstrated through the preparation of our cybersecurity program. cyber risk management program is designed to comprehensively address the spectrum of cybersecurity threats that confront our organization.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: The Advisor and its affiliates also partner with independent third-party experts to provide a comprehensive cybersecurity solution that safeguards organizations against a broad spectrum of cyber threats.

companyName: Lightstone Value Plus REIT V, Inc.


text: As we have positioned ourselves as a public company acquisition vehicle, and have limited operations, we do not have any significant operations that face cybersecurity threats. Although we do depend on the digital technologies of third parties, and any deliberate attacks on, or security breaches in, systems or infrastructure that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, information and sensitive or confidential data, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Viskase Holdings, Inc.

ticker: ENZN


text: As a company with no ongoing business operations, the Company currently has limited exposure to cybersecurity risks. However, we recognize the importance of maintaining secure information systems and protecting sensitive data, including corporate records and investor-related information.

companyName: RIDGEFIELD ACQUISITION CORP

ticker: RDGA


text: Our Board of Directors and Audit Committee oversee our enterprise risk management process, including the management of risks arising from cybersecurity threats. On at least an annual basis, the Board of Directors and Audit Committee receive presentations and reports on cybersecurity risks from our Vice President of Information Technology, which may address topics including our overall assessment of cybersecurity risks, compliance with cybersecurity policies and procedures, third-party test results, the current threat environment, and technological trends and information security considerations arising with respect to our peers in the biotechnology space. The Board and Audit Committee also receive ad hoc reporting as appropriate. Our Vice President of Information Technology, who reports to our Chief Strategy and Business Operations Officer, is primarily responsible for assessing such risks. This individual has over 20 years of information technology and cybersecurity experience in the biotechnology industry.

companyName: Foghorn Therapeutics Inc.

ticker: FHTX


text: The Company maintains, and routinely reviews and evaluates its information technology ("IT") and cybersecurity policies, practices and procedures (our "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of the Company's Crisis Management Plan. Our Cybersecurity Program is administered by our IT Manager, who is managed on a day to day basis by our General Counsel and Chief Compliance Officer and overseen by our IT Steering Committee consisting of our Chief Executive Officer, our Chief Financial Officer and Chief Operating Officer and our General Counsel and Chief Compliance Officer. Our General Counsel and Chief Compliance Officer also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan. We also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems, to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in our Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of our external IT and cybersecurity advisers, consultants and experts, are sufficient to manage our Cybersecurity Program.

companyName: Main Street Capital CORP

ticker: MAIN


text: Our Chief Information Security Officer ("CISO") leads our cybersecurity team and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. Our CISO has 25 years of experience serving in various roles related to cybersecurity and information security. Our Security Steering Committee ("SSC"), chaired by our CISO, is comprised of executive level representatives from our Information Technology ("IT"), legal, enterprise risk management and internal audit teams and is responsible for oversight, evaluation and coordination of activities related to safeguards, security risk, controls, remediation activities, policy governance and other factors. Our cybersecurity plan, strategies, policies, standards, and processes are aligned with common security risk management frameworks and practices including detailed tasks, plans and initiatives. Our program also incorporates incident response plans and notification protocols, to assess and manage incidents and threats, including their materiality.

companyName: Dine Brands Global, Inc.

ticker: DIN


text: Rocket Companies aligns its Program to the National Institute of Standards (NIST) Cyber Security framework. The Program is reviewed and updated by regular risk assessments, which identify reasonable and foreseeable internal and external risks. The Company performs ongoing assessments of its Program to measure both the sufficiency of the safeguards to control risk and the design and operating effectiveness of our security requirements and controls. We implement information security policies throughout our operations, and our enterprise risk management ("ERM") process considers information security risks alongside other company risks as part of our overall risk assessment process.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Our Board of Directors oversees cybersecurity risk management as part of its general oversight function. The Company's management team provides updates to the Board of Directors regarding cybersecurity as appropriate.

