text: Cyber Risk Management and Strategy In our increasingly interconnected environment, information is inherently exposed to a growing number of risks, threats, and vulnerabilities. As a provider of products and services to financial institutions, Jack Henry integrates industry-standard frameworks, policies, and procedures to securely process and store sensitive information, prioritizing the protection of our associates, clients, and their private data from the ever-evolving cyber threat environment.

companyName: JACK HENRY & ASSOCIATES INC

ticker: JKHY


text: Given our reliance on third-party software, service providers, and applications to support various business functions and security measures, we regularly conduct security audits and vendor management reviews. These processes are intended to ensure that third-party systems and services comply with our cybersecurity program.

companyName: STAR GROUP, L.P.

ticker: SGU

secItem: Item 1C


text: We have purchased cybersecurity insurance, but there are no assurances that the coverage would be adequate in relation to any incurred losses. As of December 31, 2024 we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company. However, we cannot guarantee that we will remain unaffected in the future.

companyName: NBT BANCORP INC

ticker: NBTB


text: Our Incident Response Plan ("IRP") is designed to facilitate rapid incident response to any security incident affecting the Company's business lines, locations, services, and divisions. The IRP defines the roles and responsibilities for the senior leadership team and cybersecurity experts to identify and respond to cybersecurity events and incidents while complying with legal obligations. The Incident Response Team ("IRT") is designated by the IRP to assess each cybersecurity incident and event for impacts to the Company, customers, and third-party partners and oversee the response to and remediation of such incident.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Bank policies and processes are designed such that the board would receive prompt and periodic information from management or the Security Governance Committee on any cybersecurity or information security incident or threat that may pose significant risk to the Bank and would continue to receive regular reports on any incident or threat until its conclusion. The Bank's Enterprise Risk and Operations Committee also receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, or more often, as necessary, the Enterprise Risk and Operations Committee discusses cybersecurity and information security risks with the Bank's chief information officer and chief information security officer.

companyName: Federal Home Loan Bank of Atlanta


text: Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives regular updates from our Chief Technology Officer and other members of management on the cybersecurity risks that they view as most relevant to our business, our cybersecurity strategy and current cybersecurity trends, as well as other updates, as necessary, regarding certain cybersecurity incidents.

companyName: Vivid Seats Inc.

ticker: SEAT


text: The Company's information technology partner has worked in information technology and information security for over 30 years with over 300 employees with six locations in the United States. A virtual Chief Information Officer ("vCIO") from the partner works directly with the Company to align business and technical strategies, decisions, and implementations. The CTO has nearly 20 years of experience in the pharmaceutical and biotech industry managing programs and projects across a variety of implementation methodologies and risk factors and holds undergraduate degrees and certifications in his respective field. The Company's Chief Executive Officer, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 25 years of experience managing risks at similar companies, including risks arising from cybersecurity threats.

companyName: Longeveron Inc.

ticker: LGVN


text: Our cybersecurity policies and processes also include risk-based measures and evaluations of risk related to third parties and, where appropriate, we require third parties to implement and maintain appropriate security measures, consistent with all applicable laws, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: Key elements of our cybersecurity risk management program include, but are not limited to the following: a. Internal and external asset identification, assessment, monitoring, and classification procedures to evaluate cybersecurity risks and inform mitigation efforts;

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around regulatory guidance and related industry standards. In addition, we leverage various cyber-related associations, threat intelligence feeds, and audits to facilitate and promote program effectiveness. The information security program is periodically reviewed by the Information Security Officer in collaboration with information technology management with the goal of addressing changing threats and conditions.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: We rely on our IT infrastructure and information systems to interact with our customers and vendors, operate our drilling rigs, and bill, collect and make payments. Our IT infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies. If our systems, or any of our customers' or vendors' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could subject us to significant liabilities and could have a material adverse effect on our operations, financial condition, business or reputation.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: We mitigate cybersecurity risks (and other material risks) through our enterprise risk management ("ERM") program, which is a company-wide effort, managed by senior executives and overseen by our Audit Committee and Board of Directors to identify, assess, manage, report and monitor material risks that may affect our ability to achieve our business objectives.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Our board of directors has overall oversight responsibility for our risk management, and, following our IPO, delegates cybersecurity risk management oversight to the audit committee. The audit committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The audit committee reports material cybersecurity risks to our full board of directors. Cybersecurity governance is overseen by senior management, which is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs.

companyName: Venture Global, Inc.

ticker: VG


text: Our cybersecurity processes are integrated into our Company's overall risk management processes. Our CTO is a member of our ERM committee and any cybersecurity issues are immediately raised to the committee. In addition, our CTO reports to the audit committee of our board of directors bi-annually, regarding our cybersecurity program and material risks, and once annually to our full board of directors, regarding overall cybersecurity strategy.

companyName: Hamilton Lane INC

ticker: HLNE


text: The IRP is designed to protect and preserve the confidentiality, integrity and continued availability of all confidential information in the care of the Company and the information systems owned or used by the Company, as well as the Company's ability to operate. Our cybersecurity IRP includes controls and procedures for timely and accurate reporting of any cybersecurity incident. In accordance with the plan, material cybersecurity incidents are escalated to the Audit Committee of the Board of Directors. We design and assess our program based on the NIST Cybersecurity Framework.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Management and Strategy have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our Company from cyber threats as well as secure our networks and systems. Such processes include safeguards, response plan, and review of our policies and procedures to identify risks.

companyName: SHARING SERVICES GLOBAL Corp


text: Our information security team has implemented and continues to maintain various technical, physical, and administrative controls as the foundation of our Security Program, which are designed to help us identify, manage, prevent, and mitigate risks from cybersecurity threats, including, but not limited to, incident detection systems and response plans, vulnerability management tools and processes, risk assessments, disaster recovery and business continuity plans, access controls, asset management, logging and monitoring, security awareness training, and third-party risk management programs.

