text: The Audit Committee receives a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the Chief Information Security Officer reports to the Audit Committee on various metrics on threat management, incident response and recovery planning, along with industry benchmarks. The Audit Committee reports on these matters to our Board of Directors as needed. In addition, the Chief Information Security Officer periodically presents directly to our Board of Directors on our cybersecurity program.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber threats, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK

secItem: Item 1C


text: Management's Vigilance A Security Council, led by the CISO with representatives from our engineering, corporate IT, security, legal, and internal audit teams, diligently reviews and assesses cybersecurity plans, risks, and incidents on a monthly basis. Any substantial risk incident is escalated to the executive team, disclosure committee, and potentially the full Board, if deemed material. Regular communication between the CISO and the Chief Legal Officer, Chief Financial Officer, and Chief Executive Officer ensures top management is well-informed about NerdWallet's cybersecurity posture and potential risks.

companyName: NERDWALLET, INC.

ticker: NRDS


text: In the last two fiscal years, we have not identified cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business, results of operations, or financial condition. Although we proactively attempt to prevent all threats, we are unable to eliminate all risk from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A. Risk Factors " We rely on information technology systems which are subject to disruption, damage, failure and other risks."

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: Through our IT consulting firm, we employ continuous monitoring mechanisms to detect and respond to cybersecurity threats promptly. Regular reports are generated as needed for management and the board, providing insights into our cybersecurity posture, incidents, and remediation efforts.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: The Company's IT security department, which operates under general oversight of the Company's CIO/CISO, is responsible for day-to-day assessment and management of cybersecurity risks, including efforts to prevent and, if necessary, mitigate the effects of a cybersecurity incident. The Company's CIO/CISO has 25 years of technology and technology leadership experience, including 13 years serving as a CISO in the insurance industry.

companyName: RLI CORP

ticker: RLI


text: The Company recognizes the importance of assessing, identifying, and managing material risks associated with cybersecurity threats (as defined in Item 106(a) of Regulation S-K). These risks include, among others, operational risks, fraud, and violation of privacy. The Company, a shell entity, does not have processes in place since cybersecurity is not a risk to the Company due to the size of the Company, nature of its operations, and the number of transactions during the year. As needed, and in order to keep the Company informed of new and evolving cybersecurity risks, the Company consults with external parties such as information technology experts about risk management and strategy.

companyName: Wright Investors Service Holdings, Inc.

ticker: IWSH


text: Our VP Information Security Officer (VPISO) runs our cybersecurity program. Our VPISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports to our Chief Financial Officer (CFO). Our VPISO and CFO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit Committee or the Board of Directors on our cybersecurity program and our efforts to identify, assess, manage, and mitigate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.

companyName: Performant Healthcare Inc

ticker: PHLT


text: The Company's Information Security Program aligns with Santander's Information Security Framework, as well as US regulatory requirements and industry standards, including the guidelines provided by the FFIEC IT Handbook and the US National Institute of Science and Technology. This program is risk-driven, with documented policies, standards, processes, and procedures to ensure the identification, assessment, and appropriate management of risk. The Company has implemented a multi-layered and integrated defense model built around five security pillars – Identify, Protect, Detect, Respond and Recover, and Foundational – with key controls implemented in each of these pillars. • Identify covers the identification of information security and cybersecurity risk to systems, assets, data, and capabilities consisting of threat intelligence, privacy and regulatory compliance, asset management, risk management, and the business environment. • Protect covers development and implementation of appropriate safeguards to ensure delivery of critical infrastructure services. This pillar supports the ability to limit or contain the impact of a potential cybersecurity event consisting of access management, data security, protective technology, network security, and vulnerability management. • Detect covers the development and implementation of the appropriate activities to identify the occurrence of a cybersecurity event consisting of anomalous activities or events, security continuous monitoring, and vulnerability detection. • Respond and recover covers the development and implementation of the appropriate activities to take action regarding a detected cybersecurity event and to maintain plans for resilience and restore any capabilities or services that were impaired due to a cybersecurity event. • Foundational covers the essential aspects of the information security program consisting of governance, awareness and training, third-party information security, security architecture, change management, strategy and standards, and talent management.

companyName: Santander Holdings USA, Inc.


text: The Board of Directors, through the Audit Committee and Directors' Risk Committee, provides direction and oversight of the Company's risk management system. Our Chief Technology Officer is responsible for managing our information security team, while our Information Security Officer is responsible for maintaining and continuing to develop and implement our cybersecurity program enterprise-wide and assessing and managing risks from cybersecurity threats. Both the Information Security Officer and Chief Technology Officer have extensive experience in the banking industry and in information technology and information security. The Information Security Officer has served in information security roles for twenty-five years and in banking for thirty-five years. The Chief Technology Officer has been with the Company since 2010 and has over twenty years of experience in information technology and cybersecurity within the banking industry.

companyName: First Foundation Inc.

ticker: FFWM


text: The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors. The ISO has over twenty years of professional experience in cybersecurity, vendor management, business continuity, and incident response, and holds multiple relevant professional certifications. The ISO provides periodic updates to the Board of Directors, including a comprehensive annual report. The Information Security, Vendor Management, BCP, and Incident Response Programs are approved by the Board annually.