companyName: HENNESSY ADVISORS INC

ticker: HNNA


text: Rapidly evolving threats to the cybersecurity landscape necessitate ongoing efforts to manage the risk of unauthorized access to the Company's information systems and devices, including those of the Company and of third-party providers. The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information. The company employs various aspects of risk assessment regularly, and to the extent possible, continuously. Further, the Company uses a defense in depth, or layered, approach to strengthen the security environment and mitigate the impact of any potential threats. Cybersecurity risks are strategically managed under the leadership of the Vice President, IT Operations and Security, who has achieved preeminent certification as a Certified Information Security Manager (CISM) and Certified Cloud Security Professional (CCSP) and has served as the most senior IT resource in many different roles.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Our Audit Committee has primary oversight of the Company's information security programs, including cybersecurity. Our internal audit department, together with third parties that we engage, report to our Audit Committee and audit the Company's information security programs. Our Chief Digital Officer, who oversees our information security training and awareness program, also updates the Audit Committee on a quarterly basis regarding information security matters. Our Audit Committee and Chief Digital Officer also provide the full Board of Directors with updates no less than annually, relating to information security and cybersecurity risks. These updates include a review of the appropriateness of our various procedures related to the security of our network and data, as well as the evaluation of new and existing technologies and their effectiveness in meeting our business objectives.

companyName: Six Flags Entertainment Corp/OLD


text: We work with industry-leading third parties that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, legal advisors, threat intelligence service providers, and penetration testing firms. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response plan, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: We engage third-party providers to conduct evaluations of our security controls, including through vulnerability assessments and penetration testing, independent audits or consulting on best practices. These evaluations include testing both the design and operational effectiveness of security controls. Additionally, our internal audit team regularly evaluates the effectiveness of the IS Program, with results reported to the board of directors.

companyName: CROWN CASTLE INC.

ticker: CCI


text: Cybersecurity risk is primarily managed by our Directors of Information Security and Information Technology. These individuals have decades of experience in managing cybersecurity risk for public companies. Additionally, we have established a cross-functional Cybersecurity Committee, consisting of executive-level leadership, including representatives from the Finance, Marketing, IT, Legal, Internal Audit, and other teams, that meets periodically to review cybersecurity risks, incidents, and assess emerging threats. The Committee is also informed of our responses to such risks, incidents and threats.

companyName: Super Micro Computer, Inc.

ticker: SMCI


text: The Audit Committee and full Board receive periodic briefings from management on our cyber risk management programs. The Company also has an internal disclosure committee made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committee meets on a quarterly basis to ensure they are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to the Board and Audit Committee as needed.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: We have established a disclosure committee, which consists of our chief executive officer, chief financial officer, and senior leaders from finance, legal, accounting, corporate communications, and investor relations, including, but not limited to, our Chief Legal Officer, CIO, CISO, chief accounting officer, controller and Chief Corporate Communications Officer. The disclosure committee is actively involved in the review and approval of the Company's SEC filings and has responsibility for considering the materiality of information for such filings and, on a timely basis, determining the disclosure of that information. The CISO briefs the disclosure committee, as necessary, on cybersecurity related matters, which includes information regarding our detection, prevention, mitigation, and remediation of cybersecurity incidents and monitoring of previously evaluated cybersecurity incidents for subsequent changes that might impact conclusions on materiality, and this information is presented to the nominating and corporate governance committee, as appropriate.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our Director of Information Technology is responsible for the day-to-day administration and management of our cybersecurity program, under the direct supervision of our Chief Product Officer (formerly our Chief Technology Officer). Currently, the Director of Information Technology role is held by an individual who has approximately 19 years of information technology experience and 10 years of cybersecurity experience. We also work with external security service providers to support our security monitoring and threat detection capabilities and have implemented a process to report relevant findings to the Director of Information Technology and up to the Chief Product Officer and other members of executive management, where appropriate.

companyName: 908 Devices Inc.

ticker: MASS


text: To our knowledge, during 2024, there were no material cybersecurity incidents or threats that materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. For more information on risks from cybersecurity threats that may materially affect the Company, see Item 1A. "Risk Factors".