companyName: SPS COMMERCE INC

ticker: SPSC


text: Cybersecurity risks are actively monitored through continuous security assessments, real-time threat intelligence, and adaptive security controls, enable proactive adjustments to our security program as threats evolve. As part of our ongoing cybersecurity risk management program, we have from time-to-time identified risks or threats to our digital and corporate systems, including attempts to obtain team member credentials through bot and phishing attacks or through social engineering. While these risks and threats, as well as others we identify, require active and ongoing efforts to mitigate, we have not currently identified any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Shake Shack Inc.

ticker: SHAK


text: Third-party Risk we are aware of the risks associated with third-party service providers, we implement stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes quarterly assessments by our Chief Executive Officer ("CEO") and on an ongoing basis by our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Clubhouse Media Group, Inc.


text: Cyber Risk Management and Strategy The Company, under the oversight of the Audit Committee of its Board of Directors, has implemented and maintains a cybersecurity risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This program extends to third-party vendors and the various properties under the Company's management, including corporate and commercial properties, through establishing vendor risk requirements and conducting vendor risk assessments.

companyName: MACERICH CO

ticker: MAC


text: Our approach to managing cybersecurity risks (including third-party risk) is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.

companyName: NEWMARKET CORP

ticker: NEU


text: Material Risks & Integrated Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a Company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. The security function housed within our Information Technology department continuously evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs and in cooperation with our broader risk management team.

companyName: Atlas Energy Solutions Inc.

ticker: AESI


text: The Evergy Companies' cybersecurity organization uses the NIST CSF to model the security program. The Evergy Companies have implemented a layered defense model to protect against cyber intrusions and attacks. One layer of defense is Evergy's employees and their abilities to detect and respond to phishing attempts. Evergy conducts annual security awareness training and monthly phishing simulations. Employees that perform poorly in the phishing simulations are subject to additional training and disciplinary action. Other defense layers include firewalls at both the network and application layers, network segmentation, email scanning, multi-factor authentications, cloud security monitoring, in addition to other defensive layers. Several of the Evergy Companies' security tools employ AI and machine learning to enhance their respective capabilities. The Evergy Companies employ security practitioners with cybersecurity and information technology degrees and certifications and with extensive experience, with several holding federal government clearances. The Evergy Companies have a 24-hour Security Operations Center that monitors for security events and the Evergy Companies frequently engage with multiple third parties to analyze network traffic. Further, the Evergy Companies regularly and as needed engage cybersecurity consultants and third parties to assist with the identification, assessment and mitigation of cybersecurity risks and assessment of the Evergy Companies' risk mitigation practices. These services include, but are not limited to, the identification of vulnerabilities, penetration testing and assessment of the cybersecurity program to both validate effectiveness and also identify any areas for improvement.

companyName: Evergy, Inc.

ticker: EVRG


text: Ongoing, annual employee security awareness training; and Cybersecurity insurance coverage to help mitigate the risk of loss from cybersecurity incidents.

companyName: FutureFuel Corp.

ticker: FF


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") 800-53, including derivatives such as NIST Cybersecurity Framework ("CSF") and HITRUST, as well as NIST 800-66 and the Center for Internet Security ("CIS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: The Company engages subject matter experts such as consultants and auditors to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor the Company's systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Cybersecurity Committee oversees and establishes the parameters of the Company's engagement with these experts to ensure the Company obtains the supplemental assistance needed in this area, if any.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Operationally, we, along with CoreSite, each perform periodic penetration testing to identify weaknesses in systems and networks so that they can be addressed appropriately. At least once per year, we also engage an outside cybersecurity firm to perform independent testing. Our vulnerability management program is in place to adequately identify, classify, prioritize and remediate vulnerabilities affecting assets. Our security operations program monitors our systems and networks, and is responsible for investigating, responding to, and reporting any potential security incidents in a timely manner. Our Incident Response Plan includes steps to determine materiality of any such incident and escalate matters to the Board and our employees are regularly trained on the plan. We conduct an incident response exercise at least annually to ensure a timely, consistent and compliant response. In 2023, we performed two separate exercises: (1) a crisis management tabletop exercise that simulated a ransomware incident and included participation from our management, including our CEO and CFO, and (2) an IT-focused tabletop which simulated multiple types of cybersecurity incidents, including (a) compromised credentials, (b) brute force attack, (c) uncleaned malware and (d) ransomware. Both of these tabletop exercises were facilitated by a third-party.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Given the extensive practical experience of implementing our IRP and business continuity plan during the Change Healthcare incident, discussed further below, we did not conduct a separate mock tabletop exercise in 2024. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.

companyName: Encompass Health Corp

ticker: EHC


text: We operate in the medical device industry, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk. We have initiated a risk-based approach designed to identify and assess the cybersecurity threats that could affect our business and information systems. Our strategy is to maintain a high level of risk awareness, identify critical IT assets, regularly update or replace those assets, and systematically perform vulnerability testing, and to promptly remediate deficiencies. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: NeuroMetrix, Inc.


text: Our management team, including our Vice President of Operations & Information Technology and Head of Information Technology, has 18+ years of experience in enterprise risk management, governance, and technical operations, information technology enterprise architecture, and information technology management, and oversees our information security program. In addition, management regularly updates the Audit Committee with respect to cybersecurity risk, also on an ad hoc basis as necessary, regarding any material cybersecurity incidents and any incidents with lesser impact potential. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: At the management level, we and John Deere jointly maintain a dedicated global team of cybersecurity professionals (Cybersecurity Team) led and managed by John Deere's Chief Information Security Officer (CISO). The Cybersecurity Team is responsible for overseeing John Deere's and our cybersecurity program, including the assessment and management of risks. The Cybersecurity Team has members with experience in governance, risk management and compliance, threat monitoring, threat emulation, penetration testing, and cyber incident management. John Deere's CISO holds a degree in Management Information Systems and has been with John Deere for over ten years. He has over two decades of extensive experience in information technology and cybersecurity and reports directly to John Deere's Chief Information Officer.