companyName: ENB Financial Corp

ticker: ENBP


text: We periodically engage third-party security consultants to conduct evaluations of our cybersecurity controls and procedures, including through penetration testing, third-party audits or consulting on best practices to address new challenges. These evaluations include testing the design and operational effectiveness of our cybersecurity controls and procedures. Our internal audit function conducts additional reviews and assessments of our cybersecurity controls and procedures. Certain results of such assessments and reviews are reported to the Audit Committee and the Board of Directors as appropriate. We use the findings from these efforts to improve our practices, procedures, and technologies.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of our Cybersecurity Management, including our CISO, CTO and our Head of IT Infrastructure.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Our management team, including our Chief Executive Officer and Chief Financial Officer, whom are supported by our information technology consultant, are responsible for assessing and managing our material risks from cybersecurity threats. This team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel. Our management team members have relevant experience in risk assessment and management, and our information technology consultant has over 25 years of IT and Cybersecurity experience.

companyName: CHARLES & COLVARD LTD


text: In accordance with our cybersecurity policy, we have established a continuous monitoring strategy and program which includes: • Defined security metrics to be monitored; • Performance of security control assessments on an ongoing basis; • Engaging third party security consultants to, among other things, conduct a review of our cybersecurity program which is overseen by the FRS Committee for identifying any cybersecurity threats; • Addressing results of analysis and reporting security status to the executive team; • Monitoring information systems to detect attacks and indicators of potential attacks; and • Identification of unauthorized use of information system resources.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: The Company has no employees and is externally managed by our Manager, which is a wholly owned subsidiary of Bimini. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: In 2023, we did not experience any material information security breach or incident. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats, see Item 1A. "Risk Factors—Failure to effectively utilize information technology systems or implement new technologies and the unauthorized disclosure of personal or sensitive data or confidential information, whether through a breach of our computer system or otherwise, could severely disrupt our business or reduce our sales or profitability" and "Compromises, interruptions or shutdowns of our information technology systems, including those managed by third parties, whether intentional or inadvertent, could lead to delays in our business operations and, if significant or extreme, affect our results of operations."

companyName: Shoals Technologies Group, Inc.

ticker: SHLS


text: In addition, we operate an enterprise risk management ("ERM") program to identify, evaluate and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with our broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard our operations, financial condition and reputation in an ever-evolving threat landscape. Cybersecurity risks are further considered and evaluated as part of an annual risk assessment performed independently by our internal audit department.

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: Our enterprise information security program is designed to detect, manage, mitigate, and respond to cybersecurity threats and is integrated into our overall risk management systems. The Company's Chief Information Security Officer ("CISO"), in concert with a Data Security Committee, is responsible for developing and implementing our enterprise information security program and reporting cybersecurity matters to senior management. T he company's enterprise information security program adheres to the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and other relevant industry frameworks as necessary.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification. This includes notifying functional areas (such as legal and human resources), senior leadership, and the board as appropriate.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk and reputational risks. We have implemented several cybersecurity processes, technologies and controls to aid in our efforts to assess, identify and manage such material risks.

companyName: Vanda Pharmaceuticals Inc.

ticker: VNDA


text: Monitor Cybersecurity Incidents Our Sr. Director of IT and the IT team are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Sr. Director of IT and the IT team implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our Sr. Director of IT is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Blackstone's CTO, John Stecher, is a Senior Managing Director and head of BXTI. Mr. Stecher is responsible for all aspects of technology across Blackstone. Mr. Stecher also advises Blackstone's investment teams and acts as a resource to Blackstone portfolio companies, and companies externally managed by Blackstone such as BREIT, on technology-related matters. Before joining Blackstone in 2020, Mr. Stecher was a Managing Director and the Chief Technology Officer and Chief Innovation Officer at Barclays. He was also a member of the Barclays Technology Management Committee. Prior to joining Barclays in 2017, Mr. Stecher held a variety of senior management and engineering roles across Goldman Sachs' capital markets and technology divisions. Mr. Stecher received a BS in Computer Science from the University of Wisconsin – Madison and a MS in Computer Science from the University of Minnesota.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: Despite robust security measures, we acknowledge the possibility of cyber threats breaching its defenses. We have developed a cybersecurity incident response plan that provides a documented framework for handling cybersecurity incidents and facilitates coordination across multiple parts of the Company. This includes a structured procedure for incident detection, analysis, containment, and recovery, underscored by the IT Leader for material incident evaluation and communication.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: Board of Directors' Oversight and Management's Role Under the shared services cybersecurity program, Energy Transfer's Chief Information Officer oversees the functions of IT, cybersecurity, infrastructure and IT governance (including the Energy Transfer IT team) and has more than 35 years of experience leading business technology functions. The members of the Energy Transfer IT team have over 50 years of combined experience in the field of IT, including 20 years dedicated to cybersecurity, and hold various certifications, including Global Industrial Cyber Security Professional (GICSP), Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH) certifications. Our internal cybersecurity program is led by USAC's IT department. The members of our IT leadership team have an average of over 25 years of experience in IT operations and over 10 years of experience in IT security, including cybersecurity risk identification and mitigation.

companyName: USA Compression Partners, LP

ticker: USAC


text: We have an Enterprise Risk Council made up of leaders from our principal functional areas and business units that meets on a quarterly basis to update our enterprise risk framework used to identify and manage our key risks, including cybersecurity. Cybersecurity is a standing item on our Enterprise Risk Council agenda and our cybersecurity team regularly presents its work to the Enterprise Risk Council to enable evolving risks to be integrated into our management processes. All cybersecurity processes and frameworks are created by the Global Information Security team, led by our CISO. Our CISO has a Systems Engineer degree in Computer Science from St. Petersburg University of Information Technology and gained experience in the manufacturing, consultancy, and energy industries prior to joining the Company in 2012. Our CISO is a Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Information Technology Infrastructure Library (ITIL) v3 Expert, and Certified in Risk and Information Systems Control (CRISC).

companyName: IQVIA HOLDINGS INC.