companyName: OptimizeRx Corp

ticker: OPRX


text: The board of directors oversees our cybersecurity risks by periodically evaluating cybersecurity reports from senior management, including the CIO and CISO, as well as reports from the board committees and third-party consultants. The Risk Committee oversees our enterprise risk management framework including risks associated with data security, cybersecurity, IT infrastructure, and data privacy. The Audit Committee oversees the internal and external auditors' review of our cybersecurity risks.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We have data and cybersecurity protection and control policies to facilitate a secure environment for sensitive information and to ensure the availability of critical data and systems. The information security management system supporting our online learning platform has been independently certified to the International Organization for Standardization ("ISO") / International Electrotechnical Commission 27001:2013 standard. This standard is designed to promote risk management, cyber-resilience, and operational excellence with respect to an information security management system. Our online learning platform undergoes regular internal security testing, and we engage third-party providers to perform penetration and vulnerability tests. We have annual independent third-party audits conducted on system security and availability, such as Systems and Organization Controls 2 Type 2 ("SOC 2") audit reports and ISO 27001 certification. Certain highly sensitive information, such as personally identifiable information ("PII") about our learners in our online learning platform, is encrypted at rest and in transit using industry standards. We also require employees and contractors to undergo annual information security awareness training. In addition, to mitigate the financial impact of cybersecurity incidents, we maintain insurance to help cover losses resulting from such potential incidents.

companyName: Coursera, Inc.

ticker: COUR


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response procedures; disaster recovery/business continuity plans; risk assessments; implementation of security standards; encryption of certain data; network security, access, and physical controls for certain systems; management, tracking and disposal of certain assets; systems monitoring; employee training; penetration tests by third-party service providers; tabletop exercises; and cybersecurity insurance.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our Information Security Program consists of several elements including: • Incident Monitoring and Response. We have 24x7 security cybersecurity monitoring, which utilizes both third-party cybersecurity experts and leading tools to monitor activity in our information systems. We also maintain an incident response plan and playbooks that define our response to a cybersecurity incident, including a cross-functional incident response process that includes key stakeholders such as senior leaders and legal, and leverages our technological resources and third-party service providers. Through ongoing communication with these teams, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to leadership when appropriate pursuant to internal guidelines governing the reporting of such events. • Threat and Vulnerability Management. We maintain a threat and vulnerability management program that leverages multiple data sources to proactively identify, assess, and mitigate changing cybersecurity risks. This program incorporates vulnerability scanning and threat intelligence capabilities, which are in place to help safeguard information assets. We also share and receive threat intelligence with government agencies, the Financial Services Information Sharing and Analysis Center ("FS-ISAC") and cybersecurity vendors and leaders in the cybersecurity industry. • Infrastructure and Data Protection. We have technical and organizational safeguards that are designed to protect our networks, systems, and data from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, network and endpoint anti-malware protections, and access controls such as privileged access management. Our information security and information technology teams collaborate regularly to assess the security of current and future infrastructure changes. • Third-Party Risk Management. We run a third-party risk management program designed to identify and manage risks, including cybersecurity risks, involving our third-party providers. This includes performing due diligence and assessment of each provider's cybersecurity posture as well as periodic re-assessments. • Security Training and Awareness. We provide ongoing education and training to employees regarding cybersecurity threats and the role they play in helping prevent and detect these threats. This includes regular phishing simulations, with training provided for any failures, as well as periodic communications via the internal company portal concerning threats, best practices, and technology changes to improve security. We also work with the Company marketing department to periodically publish articles on our website to raise security awareness with our customers.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: If a cybersecurity incident were to occur, the Company would establish a cross-functional incident response team to respond to the specific cybersecurity incident. The incident response team would consist of a subset of members from the standing crisis response team, including personnel with the most relevant experience related to the specific incident. This collaborative approach is intended to enable the Company to leverage expertise throughout the business to address cybersecurity events and to evaluate the potential financial, legal, operational and reputational implications of an incident, or series of related incidents. In considering the materiality of an event, related attacks, whether in terms of quantity or impact, are reviewed individually and in the aggregate to determine whether they may have a significant impact on the Company's financial condition, results of operations or business strategy, either quantitatively or qualitatively.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our Program includes: risk assessments and penetration tests integrated within our overall risk management processes that are designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any); annual management reporting to the Board of Directors (the "Board");

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The SHUSA Board of Directors and its Risk Committee oversee the development, implementation, and maintenance of the Company's Information Security Program. Annually, the CISO provides the Board of Directors with a report that includes the cyber risk assessment process, risk management and control decisions, results of testing, third-party service provider arrangements, security breaches or violations (if any), and adjustments to the program. In addition, the CISO provides the Board Risk Committee with annual cyber awareness reporting, in which cybersecurity risk and internal mitigating controls are reviewed.