companyName: DEERE JOHN CAPITAL CORP


text: Our CISO reports directly to our Chief Legal and Administrative Officer and Secretary. The CISO closely monitors our cybersecurity program, including our strategy and cybersecurity policies and practices, against the cybersecurity threat landscape. As described above, our cybersecurity incident response plan provides a framework for a multidisciplinary team to prevent, detect, mitigate, and remediate cybersecurity-related risks and incidents. This framework also sets forth parameters for the escalation and reporting of cybersecurity risks and incidents to broader groups at the Company, and the CISO reports information about significant cybersecurity risks and incidents to the Audit Committee on a regular basis and more frequently if warranted under the circumstances.

companyName: MGM Resorts International

ticker: MGM


text: Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age in the environment. We prioritize the patching of critical and severe vulnerabilities.

companyName: FNB CORP/PA/

ticker: FNB


text: The cybersecurity incident response process is governed by our incident response plan and overseen by leaders from our IT security and legal teams.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board may request follow-up information and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, an incident response plan/policy, a vulnerability management policy, data encryption, network security controls, data segregation, asset management, tracking, and disposal, access controls, systems monitoring, employee training, risk assessments, implementation of security standards/certifications, cyber insurance, and a dedicated cybersecurity staff/officer.

companyName: Turnstone Biologics Corp.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's our risk management processes, including oversight and mitigation of risks from cybersecurity threats. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have not identified risks from known cybersecurity threats, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Artisan Consumer Goods, Inc.

ticker: ARRT


text: The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on the Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors," under the heading "Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures."

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Following these risk assessments, we implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Security Officer and Chief Information Officer, to manage the risk assessment and mitigation process.

companyName: MICRON TECHNOLOGY INC

ticker: MU


text: To date, there have not been any cybersecurity threats or incidents that have materially impacted or are reasonably likely to materially impact our business strategy, results of operations or financial condition. Refer to Item 1A. "Risk Factors" for a discussion of risks related to data security and the associated risks to our business.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: We thoroughly assess potential vendors based on their role and the sensitivity of the IT resources they access. All vendors follow a consistent risk management process, ensuring every vendor meets our high standards. We select vendors who prioritize data protection and comply with relevant privacy regulations. Furthermore, we enforce strict protocols, including limiting access to necessary information, ensuring data usage is confined to agreed-upon purposes, and mandating the deletion or return of data upon service termination. Through these measures, we collaborate with third-party vendors while implementing controls to safeguard our information.

companyName: RALPH LAUREN CORP

ticker: RL


text: We do not reasonably believe there are currently any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company or its business strategy, results of operations or financial condition. For more information on the risks related to our IT systems, see "A significant disruption in, or breach in security of, our IT systems or violation of data privacy laws could adversely affect our business or customers that use our products" under the heading "Risk Factors" in Part I, Item 1A.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: We believe a robust and proactive approach to cybersecurity risks and threats is essential to achieving our strategic business objectives and protecting our business. We may face a wide range of cybersecurity threats, such as ransomware and denial-of- service attacks. Our customers, suppliers and other business partners may also face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these third parties could have a material adverse effect on our business and results of operations. Due to the risks that cybersecurity threats can pose to our business, we intend to continually evaluate best practices and methods, including cyber defense systems and training programs, to protect our business from a wide range of potential threats.

companyName: Modular Medical, Inc.

ticker: MODD


text: In addition, we maintain specific policies and practices governing our third-party security risks, including our third-party assessment (TPA) process. Under our TPA process, we gather information from certain third parties who contract with Meta and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.

companyName: Meta Platforms, Inc.

ticker: META


text: Our team responsible for monitoring and assessing cybersecurity threats, who reports directly to the Chief Executive Officer, manages and monitors our cybersecurity. Our board of directors, as a whole, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks, including cybersecurity risks. The board of directors receives regular updates on cybersecurity and information technology matters and related risk exposures from our executive team.

companyName: GAXOS.AI INC.

ticker: GXAI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents such as phishing attacks and other email compromises, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Smith Douglas Homes Corp.

ticker: SDHC


text: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships. The CISO has over 10 years of industry experience including management of security and vendor relationships as well as possesses several industry certifications, including certification as a Certified Information Systems Security Professional from the International Information System Security Certification Consortium and as a Certified Information Security Manager from the Information Systems Audit and Control Association.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Consistent with our overall ERM policies and practices, our cybersecurity program focuses on the following areas:

companyName: BOYD GAMING CORP

ticker: BYD


text: We believe that the use of external service providers improves our operational capabilities, and we have implemented a vendor qualification and management program that applies to our service providers, including those that handle protected health information, personal information, or other information subject to protection under applicable privacy and data protection regulations. This program is designed to identify, address and seek to mitigate potential cybersecurity and data protection risks that arise from our use of external service providers. While we do not have full visibility into the cybersecurity risk management processes of our vendors, we require new service providers to complete a vendor questionnaire that identifies the vendor's network and user protections, such as the use of multi-factor authentication, and other cybersecurity risk management processes. Vendors that store or access our confidential information are required to certify that their information systems comply with applicable industry guidelines for cybersecurity, backup, and system recovery. We rely on our third-party service providers to provide notification of, and remediate, significant cybersecurity threats and cybersecurity incidents that jeopardize the confidentiality, integrity, or availability of our information.

companyName: Celcuity Inc.

ticker: CELC


text: Board Governance Our full board of directors oversees our risk management including but not limited to IT and cybersecurity policies, procedures, and risk assessments. Our management reports to our board of directors on information security matters on a quarterly basis, or more frequently as needed.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Cyber Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment and mitigation of cybersecurity risks. This process is overseen by the Director of IT Operations and Information Security, or the IT Director, and includes periodic security assessments, audits, and testing, which are informed by industry standards and supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. We periodically engage with third parties to support these efforts. We maintain internal information security policies, including an incident response plan, which are reviewed by or at the direction of the IT Director and are updated periodically to reflect material changes and improvement in our information security practices. We have a process to assess and review the cybersecurity practices of third-party vendors and service providers prior to onboarding and periodically throughout the engagement, including through vendor questionnaires and contractual requirements, as appropriate.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Management is made aware of current and evolving cybersecurity risks through the Cyber SteerCo reporting. Furthermore, in the event of a material or potentially material cybersecurity event, our process as designed is intended to result in senior members of management being promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: Management Oversight The controls and processes employed to assess, identify, and manage material risks from cybersecurity threats are implemented and overseen by our Chief Information Security Officer ("CISO"). Our CISO leverages their over 20 years of experience in cybersecurity, compliance and risk management. Our CISO is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The CISO provides quarterly briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: NEXTNAV INC.