ticker: IQV


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the CFO, the Chief Operating Officer (COO) and the IT Director having over 30 years of information security experience. The CFO and COO each have over ten years of experience in roles with responsibility for overseeing information technology and security functions.

companyName: IN8BIO, INC.

ticker: INAB


text: Cybersecurity is an important element of the Company's overall enterprise risk management program. The Company has a multilayered system for assessing, identifying, and managing cybersecurity risks, designed to help protect the Company's information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while helping to support business resiliency and seeking to protect employee, guest, and franchisee information from unauthorized access or attack, as well as seeking to secure the Company's networks, systems, devices, products, and services. Cybersecurity is incorporated into the Company's enterprise risk management program through membership within and regular reporting to the Compliance and Enterprise Risk Management Committee.

companyName: CHOICE HOTELS INTERNATIONAL INC /DE

ticker: CHH


text: The Company's information security team, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CISO reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer, Chief Operating Officer, and Chief Accounting Officer are responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from the CISO and Chief Information Officer. The CISO together with the Chief Information Officer regularly report on the status of projects to strengthen the security of our information technology systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: To support current needs and future growth, w e use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects, including those for cybersecurity, are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our Information Technology department and third-party providers work with our senior leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Our senior leadership team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of our Board of Directors, or Audit Committee, which evaluates our overall enterprise risk.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: We have controls specifically focused on E-mail phishing including impersonation attempts. Although our automated controls prevent most phishing attempts, some can be delivered to employees. To mitigate this risk, we provide training to employees using various methods including E-mail phishing campaigns which send phishing-style E-mails, monitors user responses and automatically assigns further training as appropriate. Employees have been trained to send any suspicious activity to a central IT Service Desk for evaluation and appropriate timely action.

companyName: FRIEDMAN INDUSTRIES INC

ticker: FRD


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management process and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards and best practices. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Senior IT leadership at our consolidated subsidiaries/affiliates communicate information regarding cybersecurity risks to Company personnel through a variety of channels, including discussions between or among subsidiary/affiliate management and the Company, reports made to subsidiary/affiliate boards and direct updates to the Company's senior management and/or IT Steering Committee.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, like other companies, we and our third-party vendors have on occasion experienced, and will continue to experience, threats to our or their data and systems.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Our information security function, which is led by our Vice President of Information Technology, or VP of IT, helps identify, assess and manage our cybersecurity threats and risks. The information security function identifies and assesses cybersecurity threats and risks by monitoring and evaluating our threat environment and our risk profile using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats, evaluating threats reported to us, internal and external audits, leveraging third party threat assessments, conducting vulnerability identification assessments, and leveraging external threat intelligence.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: Processes for Assessing, Identifying, and Managing Cybersecurity Risks At an operating level, our cybersecurity program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO and CISO have over 45 combined years of information technology and cybersecurity experience with skills sets that span architecture and design, risk assessment, incident and remediation management, department development, companywide training, and the creation and implementation of cybersecurity compliance programs that address administrative, physical, and technical safeguards.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of our legal team depending on the circumstances. Our information technology team works with our incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.

companyName: Taysha Gene Therapies, Inc.

ticker: TSHA


text: Our management plays a pivotal role in assessing and managing material risks from cybersecurity threats. Our management has implemented a broad and continuous process for cyber event monitoring, analysis of emerging threats, and the development and implementation of risk mitigation strategies. Led by our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO"), we implement cybersecurity policies, procedures and strategies, including employee training programs, security assessments and attack detection alerts designed to address the constantly evolving threat landscape. Our CTO has over 20 years of technology experience, including roles at Amazon Web Services, Dell EMC, and Ball Aerospace. Our CISO has over 30 years of cybersecurity and IT leadership experience.

companyName: NU SKIN ENTERPRISES, INC.

ticker: NUS


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our IT Systems and Confidential Information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • designing products and services with cybersecurity in mind; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our IT Systems, information, products, services, or our broader enterprise IT environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Shift4 Payments, Inc.

ticker: FOUR


text: During the period covered by this report, risks from cybersecurity incidents or threats did not have a material impact on the Bank's strategy, results of operations, or financial condition. The Bank has experienced minor cybersecurity incidents and threats in the past, none of which have had a material effect on the Bank's financial condition or results of operations. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significant adverse impact to the Bank, the Bank's members, and their customers. The Bank is prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, the Bank's ability to continue to service the Bank's members and protect the privacy of their data entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.

companyName: Federal Home Loan Bank of Atlanta


text: The AGM Board of Directors' oversight of Apollo's cybersecurity risk management is supported by the audit committee of the AGM Board of Directors (the " AGM audit committee "), the AAM Global Risk Committee (" AGRC "), the Operational Risk Forum (the " ORF "), the Cybersecurity Working Group and management. The AGM Board of Directors, the AGM audit committee, the AGRC, the ORF and the Cyber Security Working Group receive regular updates on Apollo's information technology, cybersecurity risk profile and strategy, and risk mitigation plans from Apollo's risk management professionals, AGM's Chief Security Officer (" CSO "), its CISO, and other members of Apollo's management and relevant management committees and working groups. The Cyber Security Working Group is chaired by the CISO and has representation from Apollo's Technology, Legal, Compliance, and ERM teams. The group meets at least once a quarter to discuss cybersecurity and risk mitigation activities, among other topics. The CISO regularly reports to the ORF regarding cyber risk, and the ORF in turn reports to the AGRC on a quarterly basis, noting any cyber updates when necessary or appropriate. In turn, AGM's board of directors and/or the AGM audit committee receive quarterly risk updates from risk management professionals, as well as at least annual updates on cyber risk specifically. The full AGM Board of Directors or the AGM audit committee receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, as well as from Athene's CISO, at least annually.