companyName: Santander Holdings USA, Inc.


text: Board of Directors has specific oversight responsibility for cybersecurity, which also oversees our general risk management. The Board of Directors reviews and discusses with management our policies, practices and risks related to information security and cybersecurity.

companyName: Ondas Inc.

ticker: ONDS


text: Following our risk assessments, we design and implement reasonable safeguards to address any identified gaps in our existing processes and procedures.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Currently, our cybersecurity risk management relies primarily on internal resources. However, as the Company continues to expand, we anticipate engaging third-party consultants to assist in enhancing our cybersecurity management processes and addressing evolving threats.

companyName: RICHTECH ROBOTICS INC.

ticker: RR


text: In addition, our third-party vendors and service providers play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Company's IT AVP, on behalf of the ISC, reports to the Audit Committee at least annually regarding technological risk exposure and the Company's cybersecurity risk management strategy and reports any incidents to the Audit Committee in real time. Based on these reports, the Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Internal Audit function also provides quarterly updates to the Audit Committee which include an update on cybersecurity risks and related internal controls.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: How management is informed of and monitors incidents Our management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures and maintaining our cybersecurity programs. Our cybersecurity programs are under the direction of our CSO (in coordination with our Chief Privacy and Data Responsibility Officer, Chief Data Officer, among others), who receives reports from our cybersecurity teams and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our management, including the CSO and our cybersecurity teams, follow a risk-based escalation process to notify the Risk Committee outside of the regular reporting cycle as appropriate when they identify an emerging risk or material issue.

companyName: Mastercard Inc

ticker: MA


text: The Vice President of Corporate Systems (the "CISO") leads our information security organization and is responsible for managing our information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading cybersecurity programs at other public companies. Team members who support our information security program have relevant educational, industry, and professional experience. Our information security team provides regular reports to senior management and other relevant teams on various cybersecurity threats, assessments and findings.

companyName: Chewy, Inc.

ticker: CHWY


text: Our internal information security team is responsible for day-to-day operations related to our cybersecurity risk management strategy, including identifying, assessing, and managing cybersecurity threats and risks. We established a process that intends for our Incident Response Team to respond to and address incidents as they arise. The Incident Response Team is multidisciplinary and comprised of members of our information technology and security function, accounting and finance department, and legal department. This team is led by our Director of Security and Network Infrastructure. The Director of Security and Network Infrastructure role is currently held by an individual who has approximately twenty (20) years of information technology and ten (10) years of information security related experience.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws and implement changes to our processes to comply; Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; Update key employees regularly on phishing email and other cybersecurity risks; Employ artificial intelligence assisted cybersecurity monitoring capabilities; and Complete regular updates to key software and infrastructure.

companyName: McEwen Inc.

ticker: MUX


text: In the last three fiscal years, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion on risks posed by cybersecurity threats, see "Item 1A. Risk Factors - Risks Relating to Our Business- We may experience cybersecurity incidents and are subject to cybersecurity risks. The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: awareness training for our employees, incident response personnel, and senior management; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Stereotaxis, Inc.

ticker: STXS


text: Continuously developing and evaluating our program in accordance with the NIST Cybersecurity Framework. This Framework serves as a reference to aid in the identification, assessment, and mitigation of cybersecurity risks pertinent to our business operations.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Cybersecurity is a critical component of our operational integrity and strategic planning. Recognizing the evolving nature of cyber threats, we are committed to implementing robust cybersecurity measures to safeguard our digital assets, protect stakeholder interests, and ensure continuity of our operations.

companyName: INNOVATE Corp.

ticker: VATE


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this annual report on Form 10-K, under the heading "Operations".