ticker: NN


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards in collaboration with IT and management. Personnel at all levels and departments are made aware of our cybersecurity policies through training.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: The Internal Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment, prioritization, and remediation program. The Internal Cybersecurity Team also performs regular system penetration testing to validate our security controls and assess our infrastructure and applications. All management employees take mandatory security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Security starts for our system at the edge of the network. We then build security deeper into the system resulting in interlocking layers designed to strengthen each other. Our information security management system is based upon industry leading frameworks, including ISO 27001. ISO 27001 specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization's overall business risks. It specifies the requirements for the implementation of security controls customized to the needs of individual organizations and addresses confidentiality, access control, vulnerability, business continuity, and risk assessment.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: Impacts from Cybersecurity Threats As of the date of this Report, though the Company and our service providers have been subject to certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. For additional information about the risks to our business associated with a breach or compromise to our information technology systems, see Item 1A, Risk Factors – System security vulnerabilities, data breaches, and cyber-attacks could compromise proprietary or otherwise sensitive information or disrupt operations, which could adversely affect Perpetua Resources' business, reputation, operations, and stock price.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of the Company's management team responsible for overseeing the Company's cybersecurity risk program, including our Chief Information Officer ("CIO"). These reports and updates may address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Audit Committee periodically reports to the Board on data protection and cybersecurity matters. We also have protocols by which certain cybersecurity incidents are escalated within the Company and, in certain circumstances, reported to the Board and/or Audit Committee in a timely manner.

companyName: ESAB Corp

ticker: ESAB


text: Following these risk assessments, we consider whether and how to adjust our strategies and controls to reduce the potential impact of identified risks. Our management team is responsible for executing risk mitigation plans and monitoring the effectiveness of these measures. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer who reports to our Chief Technology Officer, who in turn reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Yext, Inc.

ticker: YEXT


text: Our business, results of operations, financial condition, or reputation could be materially affected as a result of certain risks from cybersecurity threats, including for example, due to: the cost of and modification of business activities and implementation of security measures; system failure, data loss, fraud or theft; disruptions, including in operations; delays in remediation of high risk or critical vulnerabilities; costs of notices and other disclosures that may be required by applicable data privacy and security obligations; or our inability to recover such costs under insurance policies or contractual rights. See "Risks Related to Our Business" in Item 1A, Risk Factors for more information and a description of the risks from cybersecurity threats that materially affect the Company.

companyName: Dutch Bros Inc.

ticker: BROS


text: The Board is kept informed about cybersecurity issues through a structured and responsive communication process tailored to its needs. This involves updates provided by the Chief Information Security Officer ("CISO") or other members of management during Board and Risk Committee meetings. Additionally, management reports to the Board on significant cyber incidents, emerging threats, and the effectiveness of existing security measures. The communication framework is intended to keep the board informed about cybersecurity matters, allowing them to make informed decisions and provide strategic guidance to fortify the Company's defenses against potential threats.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Old Republic dedicates significant resources across the enterprise to regularly monitor its networks, infrastructure and procedures in an effort to prevent, detect, address and mitigate these risks. The Company's Chief Information Security Officer (CISO) oversees the Company's enterprise cybersecurity strategy while the Company's Chief Executive Officer (CEO) retains primary responsibility for managing enterprise-wide risks, including those related to cybersecurity. The Company's Board of Directors' oversight responsibilities include ascertaining that appropriate policies and practices are in place for managing the identified risks faced by the enterprise, and, as discussed below, the Audit Committee of the Board of Directors has oversight authority over data protection and cybersecurity risk exposure, as well as the Company's practices and protocols for the use of AI. The Company's CISO has more than 27 years of experience in the field of information technology and security, comprised of six years in the U.S. Defense Industry and 21 years in the civilian sector. The CISO has a bachelor's degree in computer studies and is an EC-Council Certified Chief Information Security Officer, a member of ISACA (formerly known as the Information Systems and Audit and Control Association), a member of the Factor Analysis of Information Risk (FAIR) Institute risk management education committee, and holds membership on the governing bodies for the Evanta National CISO community and the Evanta Regional (Dallas, Texas) CISO community.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: The oversight of cybersecurity threats is undertaken by our Chief Financial Officer. Our audit committee is responsible for cybersecurity oversight and monitoring risk. Management informs the audit committee of such risk by committee meetings.

companyName: My Size, Inc.

ticker: MYSZ


text: Our board of directors is responsible for overseeing our risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of our risk management program and our cybersecurity policies, processes, and practices. Our cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into our overall risk management system and processes as part of our IT security incident response plan.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: Risks Associated with Cybersecurity The Company is often targeted in an effort to obtain unauthorized access to its financial records and confidential information, destroy data, disable or degrade service, or sabotage systems. Such attacks may take various forms, including the introduction of computer viruses or malware, ransomware, phishing attacks, cyberattacks, or breaches due to errors or malfeasance by employees, contractors and others who have access to or obtain unauthorized access to the Company's systems and networks. To date, these threats and attacks have not resulted in a material cybersecurity incident. However, a material failure, interruption or security breach could adversely affect the Company's business and operations through financial losses, remediation expenses, reputational damage, as well as exposing the Company to customer dissatisfaction and civil litigation, regulatory fines or penalties or losses not covered by insurance. For more information on risks to the Company from cybersecurity threats, see "Risk Factors – Operational Risks".