companyName: Apollo Infrastructure Co LLC


text: Our employees, including part-time and temporary employees, undertake an annual cybersecurity training program, which is augmented by additional training and communications on information security and data privacy matters throughout the year.

companyName: MCCORMICK & CO INC

ticker: MKC


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process to oversee critical service providers, suppliers, and vendors.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: We use third-party service providers to perform a variety of functions throughout our business, such as conducting nonclinical and clinical trials; supply and quality testing; development and manufacturing; and professional services firms, including legal counsel. Additionally, we rely on third-party service providers and technologies to operate critical business systems to process sensitive data in a variety of contexts, including, without limitation, cloud-based infrastructure, encryption and authentication technology for certain environments and systems, employee email, and content delivery. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, which may include reputational due diligence and vendor risk evaluations.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our Manager's cybersecurity processes and practices are integrated into the Company's risk management and oversight program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. The Company has adopted a cybersecurity incident response plan to enable rapid response, curtail further security breaches, mitigate and manage costs, and facilitate timely disclosure of material cyber incidents as required by the SEC.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Fortress has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Fortress's cybersecurity program is managed by Fortress's Chief Information Security Officer and Fortress's Chief Technology Officer (together, "Fortress IT Management"), who report to Fortress's Chief Financial Officer. Fortress IT Management and their team are responsible for implementing Fortress's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.

companyName: Fortress Net Lease REIT


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our external Information Technology team, an Information Technology council composed of various management and senior level employees, and the General Counsel. Such individuals have collectively over 10 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as several relevant degrees. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: We have a cybersecurity training program that covers a variety of topics designed to educate our employees about the importance of cybersecurity awareness, highlight typical cybersecurity-related risks and issues (such as phishing attacks and other methods used to attempt to infiltrate our systems) and test that awareness using knowledge assessments and simulations. The training is administered to employees on a rolling basis, and we use a third-party provider for the content and periodically update the training to incorporate new cybersecurity-related developments.

companyName: CTS CORP

ticker: CTS


text: When a cybersecurity incident occurs, whether detected internally or from third-party cybersecurity incidents, we evaluate the incident for criticality across a range of contributing indicators, including service availability, impact to operations, reputational impact, regulatory and legal considerations, data sensitivity and direct financial impact. The potential impact of the incident, individually or in aggregate, is evaluated by the Chief Security Officer, or CSO, continuously across these criteria. We have escalation procedures to notify members of senior and executive management, the Board (or an applicable subset) and regulators in a timely manner based on the criticality of the cybersecurity incident. S&T also has in place incident response and business continuity plans. The Incident Response Program outlines the policies, procedures and technical measures for identifying an incident, assessing its nature and scope, minimizing and containing the impact, investigating the root cause and reporting, as applicable. S&T uses data from incidents to reassess risk, evaluate and implement any additional controls deemed necessary and measure the success of the incident response team. The Incident Response Program also includes staff training, annual updates and testing. The Business Continuity Plan defines the policies, procedures and technical measures to restore systems and critical operations. S&T also maintains business continuity plans for critical systems and applications managed or hosted by third-party vendors.

companyName: S&T BANCORP INC

ticker: STBA


text: During the year ended June 29, 2024, the company has not identified risks from cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably anticipated to materially affect the company, including its business strategy, results of operations, or financial condition. Nevertheless, the company recognizes cybersecurity threats are ongoing and evolving and has seen an increase in cyberattack volume, frequency and sophistication. We are committed to supporting the governance and oversight of cybersecurity risks and to implementing mechanisms, controls, technologies, and processes designed to help the company assess, identify, and manage these risks. For more information on the company's cybersecurity risks, refer to Item 1A, "Risk Factors."

companyName: SYSCO CORP

ticker: SYY


text: Third Party Security Experts We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

companyName: Baker Hughes Co

ticker: BKR


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Aimco OP L.P.


text: Senior security leadership meets regularly with the company's risk-management team and internal and external auditors to evaluate the effectiveness of the company's systems, controls, and management processes with respect to cybersecurity risks. The company also engages third-party cybersecurity experts to assess its processes and suggest improvements, which are reviewed with the company's executive leadership.

companyName: ARROW ELECTRONICS, INC.

ticker: ARW


text: The Company's information security group monitors the Company's information systems to prevent, detect, mitigate, and remediate cybersecurity incidents. The Company uses tools and techniques to continually assess and monitor, manage and mitigate cybersecurity threats to its IT systems in a manner consistent with industry practice. The Company engages with key vendors, industry participants, and intelligence and law enforcement communities as part of its continuing efforts to obtain current threat intelligence, collaborate on security enhancements, and evaluate and improve the effectiveness of its information security program. As part of this program, the Company conducts periodic tabletop and red-teaming exercises to assess its cybersecurity incident response processes and defenses. The Company also maintains vendor management diligence and oversight processes to identify and monitor potential risks from cybersecurity threats attendant to its use of third-party service providers. Additionally, the Company monitors cybersecurity threat intelligence received from key third-party service providers associated with the Company.

companyName: Merck & Co., Inc.

ticker: MRK


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remain. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. No security measure is infallible. See "Risk Factors" in Part I—Item 1A of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: The Board provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risks and assists the Board of Directors in fulfilling its oversight responsibilities regarding Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.