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Our commitment to cybersecurity is a fundamental aspect of our operational strategy, ensuring the protection of our information assets, the continuity of our operations, and the trust of our stakeholders.

companyName: Outdoor Holding Co

ticker: POWW


text: Genworth's risk management framework recognizes the significant operational risk, including risk of losses, from cybersecurity incidents and the importance of a strong cybersecurity program for effective risk management.

companyName: GENWORTH FINANCIAL INC

ticker: GNW


text: We use both external and internal threat intelligence sources to inform our defensive measures, including information from industry vendors and government agencies. We monitor evolving risks and threat events to implement security controls where applicable.

companyName: Village Farms International, Inc.

ticker: VFF


text: All IT assets and infrastructure are monitored 24/7/365 through a combination of automated detection software, SIEM software and a fully staffed 24/7 SOC. We have continuous monitoring for viruses, intrusions, and malicious activities.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: cybersecurity programs. Our expertise in IT and cybersecurity generally has been gained from a combination of education, best practices and prior experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above. As evidenced by the cybersecurity incident described above, no combination of defensive measures are infallible. However, we are confident that we have established robust and reasonable measures and defenses consistent with industry standards and our Company's operations and use of internet-related systems. While this landscape is continually changing, we attempt to be knowledgeable and flexible with regard to the protection of our data and that of our partners.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: In designing and evaluating our cybersecurity program, we will adopt the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF 2.0") as a guiding principle. It is important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment and management processes and does not equate to compliance with any specific technical standards or requirements.

companyName: NKGen Biotech, Inc.


text: Our cybersecurity team is led by our chief information security officer, who is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior management and other teams across the Company. The chief information security officer provides regular updates to the Cybersecurity Committee (discussed further below) of which he is also a member. Our chief information security officer has extensive cybersecurity knowledge and skills gained from over 20 years of experience at the Company as chief information security officer and chief information officer where he has been responsible for implementing and maintaining cybersecurity and data protection practices, implementing complex technology solutions, and managing large groups of technology professionals. He holds multiple cybersecurity industry focused certifications and reports directly to the Co-Chief Executive Officer.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: The Committee is responsible for developing and implementing cybersecurity risk mitigation strategies and activities, including the managing of comprehensive incident response plans, overseeing the cybersecurity risks posed by third-party vendors, keeping our policies and procedures current, assessing compliance with our cybersecurity policies and procedures, and receiving regular updates on cybersecurity-related matters.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, customers and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: AmpliTech Group, Inc.

ticker: AMPG


text: We also engage third party service providers when necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Despite our security measures, our information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyberattacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position, and additional costs to remediate the issue.

companyName: urban-gro, Inc.

ticker: UGRO


text: We have identified and analyzed the nature and scope of the affected systems and data. We have notified our affected customers and applicable state attorneys general and regulators, and approximately 1.3 million potentially impacted consumers; are providing credit monitoring, web monitoring and identity theft restoration services; and are fielding questions from customers. We are continuing to coordinate with law enforcement, our customers, regulators, advisors and other stakeholders. We have been named as a defendant in several lawsuits related to this incident. The Company will vigorously defend itself against any litigation filed related to this incident. This incident did not have a material impact on the Company.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: Governance and Oversight of Cybersecurity Risks Fortress has developed an incident response framework to identify, assess and manage cybersecurity events. The framework is managed and implemented by Fortress's Enterprise Security Steering Committee (the "ESSC"), a cross- functional management committee that includes its General Counsel, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Chief Human Resources Officer and Fortress IT Management. The ESSC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with business heads and senior management, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: Fortress Net Lease REIT


text: Our Audit Committee and management meet with the Board on a quarterly basis to provide updates on cybersecurity risks, material cyberattacks and security incidents as they occur, as well as to promote company-wide cyber risk and security awareness. Additionally, our Chief Information Officer and Director of Cybersecurity meet periodically with the Board or the Audit Committee to brief them on technology and information security matters.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: As a matter of process, the Nominating and Corporate Governance Committee annually reviews, and recommends to the Board of Directors its approval of, our information security policy and cybersecurity program and our incident response plans. Furthermore, on an annual basis, the Board of Directors and its Committees review and discuss our technology strategy with our Chief Information and Compliance Officer and approve our technology strategic plan.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Our management team, including our Chief Information Security Officer (CISO), is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 20 years of experience managing the security and compliance organization for global companies, providing online and cloud-based services to more than a majority of the Fortune 500 and the United States Government.

companyName: Stride, Inc.

ticker: LRN


text: We do not believe there are any currently known cybersecurity risks that are reasonably likely to materially impact our business strategy, operations, or financial condition. If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding cybersecurity risks that we face and the related potential impacts on our business, see the risk factor titled "Our internal computer systems, or those of our third-party collaborators or other service providers, may fail or suffer security breaches and cyber-attacks, which could result in a material disruption of our development programs."