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: The Firmwide Technology Risk Committee reviews matters related to the design, development, deployment and use of technology. This committee oversees cybersecurity matters, as well as technology risk management frameworks and methodologies, and monitors their effectiveness. This committee is chaired by the chief technology officer and reports to the Firmwide Operational Risk and Resilience Committee.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: For a discussion regarding risks from cybersecurity threats, see our risk factors, including the risk factors titled "— We have experienced, and may experience security or privacy breaches or other unauthorized or improper access to, use of, disclosure of, alteration of or destruction of our proprietary or confidential data, employee data, or platform user data, which could cause loss of revenue, harm to our brand, business disruption, and significant liabilities", "—Cyberattacks, including computer malware, ransomware, viruses, denial of service attacks, spamming, phishing and social engineering attacks could harm our reputation, business, and operating results", "—We currently are subject to a number of inquiries, investigations, and requests for information from the DOJ, other federal, state and local government agencies and other foreign government agencies, the adverse outcomes of which could harm our business" and "—We face risks related to our collection, use, transfer, disclosure, and other processing of data, which could result in investigations, inquiries, litigation, fines, legislative and regulatory action, and negative press about our privacy and data protection practices" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Uber Technologies, Inc

ticker: UBER


text: We maintain a cross-functional cybersecurity incident response plan with defined roles, responsibilities and reporting protocols. This plan, which we evaluate and test on a regular basis, focuses on responding to and recovering from any significant cybersecurity incident as well as mitigating any impact from such incidents on our business. Generally, when a cybersecurity incident or suspected cybersecurity incident is identified, the SOT would escalate the issue to the ACT for initial analysis and guidance. In the event of a significant cybersecurity incident, the ELT would typically be tasked with preparing an initial response. The ELT, with support from the ACT, would be responsible for determining whether a particular cybersecurity incident (alone or in combination with other factors) triggers any reporting or notification responsibilities under applicable law or regulation or pursuant to any contractual obligation.

companyName: QXO, Inc.

ticker: QXO


text: Although we maintain systems and controls designed to prevent cybersecurity breaches from occurring, and we have processes to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of a breach occurring cannot be eliminated entirely. As we engage in more electronic transactions with service customers and vendors, and rely more on cloud-based information systems, the related security risks will increase, and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Most of our robots leverage on-site servers, which provides greater control over data and reduces reliance on overseas or manufacturer-hosted servers often used by other robotics companies. We believe this approach enhances system security and protects sensitive operational maintain security measures intended to protect against cybersecurity threats; however, no system is entirely free from risk. To date, we have not experienced any material cybersecurity incidents. We monitor applicable U.S. data privacy and cybersecurity standards and will continue to prioritize cybersecurity as a core element of our operations.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: Cybersecurity at our company is overseen by our Board, the Audit Committee and management, as well as through our Enterprise Information Security Policy ("EISP").

companyName: Brookfield Asset Management Ltd.

ticker: BAM


text: See " Risk Factors – Our internal computer systems, or those used by our third-party contractors or consultants, may fail or suffer security breaches, resulting in liability and harm to our reputation, which could negatively affect our business, results of operation and financial condition. We may face liability if we breach our obligations related to the protection, security, nondisclosure of confidential information or disclosure of sensitive data or fail or are perceived to fail to comply with applicable data protection laws and regulations, or consumer protection laws, regulations and standards. "

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: Our CISO, who reports to the CIO, is responsible for hiring appropriate personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: EVERBRIDGE, INC.


text: The Cyber Committee, chaired by the CISO, and whose members include the CTSO and CAO, as well as other members of senior management and the legal team, is responsible for identifying cybersecurity risks and threats, recommending mitigating actions to strengthen cybersecurity resilience, and meeting risk tolerance thresholds established by senior management. The Cyber

companyName: MOODYS CORP /DE/

ticker: MCO


text: Our cybersecurity program includes ongoing vulnerability and risk management processes along with a managed security service provider that utilizes a detection and response solution to provide us with 24/7/365 monitoring and alerting. We have developed an incident response plan that is designed in accordance with the NIST framework to facilitate (1) identification and containment of any cybersecurity incidents; (2) remediation of identified vulnerabilities; (3) mitigation of disruption to critical information systems; and (4) assessment of what occurred, notification of affected individuals as necessary and mitigation of consequences that may arise from any unauthorized access. This plan also identifies and describes the roles and responsibilities of our incident response team, including investigation and escalation as appropriate up to and including our Audit Committee or Board of Directors.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a disaster recover/business continuity plan and information security policy, encrypting certain data, data segmentation, network security controls, access and physical security controls, asset management, tracking and disposal, systems monitoring, employee training, maintaining cyber insurance and using third party threat detection software.

companyName: Kura Oncology, Inc.

ticker: KURA


text: As of December 31, 2024, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a comprehensive cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: Our Chief Financial Officer is primarily responsible to assess and manage our material risks from cybersecurity threats with assistance from third -party service providers.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: Cybersecurity represents an important component of our overall approach to business strategy, risk management and financial oversight. Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees, and is actively involved in oversight of our risk management program. The board of directors performs this oversight function at the full board level, as well as through its standing committees that address risks inherent in their respective areas of oversight. The audit committee is responsible for assisting the board of directors in reviewing and assessing the quality and effectiveness of our cybersecurity policies, practices and procedures protecting our information technology systems, data, products and services across all business functions, and reporting its findings to the board of directors, which has final oversight responsibility over cybersecurity-related matters.

companyName: HUBSPOT INC

ticker: HUBS


text: our Internal Audit Department ("IAD"), which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment; and our Cyber Incident Response Team ("CIRT"), a cross-functional team of subject matter experts from across the Company and certain third-party support providers that we have on retainer.