companyName: IRADIMED CORP

ticker: IRMD


text: Securing the Company's IT systems is integral and foundational to its everyday operations. The mission of the Company's cybersecurity team is to focus on defining and deploying its information security strategy, sustaining a robust employee cyber awareness and training program, executing security engineering, providing continuous monitoring of its operations, responding and coordinating the response and investigation of cyber incidents, building and testing its disaster recovery plans in support of its businesses' continuity plan requirements, and developing its cyber and information security policies. The Company employs a dedicated cybersecurity team led by its head of information and cybersecurity who reports directly to the Company's Chief Digital Information Officer. Combined, the Company's cybersecurity team has nearly four decades of security and technology operations expertise along with numerous security certifications.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: Our chief financial officer has primary responsibility for assessing, monitoring, managing cybersecurity risks and updating the Board of Directors on any significant risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

companyName: Pharma-Bio Serv, Inc.

ticker: PBSV


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes real-time Company endpoint scanning, detection, prevention, and remediation; regular audits; threat assessments; and consultation on security enhancements.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: The IT Team manages day-to-day cybersecurity risks under the oversight of our Chief Information Officer ("CIO"), who is actively engaged in strategic planning, security assessments, and mitigation efforts. Our CIO has 10+ years of experience overseeing security practices at various multi-national restaurant concepts. Our CIO and Chief Financial Officer discuss IT matters on a routine basis, and as noted above, periodic reviews are conducted with the executive management team and the Audit Committee.

companyName: Portillo's Inc.

ticker: PTLO


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. As outlined in its committee charter, the Cybersecurity Risk Management Committee of the Board ("Cybersecurity Risk Committee") assists the Board in fulfilling its oversight responsibility. Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer ("COO"), who reports directly to our Chief Executive Officer ("CEO"). Mr. Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company. Mr. Adams previously served as Zoom's Chief Counsel to the COO and CISO.

companyName: Zoom Communications, Inc.

ticker: ZM


text: Our Board, in coordination with the Audit Committee, oversees our cybersecurity program, including the management of risks from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks from our Chief Information Officer ("CIO"), which address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), and information security considerations arising with respect to our peers and third parties. On a regular basis, our Audit Committee discusses our approach to cybersecurity risk management with our CIO, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. The Board receives occasional updates from the Audit Committee and CIO on the effectiveness of our cybersecurity program. When appropriate, the Board also receives reports concerning the detection, mitigation and remediation of cybersecurity threats and incidents Our CIO has over 25 years of software engineering experience including over ten years of being responsible for MarketWise's cybersecurity. In coordination with our executive team, our CIO and our Senior Vice President of IT Operations work collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. Our CIO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board.

companyName: MARKETWISE, INC.

ticker: MKTW


text: Throughout the year, the Board and the relevant Board committees receive updates from management with respect to various enterprise risk management issues and dedicate a portion of their meetings to reviewing and discussing specific risk topics in greater detail, including risks related to cybersecurity and climate change, to, among other things, assist in identifying the principal risks facing our company, identifying and evaluating policies and practices that promote a culture designed to appropriately balance risk and reward, and evaluating risk management practices.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process, including processes related to cybersecurity risks.

companyName: BALL Corp

ticker: BALL


text: The Board of Directors and management are committed to enhancing our cybersecurity risk management measures, which are integrated into our enterprise risk management processes and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our IT systems. Our CISO has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: We implement a rigorous process for vetting and securing our relationships with third-party vendors. This includes security assessments and contractual agreements outlining specific security measures they must adhere to.

companyName: Mega Matrix Corp.


text: Cybersecurity Incidents In the event of a cybersecurity incident, our response and mitigation efforts are guided by the IRP, which provides guidance on how to respond to, and recover from, a significant cyber incident requiring an organized response. We continue to conduct tabletop exercises testing the principles and procedures set forth in our IRP based on lessons learned.

companyName: Sensata Technologies Holding plc

ticker: ST


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee holds periodic discussions with management regarding the Company's guidelines and policies with respect to cybersecurity risks and receives regular reports regarding such risks and the steps management has taken to monitor and control any exposure resulting from such risks. Our CISO also leads an annual review and discussion with the full Board of Directors dedicated to the Company's cyber risks, threats, and protections and provides updates throughout the year, as warranted.

companyName: Primo Brands Corp

ticker: PRMB


text: This information security program is a key part of our overall risk management system, which is administered by our Information Security Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: Assessment, Identification and Management of Material Risks from Cybersecurity We rely on the cybersecurity strategy and policies implemented by Sculptor, our sponsor and an affiliate of the Adviser. Sculptor's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Sculptor's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Sculptor has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors, and other third parties who entrust us with their sensitive information.

companyName: Sculptor Diversified Real Estate Income Trust, Inc.


text: Due to our structure as a REIT, the cybersecurity program, processes, and strategy described in this section are limited to the corporate systems, service providers, and information services belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: We use third-party service providers to perform a variety of functions throughout our business, application providers, hosting providers, supply chain resources and data back-up service providers. We have a vendor management program designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Components of the vendor risk management program include, for example, conducting risk assessments for certain vendors, reviewing certain vendors' written security programs, reviewing security assessments and responses to security questionnaires, auditing of certain vendors, vulnerability scans related to vendors, and the imposition of certain contractual information security obligations for certain vendors.