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Day-to-day management of our information security strategy and operations is currently the responsibility of our CISO, who reports into our Chief Financial Officer. Prior to joining the Company, our CISO held senior leadership roles in various other organizations, including as CISO for a publicly traded, global retailer and as a consultant advising organizations on information security strategy, and as a Special Agent with the U.S. Secret Service focusing on electronic crimes. That experience is supplemented by the collective experience and expertise of our dedicated internal teams of cybersecurity personnel.

companyName: Walt Disney Co

ticker: DIS


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, increasing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: The Company is unaware of any risks from cybersecurity threats, including those from publicly disclosed incidents with respect to other companies, that have materially affected, or are reasonably likely to materially affect the Company, including strategies, results of operations, or financial condition.

companyName: DILLARD'S, INC.

ticker: DDS


text: Our cybersecurity processes are integrated into our Company's overall risk management processes. Our CTO is a member of our cybersecurity and ERM committees and cybersecurity issues are raised to these committees. In addition, our CTO reports to the audit committee of our board of directors bi-annually, regarding our cybersecurity program and material risks, and once annually to our full board of directors, regarding overall cybersecurity strategy.

companyName: Hamilton Lane INC

ticker: HLNE


text: Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Audit Committee receives quarterly reports from our Chief Information Security Officer ("CISO") on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CISO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. The CISO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CISO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Critical Security Controls to continually evaluate and enhance our cybersecurity. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third -party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout our organization. These cybersecurity drills are performed both in-house and by a third -party service provider. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. Our Cybersecurity Steering Committee also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Steering Committee escalates events, including to the Chief Financial Officer, Audit Committee and Board of Directors, as relevant, according to pre-defined criteria.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: Board oversees our risk management process and receive regular updates and information on cybersecurity risks, if any, which address recent developments, evolving standards, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receive timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: The Company has implemented and maintain multiple layers of physical, administrative and technical security processes designed to protect our manufacturing facilities from disruptions that may result from cybersecurity incidents, as well as safeguard the confidentiality of our critical systems, and data residing on those systems, including employee data, customer data, and intellectual property. Our risk assessment and management of material risks from cybersecurity threats is integrated into our overall enterprise risk management process, as well as our information systems processes. Our strategy includes regular formal risk assessments, dynamic risk and threat analysis, utilization of security tools, regular cybersecurity-related tabletop and phishing exercises designed to simulate cybersecurity incidents, and frequent security awareness and technical security trainings. We conduct periodic internal and third-party assessments to evaluate our cybersecurity posture and test and assess our incident response program, incident roles and responsibilities, material impact evaluation, and decision-making processes in the event of a cybersecurity incident. We use our risk and security assessments to enhance our information security capabilities.

companyName: GENTEX CORP

ticker: GNTX


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. To date, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Assessments by external providers of our cybersecurity measures include information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such internal and external assessments, audits, and reviews are reported to the audit committee and the board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our data and systems, including payors and IDTFs. These processes include vetting of service providers for security, reliability, and availability; execution of a Business Associate Agreement with each provider for compliant management, storage, or processing of PHI; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete a risk-based review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: The Board of Directors have oversight responsibility for the Company's cybersecurity risks. While the Company's employees play a key role in cybersecurity, the Company's Chief Information Officer, General Counsel and other members of management have shared responsibility for assessing and managing the Company's cybersecurity risks. The Company's management has sufficient knowledge, experience and expertise for assessing and managing the Company's cybersecurity risks. The Board of Directors and Audit Committee receive updates from management regarding cybersecurity risks, cybersecurity threats that could impact the Company and cybersecurity initiatives to enhance the Company's cybersecurity practices. The Audit Committee also receives updates on the results of assessments and audits of the Company's information technology systems and controls.

companyName: Quanex Building Products CORP

ticker: NX


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to events compromising information and systems security, and works closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.

companyName: Century Communities, Inc.

ticker: CCS


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our cyber defense team, notifications from employees, vendors or service providers, and notifications from third party information technology system providers. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to our IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Playa Hotels & Resorts N.V.