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: The Company has a cybersecurity risk program that is based on industry standards and best practices managed by a dedicated staff and specialists that support this program. We have implemented a set of system, network and application-level controls to protect our corporate data and systems. These controls are monitored for cybersecurity risk events and incidents on a continuous basis by a dedicated staff of cybersecurity professionals and various third-party providers. These controls are updated as necessary to protect the Company. In addition, the Company also takes a proactive approach by monitoring cyber threat intelligence to stay informed regarding emerging risks. The cybersecurity risk program also utilizes third-party assessors, consultants and auditors to perform various services, such as tabletop exercises and network penetration tests. The Company provides awareness training to its employees to help identify, avoid and mitigate cybersecurity threats. Employees with network access participate quarterly in required training, including spear phishing and other awareness training. The program also has a policy in place to address vendor and third-party risk. Cybersecurity risk is also evaluated during the acquisition process for new products and services.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our chief financial officer and CIO, regularly brief the board of directors on our cybersecurity and information security posture, and our board of directors is apprised of cybersecurity incidents deemed to have a high or critical business impact, even if immaterial to us. The board has delegated some of its primary risk oversight to board committees, including that our audit committee facilitates the board's process of oversight of our overall risk management approach. Our full board retains oversight of cybersecurity because of its importance to us and visibility with our customers.

companyName: VALHI INC /DE/

ticker: VHI


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition. However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors".

companyName: IMAX CORP

ticker: IMAX


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to employees, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that generally aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage these material risks, safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's data, and maintain the trust and confidence of our customers, business partners, and employees.

companyName: Energy Services of America CORP

ticker: ESOA


text: The Company's Information Security and Privacy program and teams are managed by the Vice President, Information Security and Privacy, who reports to the Executive Vice President, Chief Technology, Digital Commerce, and Strategy Officer. The Company's cybersecurity leaders have more than 25 years of relevant experience and multiple professional certifications.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: threat intelligence providers, cybersecurity consultants and software providers, managed cybersecurity service providers, and penetration testing service providers.

companyName: Silence Therapeutics plc

ticker: SLN


text: In the event of an incident, we leverage a multi-layered set of plans that include, Endpoint Detection and Response software, Security Information and Event Management tools for detection, and a Cybersecurity Incident Response Plan and Disaster Recovery Response Plan for recovery. The recovery plans outline the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying designated functional leadership teams, the Disclosure Committee, the General Counsel, other senior leadership, and the Board of Directors, as appropriate. These designated leaders assess various factors, including operational, financial, legal, regulatory, reputational impacts on the Company to determine the materiality of the incident and the appropriate response..

companyName: BROWN FORMAN CORP

ticker: BF-A


text: To proactively manage cybersecurity risk in our organization, our management team has instituted a security policy that is available to all employees.

companyName: Vyome Holdings, Inc

ticker: HIND


text: In the event of a cybersecurity incident, senior management, including our General Counsel, CIO, and Chief Financial Officer ("CFO"), are tasked with assessing the incident. This assessment involves evaluating relevant quantitative and qualitative factors as well as considering SEC guidance. Depending on the assessment results, the cybersecurity event may be escalated to involve our CEO, Board of Directors, and law enforcement. Additionally, the Board of Directors in consultation with senior management will decide, based on the assessment, whether the cybersecurity incident requires disclosure in a filing with the SEC.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: We educate our employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.

companyName: Chemours Co

ticker: CC


text: Cybersecurity is a component of our IT/OT Security Program, which we periodically review and adapt to respond to new and evolving circumstances, cybersecurity threats and regulations. We evaluate security, privacy, and resiliency risks, including those related to cybersecurity, in our overall Enterprise Risk Management (ERM) program's annual risk assessment process. This annual risk assessment process takes into account broader risks based on likelihood, potential consequences, and mitigations, such as operational and economic impact; health, safety and environmental impact; and reputational and financial implications. This risk assessment is discussed with members of the ELT, Audit and Finance Committee (AFC) of the Board of Directors, and Board of Directors on at least an annual basis.

companyName: CONOCOPHILLIPS

ticker: COP


text: Accordingly, we have long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: an in-house team dedicated to information and cybersecurity, responsible for conducting regular evaluations of our information systems, existing controls, vulnerabilities, and potential enhancements; tools for continuous monitoring capable of detecting and aiding in the response to cybersecurity threats in real-time;

companyName: Princeton Bancorp, Inc.

ticker: BPRN


text: The Company engages with external experts and advisors, as needed, to review, enhance, and support our IS Program. For example, third parties may be used to assist in the event of a breach or to mitigate certain threats to Regions' environment. Internally, the Company regularly provides associates with cybersecurity training and education at least annually. To bolster these practices, Regions maintains cybersecurity insurance, which is reviewed annually, to cover potential financial losses from cyber events. In addition, Regions participates in information sharing organizations to gather and share information with peer banks and other financial institutions to better prepare and protect its information systems from attack.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee as part of its review of our ERM framework. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Information Officer and our Chief Information Security Officer. In 2023, the Audit Committee received briefings on information security matters at all of its regular meetings. In addition, our Chief Information Officer, our Chief Information Security Officer, other members of our information technology leadership team and an outside legal expert on cybersecurity matters held a special session with all members of our Board of Directors to provide an overview of the information security environment. In addition to information provided in these meetings, members of our Board also have access to internal and external education on cybersecurity risks. The Board also benefits from the expertise of one of our members who has significant experience in management of cybersecurity companies.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: Our cybersecurity program is strategically crafted to achieve the paramount goals of identifying, protecting, detecting, and responding to all potential risks and threats. Employing a defense-in-depth strategy, we proactively identify, investigate, and resolve vulnerabilities and security incidents in a timely manner.

companyName: SunOpta Inc.