companyName: STARZ ENTERTAINMENT CORP /CN/

ticker: STRZ


text: At least annually, we conduct tabletop exercises to simulate various attacks, enhancing our preparedness against potential threats. These tabletop exercises are conducted with the support of third-party cybersecurity experts. We perform continuous monitoring and detection of our systems, networks, and data repositories for suspicious activities by leveraging a third-party that provides 24x7 comprehensive monitoring of activity that is outside the normal patterns for our day-to-day operations. Our information security team works to stay up to date on threat intelligence through partnerships with outside agencies. We accumulate security event data into our security information and event management, or SIEM, tool that tracks and monitors events providing a comprehensive view of how to respond to various threats.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Risk Assessment and Safeguards. We conduct regular assessments of risks and vulnerabilities to the confidentiality, integrity, and availability of data in our systems, and we implement safeguards to reduce these risks and vulnerabilities to a reasonable and appropriate level. For internal information systems and assets, we conduct regular internal reviews, employ continuous security monitoring, and conduct periodic independent reviews of the key components of our security program. For customer-facing products and services, in addition to internal reviews and testing, we undergo external reviews and penetration testing using an independent third party provider. Our cloud platforms for SaaS solutions are audited annually by external independent auditors who review our platforms against the Service Organization Controls ("SOC") 2 and ISO 27001, 27017 and 27018 standards, and some of our Digital Agreement products are available on a FedRAMP compliant platform. Some of our products are certified under specific technical standards or industry guidelines, such as FIPS 140-2 and FIDO. Our Digipass authentication fulfillment services are also audited annually by external independent auditors against the SOC 2 standard. We conduct self-assessment activities for those standards or regulations that are not covered by the external auditors, such as the General Data Protection Regulation in Europe. Additionally, we periodically engage third party consultants to assist with identifying, assessing, and/or managing cybersecurity threats.

companyName: OneSpan Inc.

ticker: OSPN


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures, and we perform risk assessments of vendors, including their ability to protect data from unauthorized access.

companyName: Gogo Inc.

ticker: GOGO


text: Material findings are reported to the Operations & Strategy Committee. A report of these vendors also is provided to the Risk Committee of the board of directors, which provides updates to the full board of directors.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Overall, we believe that we have established a robust framework for confidentiality, integrity, and availability of information, adhering to relevant security standards, practices, and compliance requirements. In addition, we maintain insurance to help protect against risks associated with cybersecurity threats. As of the date of this report, we do not believe that any risks from cybersecurity threats have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1.A – Risk Factors – Risks Related to Our Business Operations – If our internal company cyber-security measures are breached or fail and unauthorized access is obtained to our IT environment, we may incur significant losses of data, which we may not be able to recover and may experience a delay in our ability to conduct our day-to-day business" in this Annual Report.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: The Company's information security and cybersecurity program is managed by a dedicated CIO, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CIO has more than 25 years of experience in privately held and publicly traded companies and has an established track record of developing and overseeing cybersecurity programs. Additionally, our CIO holds a Bachelor of Science in Computer Science, a Master of Science in Information Technology, and specializations in AI Product Management and Machine Learning Operations. Our CIO provides periodic reports to our Board and Audit Committee as well as our Chief Financial Officer and other members of our senior management as appropriate. We have also established cross-functional teams to collaborate and communicate on cybersecurity-related issues. The reports to management include updates on the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, and the emerging threat landscape. Specifically, our management-driven ERM Committee and Incident Response team include executives from key departments across the Company and each work collaboratively to ensure periodic reviews and assessments of the Company's security environment are being observed.

companyName: Janus International Group, Inc.

ticker: JBI


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our customers and employees ("Information Systems and Data").

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: Our Nominating / Corporate Governance Committee has oversight of our cybersecurity risk management program and reports to our board of directors on cybersecurity matters.

companyName: Travere Therapeutics, Inc.

ticker: TVTX


text: The audit and risk committee receives periodic reports and briefings from management on our cybersecurity risks. In addition, management updates the audit and risk committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The audit and risk committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Mereo BioPharma Group plc

ticker: MREO


text: No material cybersecurity incidents were identified as of filing date. We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Quantum Genesis AI Corp.

ticker: QTZM


text: For additional information concerning cybersecurity risks we face, see "General Risk Factors — Information system failures, cyber incidents or breaches in security could adversely affect us" in Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K.

companyName: LGI Homes, Inc.

ticker: LGIH


text: During 2024, FMC did not directly experience a cybersecurity breach in any FMC system. During 2024, we did receive notification of cybersecurity breaches affecting third-party vendors, but none were material in nature for FMC.

companyName: FMC CORP

ticker: FMC


text: As of the filing of this Form 10-K, we are not aware of any cyber attacks that have occurred since the beginning of 2023 that have materially affected, or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We describe whether any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "The Company's business could suffer if information technology systems are disrupted, cease to operate effectively or become subject to a cybersecurity breach" included within our risk factor disclosures in Item 1A. Risk Factors of this Annual Report on Form 10-K, which information is incorporated herein by reference.

companyName: Hamilton Beach Brands Holding Co

ticker: HBB


text: We conduct risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments are designed to identify reasonably foreseeable internal and external material cybersecurity risks to our critical systems, information, products, services, and our broader Company-wide IT environment, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Risk assessments take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants as needed. The results of our assessments are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that is then periodically reported to our Board and Audit Committee. Safeguards: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.

companyName: BTCS Inc.

ticker: BTCS


text: Since our commencement of operations, we have not experienced a material cybersecurity incident and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition.

companyName: Crescent Capital BDC, Inc.

ticker: CCAP


text: The Company maintains a robust cybersecurity infrastructure to safeguard our operations, networks and data through comprehensive security measures including our technology tools, internal management and external service providers.