text: The Audit Committee. The Audit Committee reviews with our management team, including our Senior Vice President – Information Systems and Technology, our cybersecurity frameworks, policies, technologies, programs, opportunities, strategies and risks. These presentations highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks, related remediation and mitigation activities, security user awareness and reporting training program and any other relevant cybersecurity topics. In addition, members of our Legal Department advise the Audit Committee as needed regarding cybersecurity-related legal matters, including disclosure requirements. Management believes that these reports help to provide the Audit Committee with an informed understanding of our cybersecurity program, risks and strategies. The Audit Committee may request follow-up data and presentations to address any specific concerns or recommendations. In addition to this periodic reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee as needed based upon our cyber incident reporting process. The Audit Committee reports regularly to the entire Board and reviews with the Board any major issues that arise at the committee level, which may include cybersecurity risks.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: In the event of a cybersecurity incident, the Company's SVP, Head of Legal and Compliance is equipped with a well-defined Incident Response and Reporting Policy (IRRP) to guide response, reporting, and recovery actions. This IRRP includes immediate actions to mitigate the impact of the incident, long-term strategies for remediation and prevention of future incidents, and provides for internal notification of the incident to functional areas as well as senior leadership and the Board of Directors, as appropriate.

companyName: Talis Biomedical Corp

ticker: TLIS


text: Under the leadership of our general counsel, we have constituted an enterprise risk management committee ("ERMC") composed of senior management, including the CIO and other senior executives. The ERMC monitors and oversees risk areas that potentially could pose a high impact to the business, and cybersecurity currently is one of the ERMC's priority focus areas. The ERMC reports on our top identified risks and steps to address those risks to the full Board on a semi-annual basis.

companyName: REPLIGEN CORP

ticker: RGEN


text: The audit committee of the board of directors receives periodic reports from our Senior Director, IT & Facilities concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: CERUS CORP

ticker: CERS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the risk factor heading " Security incidents, loss of data and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability " which disclosures are incorporated by reference herein. We have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: We have engaged a third-party provider that manages and monitors our Security Operations Center, including our firewall and intrusion detection and prevention system. Additionally, management has engaged a separate vendor to monitor and manage endpoint detection and response applications on all Company devices, including workstations, laptops and servers.

companyName: Sterling Bancorp, Inc.


text: We have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Cyber-attacks or other failures in our telecommunications or information technology systems, or those of our collaborators, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations."

companyName: Galaxy Gaming, Inc.

ticker: GLXZ


text: Internally, we have a security awareness training platform which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness training platform offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on a periodic basis, and it is supplemented by testing initiatives, including periodic phishing tests.

companyName: Summit Materials, LLC


text: Our CTO, supported by our Vice President of Infrastructure and Security, assumes primary responsibility for assessing and managing material cybersecurity risks. With over 25 years of experience spanning restaurant, retail, and technology brands, our CTO brings a wealth of expertise to the role. Having previously held similar positions leading and overseeing cybersecurity programs at both private and public companies, our CTO is well-equipped to navigate the complex landscape of cybersecurity threats and challenges.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: We believe that Oracle is a target for computer hackers, cyber threats and other bad actors because our products and services store, retrieve, process and manage large amounts of data, including sensitive data. We and our vendors are regularly subject to attempts by third parties to identify and exploit product and service vulnerabilities, penetrate or bypass our security measures and gain unauthorized access to our or our customers', partners' and suppliers' software, hardware and cloud offerings, networks and systems.

companyName: ORACLE CORP

ticker: ORCL


text: As a blank check company, we do not have any operations and our sole business activity has been to search for and consummate a business combination. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, our management team will report to our board of directors and provide updates on our management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Cartica Acquisition Corp

ticker: CRTAF


text: The audit committee receives periodic reports our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also can request access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: We also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate our security posture. We also engage external firms to measure our NIST CSF maturity level.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: We undertake vulnerability, attack, and penetration testing via a third-party audit. As part of our general control practices, we perform a review of service organizational controls reports for in-scope vendors to ensure adherence to generally accepted cybersecurity practices. Any reported weaknesses and associated responses are captured and evaluated for impact, and subsequently provided to our leadership for review and response.

companyName: Centuri Holdings, Inc.

ticker: CTRI