ticker: STKL


text: The Company's cybersecurity risk management strategy focuses on several areas: • Identification and Reporting: The Company has implemented a comprehensive, cross-functional approach to identifying, and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly alert, identify, scope, triage, escalate, contain, eradicate mitigate and recover from cybersecurity incidents by providing management visibility and to enable management to take action with respect to reporting of material incidents in a timely manner. • Technical Safeguards: Our program consists of layered defenses to enhance resiliency within the system to prevent, detect and respond to any incidents. Our perimeter security incudes but is not limited to, proactive threat intelligence via our security partners, firewalls, end-point security agents, email security, vulnerability assessments and scans, proactive patching, and privileged access management. Our detection capabilities include event logging and monitoring such as unsuccessful login attempts, escalated privilege attempts, anomaly detection. Our response capabilities are supplemented by a 3rd party incident response retainer to assist us in the event of an incident, Security playbooks, and recovery procedures also form part of our incident response capabilities. We do conduct Red Team/ Blue Team exercises with 3rd parties to help us assess our resiliency and the performance of our capabilities. We have also implemented various technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including: firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as outside audits and certifications. • Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response, business continuity, and disaster recovery plans designed to address the Company's response to a cybersecurity incident. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Canopy Growth Corp

ticker: CGC


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2023, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: We have established policies and standard operating procedures to define and implement our cybersecurity strategy, which includes multiple layers of administrative, operational, technical and physical safeguards used to protect information systems and data. Additionally, we have dedicated internal resources and processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management processes. The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks. Our third-party service providers are subject to a screening process, which includes risk and security assessments of the provider's data security protocols and a review of contract terms to verify that privacy laws and consumer data protection regulations are considered and incorporated into the services provided to us.

companyName: HireRight Holdings Corp


text: We generally require each of our relevant third-party service providers to implement and maintain appropriate security measures and to promptly notify us of any suspected breach of security that may affect our company. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Management of our cybersecurity team has extensive experience and training related to cybersecurity matters. These leaders hold top-secret clearance from the U.S. federal government and have attended classified briefings from relevant federal agencies. Our cybersecurity team has in excess of 120 years of combined cybersecurity experience as of year-end 2023, and members of the team hold various specialized certifications related to cybersecurity, including training related to penetration testing and information system auditing.

companyName: KINDER MORGAN, INC.

ticker: KMI


text: The Cybersecurity Oversight Team, along with internal security stakeholders, are the team members principally responsible for overseeing and implementing our cybersecurity risk management program. Our Cybersecurity Oversight Team members each possess at least 5 years of cybersecurity experience, with strong educational qualifications including post-secondary education, industry certifications and other relevant developmental training. We believe this collective experience allows us to effectively manage risks emerging from cybersecurity threats.

companyName: Augmedix, Inc.


text: Our Information Technology, or IT, department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, evaluating threats that are reported to us, using external intelligence feeds, engaging in internal and external audits, and engaging third parties to conduct threat assessments.

companyName: Kura Oncology, Inc.

ticker: KURA


text: Information security is essential to our mission and our institutional strategic goals. Under the leadership of our Chief Information Security Officer ("CISO"), we have developed and implemented a comprehensive risk-based information security program that meets regulatory requirements and encompasses a cybersecurity program that is based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. This framework enables identifying and evaluating cybersecurity risks, enabling risk management decisions, and responding to emerging threats. The Information Security Program and all applicable cybersecurity policies, processes, and controls apply to all of our operations and all of our employees.

companyName: PACIFIC PREMIER BANCORP INC


text: We have not been the victim of a cyber incident in the past but may be the subject of cyber incidents in the future.

companyName: Saker Aviation Services, Inc.

ticker: SKAS


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has integrated cybersecurity risk management into our broader enterprise risk management framework to promote a company-wide culture of cybersecurity risk awareness and management. This integration aims to ensure that cybersecurity considerations are an integral part of our decision-making processes at every level.

companyName: Cornerstone Building Brands, Inc.


text: We require service providers to undergo regular security assessments, and we ensure that such providers have robust incident response plans in place during our engagement.

companyName: Powerfleet, Inc.

ticker: AIOT


text: Our management team, including our Chief Financial Officer and Chief Information Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has overall responsibility for leading our overall cybersecurity risk management program, including our internal cybersecurity personnel and our external cybersecurity service providers. Our Chief Information Officer has more than 20 years of experience managing and leading IT and cybersecurity teams.

companyName: Custom Truck One Source, Inc.

ticker: CTOS


text: The Company has cybersecurity incident response policies and procedures for identifying, assessing, and managing material risks arising from cybersecurity incidents, including those arising from third-party service providers. Our cybersecurity program is based on components of the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. The Company's Vice President, Information Security, who has 15 years of experience in information security and has several industry certifications such as Certified Information Security Manager ("CISM"), Certified in Risk and Information Systems Control ("CRISC"), and Certified Information Privacy Professional ("CIPP"), is primarily responsible for managing and assessing cybersecurity risks. The Company uses a number of other internal and external resources to manage its information technology ("IT") and cybersecurity operations across the Company, including global managed service providers that provide 24/7 support for all of the Company's key IT systems and consultants who are engaged periodically to assist with the Company's evaluation of its systems and processes for preventing and mitigating cybersecurity incidents. The Company's global managed service providers also assess cybersecurity incidents and classify them by severity level in accordance with the Company's Incident Response Plan, which determines how each cybersecurity incident is managed and communicated. The Incident Response Plan also outlines the procedures that the Company then follows for evaluation and recovery from an incident, including containment of the affected systems, in order to restore our systems to normal operations. To date, the Company has not had a cybersecurity event that materially impacted its operations, financial position or the security of its proprietary data.

companyName: GRAPHIC PACKAGING HOLDING CO

ticker: GPK


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack including assistance in the timely remediation of material cyberattacks and incidents.

companyName: RPC INC

ticker: RES


text: Cybersecurity risk management is a core tenet of our information technology security program. We have implemented various cybersecurity technologies, controls, and processes to ensure the integrity and availability of our infrastructure, data, and operations. We periodically review and modify these technologies and processes to align with the latest in industry best practices and an ever-changing threat landscape. risk assessment is performed on all new products and product updates; internal staff with security certifications, and we work with third parties to perform security vulnerability testing; to data protection laws are closely monitored and necessary changes are implemented; routine security training to employees and communicate any emerging threats; the security posture of all third parties that we engage; a comprehensive incident response plan; cybersecurity insurance to help mitigate any potential losses arising from cybersecurity incidents.

companyName: GAXOS.AI INC.