companyName: Primo Water Corp /CN/


text: Our Chief Information Security Officer, or CISO, who has decades of experience in similar roles in the technology industry, leads and oversees our information security program, including our cybersecurity policies and information security team. This team is responsible for implementing processes designed to identify and protect company assets through prevention and detection controls. Through our cybersecurity program, we have developed prevention, response and recovery processes and procedures designed to address potential adverse impacts to our company should a cyber event or incident occur. We have implemented security and awareness training which is required for all employees during onboarding and annually thereafter, and we conduct regular phishing simulations.

companyName: Toast, Inc.

ticker: TOST


text: Our CISO and Vice President of IT are primarily responsible for assessing and managing risks from cybersecurity threats to the Company. The CISO and Vice President of IT make regular reports to senior management regarding the cybersecurity program. We also have a notification process for appropriate escalation of cyber incidents by members of our internal cybersecurity team to senior management as appropriate, including our Chief Executive Officer, Chief Financial Officer, Chief Accounting Officer, and/or General Counsel, as well as to the Audit Committee. The senior management team, including the CISO and Vice President of IT, provides quarterly data protection and cybersecurity reports to the Audit Committee, as well as periodic reports to the full Board of Directors, which include information about cyber risk management, the cybersecurity risk environment, and the status of ongoing efforts to strengthen cybersecurity effectiveness.

companyName: Woodward, Inc.

ticker: WWD


text: As part of its oversight responsibilities, which include the identification of the principal risks of the business and ensuring the implementation of appropriate systems to manage such risks, the Board devotes significant time and attention to information security and risk management, including cybersecurity, and regulatory compliance, supported by the Audit Committee.

companyName: CELESTICA INC

ticker: CLS


text: Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to our chief executive officer, who would be responsible, along with third parties including our IT consultants, for assessing the materiality of, and mitigating and remediating, any cybersecurity incidents of which we are notified. In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third-party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third-party service provider or that otherwise impacts third-party technology and systems we use.

companyName: UNION PACIFIC CORP

ticker: UNP


text: In 2024 and 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. In June 2022, ETI experienced a previously disclosed network security incident which had material adverse impact and required ETI to, among other things, limit access to its applications and services by its employees and customers. In response, ETI incurred considerable costs to restore the security of its internal systems and networks and adopted various enhancements. If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results or financial condition. Please refer to " Item 1A. Risk Factors " for further information about the material risks associated with various cybersecurity threats.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Impacts of Cybersecurity Incidents To date, the Company has not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" in this document for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: As of the date of this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: To date, cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect the Company. Refer to "Our operations could be disrupted if our information systems fail or are not upgraded or are subject to cyber-attacks" in Part I, Item 1A of this report for additional information on risks from cybersecurity threats.

companyName: Endo International plc


text: The Company's third-party risk management program is designed to oversee and identify the cybersecurity threats associated with the use of third-party service providers. While the optics into a third-party's operation are limited, the Company performs risk-based evaluations of third-party service providers. These evaluations include reviewing information including, but not limited to, security assessment questionnaires, security testing summaries, audit reports performed under the SSAE 18 Audit Standard, and information security policies.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Interruptions in or other compromises of our information technology systems or data or that of third parties upon whom we rely could adversely affect our business."

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments and annual penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.

companyName: Rapid7, Inc.

ticker: RPD


text: Monitoring and detection processes and procedures have been implemented to help identify cybersecurity incidents. In the event of an incident, we intend to follow protocols associated with incident detection, mitigation, recovery and notification, including notifying senior leadership and the Board, as appropriate. awareness training has been implemented for all employees whereby training is conducted at least on an annual basis.

companyName: Prairie Operating Co.

ticker: PROP


text: The audit committee and board of directors actively participate in discussions regarding cybersecurity risk exposures and steps taken by management to monitor and mitigate such risks, further to their responsibility to manage, oversee and remain informed about the most significant risks to Company and align our risk exposure with our strategic and business objectives. At least annually, the audit committee reviews with our CTO the Company's cybersecurity program, including the robustness and efficacy of the Company's overall cybersecurity program, steps taken to enhance defenses and security measures in place and our established plans to identify, detect and respond to threats we may encounter. The audit committee also annually reviews and discusses with management the ERM process and annual risk assessment, as well as the Company's cyber insurance coverage and annual SOC-1 report provided by an independent services firm. More frequently, the audit committee and board of directors receive reports and communications from our CTO and our Chief Operating Officer regarding material risks and specific developments related to the changing cybersecurity landscape and the Company's operating, technology and control environment. Such reports may cover topics such as: recent investments made in our cyber infrastructure; the undertaking of new technology projects and initiatives; vulnerability assessments and key findings from external cyber experts retained by the Company; the impact of new cybersecurity-related rules and regulations; changes in the threat environment including new and emergent risks; and evolving information security standards and market practices including with respect to peers and third parties.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: We rely on our technology infrastructure and information systems for our internal communications, controls, reporting and relations with customers and suppliers, to utilize our data, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third -party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: For information on the Company's cybersecurity-related risks, see "Information Systems, Cybersecurity and Data Privacy Risks" in Item 1A. Risk Factors in this Form 10-K. While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We maintain relevant expertise within the Company's management team to manage cybersecurity risks. At the management level, the Chief Information Officer and Information Security Officer receive regular reports from the Company's systems department, both historical and real-time, about the Company's cybersecurity status. The Company has established written policies and procedures to ensure that significant cybersecurity incidents are immediately investigated, addressed through the coordination of various internal departments, and publicly reported (to the extent required by applicable law). If management determines a material cybersecurity incident has occurred, the Company's policies require management to promptly inform the Audit Committee with follow-up information to the full Board of Directors.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur. We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders. Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident. Periodic tabletop and crisis simulation exercises are conducted to reinforce our incident response controls on an ongoing basis.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee. The Audit Committee holds a special in-person meeting, typically in the fourth quarter, to review the Company's cybersecurity as well as the overall IT structure and planned changes with the Company's Chief Information Officer (CIO) and provides an update to the Board from that meeting. The Company's CIO also meets directly with the full Board of Directors, typically in the second quarter. At this meeting, the CIO reports and discusses relevant current and new IT risks and the general health and maturity of our overall IT risk management program. Other updates are provided throughout the year to the Audit Committee and the Board, as needed. In the event a cybersecurity incident is determined to be significant, a formal meeting of the full Board of Directors is convened.

companyName: HUNT J B TRANSPORT SERVICES INC

ticker: JBHT


text: Our cybersecurity program, a pivotal component of our overarching ERM framework, concentrates on several key areas:

companyName: WIDEPOINT CORP

ticker: WYY


text: The Company's cybersecurity program and policies articulate the expectations and requirements with respect to acceptable use, risk management, data privacy, education and awareness, security incident management and reporting, identity and access management, vendor due diligence, security (with respect to physical assets, products, networks, and systems), security monitoring and vulnerability identification. The cybersecurity program and policies are operated by a dedicated cybersecurity operations team. The program and policies are aligned with the Company's enterprise risk management program.

companyName: Veralto Corp

ticker: VLTO


text: We aim to deploy a cyber-risk management program which is intended to assist in assessing, identifying, and managing material risks from cybersecurity threats to our data and information systems. The Company currently manages its cybersecurity risk through a variety of practices that are applicable to all users of our information technology and information assets, including our officers and directors, contractors, and vendors. The Company uses a combination of technology and monitoring to promote security awareness and prevent security incidents, including network and passwords protocols, third party firewalls, and antivirus protections. Our Board of Directors performs an annual review of our cybersecurity program, including management's actions to identify and detect threats.

companyName: Eline Entertainment Group, Inc.

ticker: EEGI


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity.

companyName: Tesla, Inc.

ticker: TSLA


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Account are assessed on an ongoing basis, and how such risks could materially affect the Account's business strategy, operational results, and financial condition are regularly evaluated. TIAA maintained appropriate cyber security policies and procedures during the 12-month period covered by this report and there were no material cybersecurity issues that affected the Account. Cybersecurity risk remains heightened to the financial industry, including the Account, and a failure in or breach of our systems or infrastructure, or those of a material third party or service provider, could cause disruption and adversely impact the Account's operations and performance. TIAA continues to invest in its cybersecurity program to protect against emerging threats, including threats against third parties and service providers.

companyName: TIAA REAL ESTATE ACCOUNT


text: Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer ("CISO") who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards. The CISO reports to our Chief Legal Officer, and our Internal Audit Department monitors and reviews our cybersecurity initiatives.

companyName: EZCORP INC

ticker: EZPW


text: The CISO and his leadership team generally meet each business day to discuss security item triage and emerging threats and trends identified by the Threat Intelligence Team. The CISO shares pertinent information from those meetings with the Chief Risk Officer. During a cyber incident, which could involve the Company or a third-party service provider to the Company, the Company's Cyber Security Incident Response Team (CSIRT) leads the response and internal communication. CSIRT manages low and moderate severity incidents, and Enterprise Crisis Management manages high and very high severity incidents. The risk rating of an incident may change throughout the incident investigation period as new information is learned or the environment changes. Depending on severity level, CSIRT or Enterprise Crisis Management distributes incident communications to senior management, including the Chief Executive Officer, Chief Risk Officer, Board of Directors or appropriate Board committee, and if applicable, the Company's regulators.

companyName: US BANCORP \DE\

ticker: USB


text: Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident. This approach involves continuous oversight and improvement based on evolving cyber threats. Materiality also considers both quantitative and qualitative factors in determining impact.

companyName: BED BATH & BEYOND, INC.

ticker: BBBY


text: Network Log Reporting is consolidated and retained in read-only formats with limited access. Logs are gathered from critical systems on the network and consolidated within a security information and event management ("SIEM") solution.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: Our cybersecurity risk management program includes: • risk assessment processes to monitor, evaluate and identify risks to our Information Systems and Data; • a multidisciplinary team, including members from our executive management team, our information security and technology function, and legal team (internal and engaged external experts) to identify, assess, and manage cybersecurity threats and risks; • security tools throughout our IT environment to monitor for and identify cybersecurity risks and incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • technical, physical, and organizational measures, processes, standards, and/or policies to address cybersecurity threats to our Information Systems and Data; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: Security and privacy incident response We maintain an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. We test and evaluate our plans on a regular basis. The CIO/CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.

companyName: PENTAIR plc

ticker: PNR


text: With respect to incident response, we have adopted an Incident Response Playbook that applies in the event of a cybersecurity threat or incident (an "IRP") to provide a standardized framework for responding to security incidents, including malware, hacking, data breach (including third-party data breach), and other types of vulnerabilities. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow. Our incident response process is generally based on the NIST framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services requiring access to secure Company information, and to all devices and network services that are owned or managed by the Company. Our incident response team includes our CISO and the information security team, along with various business units, as applicable, and undergoes periodic training which includes exercises on monitoring and detection tools.

companyName: MAGNITE, INC.

ticker: MGNI


text: Risks from Cybersecurity Threats We have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: NEE's Board of Directors is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity reports from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. The cybersecurity reports to the Board of Directors include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, including cyber defenses, notable incidents and a summary of the annual cyber drill results. Significant active cybersecurity incidents and threats are communicated to the Board of Directors as they occur.

companyName: FLORIDA POWER & LIGHT CO