ticker: GXAI


text: We engage third parties like a penetration testing firm and our managed service provider in connection with our risk assessment processes. These service providers assist us in identifying vulnerabilities to design and implement, suggesting remediation of our cybersecurity policies and procedures, as well as monitor and test our safeguards. We require each third-party service provider to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: 1. Cybersecurity Risk Management Program – The Company’s cybersecurity risk management program includes the following activities: • Regular Security Committee meetings where the head of Information Security briefs the Security Committee on cybersecurity threats and responses, strategies and initiatives relating to cybersecurity, and roadmaps for improving the Company’s cybersecurity. • Training employees on cybersecurity upon hire, and at least annually, with more detailed training provided to those employees that have greater access to data and systems. • Over two dozen Information Security policies that focus on specific aspects of our cybersecurity risk management (e.g., Vendor Management).

companyName: QUINSTREET, INC

ticker: QNST


text: The Company maintains an operational Incident Response Plan ("IRP") that defines how the Company handles cybersecurity incidents, including escalation, reporting and remediation procedures. The IRP is reviewed annually both internally and by third parties during regular audits. In addition, the Company retains a preferred partner with expertise in cybersecurity risks and incidents to advise on cybersecurity related matters. The Company's preferred partner is also part of the Company's IRP procedures and provides independent analysis and advice during cybersecurity investigations. The Company also maintains a Security Awareness Program, which is designed, implemented, and maintained by the Company's Chief Information Security Officer. The Company's Security Awareness Program includes training that reinforces the Company's information technology risk and security management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Company's resources and information, as well as how to respond to unauthorized access to or use of Company information. The Security Awareness Program training is mandatory for all employees globally at least annually, and it is supplemented by Company-wide assessment initiatives, including periodic testing. The Company provides specialized security training for certain employee roles, such as application developers.

companyName: DraftKings Inc.

ticker: DKNG


text: The Audit Committee receives regular reports from management concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Longboard Pharmaceuticals, Inc.


text: We design and assess our program based on the ISO 27000 and the National Institute of Standards and Technology (NIST) SP-800 and Cybersecurity Framework ("CSF"). We use these frameworks to help us identify, assess and manage cybersecurity risks relevant to our business. It is not intended to suggest that we meet any particular technical standards, specifications or requirements.

companyName: Avery Dennison Corp

ticker: AVY


text: Management is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Officer, who is a member of our executive management team and closely coordinates as needed with other senior management personnel including the Deputy Chief Information Security Officer, the Chief Product and Technology Officer and the Chief Legal Officer, who collectively possess significant experience in evaluating, managing and mitigating security and other risks, including cybersecurity risks.

companyName: SentinelOne, Inc.

ticker: S


text: The Company's Chief Information and Digital Officer has formal education in information technology and extensive experience working in and leading Dow's information systems and technology function. The Chief Information and Digital Officer receives regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation.

companyName: DOW INC.

ticker: DOW


text: Education and Awareness Through its Information Security Awareness Program, the Company provides regular, mandatory training regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and effective practices.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: While we attempt to mitigate cybersecurity risks by employing a number of measures, as described above, our employees, systems, networks, products, facilities and services remain potentially vulnerable to ransomware or sophisticated espionage. Depending on their nature and scope, such threats could potentially lead to the compromise of confidential information, improper use of our systems and networks, manipulation and destruction of data, defective products, production downtimes and operational disruptions, which in turn could adversely affect our reputation, competitiveness and results of operations or financial condition. As of February 27, 2025, we do not believe that any cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A. Risk Factors - General Risk Factors for additional information.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: Our board of directors currently do not oversees our cybersecurity program, and have delegated the oversight to our PRC subsidiary which established its Information Security Committee headed by our CEO, Mr. Tao Guolin to be the head of the committee. The Information Security Committee will provide the board of directors occasional updates on the effectiveness of our cybersecurity program.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: We are externally managed by the Advisor, a subsidiary of Cohen & Steers, and representatives of the Company and the Advisor operate the Company's business through Cohen & Steers' information systems. Our business is dependent on the effectiveness of our and Cohen & Steers' information and cybersecurity policies and procedures to protect our and Cohen & Steers' network and telecommunications systems and the data that reside in or are transmitted through such systems.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Additionally, the Company may collect and share personal data to investigate, prevent, or take action regarding illegal activities, suspected a developer of regulatory-grade financial technology, the Company ensures that its cybersecurity measures align with relevant regulations and standards. The company's subsidiaries, such as Alchemy Markets Ltd. and Alchemy Prime Limited, are regulated by financial authorities like the Malta Financial Services Authority (MFSA) and the UK's Financial Conduct Authority (FCA), respectively. Compliance with these regulatory bodies necessitates adherence to stringent cybersecurity protocols to protect client data and maintain the integrity of financial operations.

companyName: FDCTECH, INC.

ticker: FDCT


text: The Board of Directors is responsible for the overall oversight of the Company's enterprise risk management. The Board of Directors has delegated oversight of cybersecurity risks to the Technology, Data and Supply Chain Committee. The Technology, Data and Supply Chain Committee receives quarterly cybersecurity updates from the Company's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), which include updates on the Company's cybersecurity policies and strategies, cyber risk posture, improvements and threats, the status of projects designed to continuously improve the Company's information security systems, assessments of the Company's security program, employee training and awareness programs, emerging threat landscape and engagement with external cybersecurity experts and advisors, as needed.

companyName: SCHOLASTIC CORP

ticker: SCHL


text: The Board of Directors recognizes the critical importance of maintaining the trust and confidence of our suppliers, customers, other business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating any cybersecurity threats and effectively responding to cybersecurity incidents should they occur.

companyName: Callon Petroleum Co


text: Our management team, including the Chief Technology Officer, General Counsel and the Senior Vice President of Information Technology & Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes 17 years as a Chief Technology Officer, a General Counsel with 10 years of cybersecurity oversight responsibilities, and a Senior Vice President of Information Technology & Security with 19 years of experience in information technology.

companyName: BEASLEY BROADCAST GROUP INC

ticker: BBGI


text: Our management team, including our VPIT and DIS has overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes extensive technology and finance leadership experience across multiple industries, experience in the Legal, Risk and Compliance disciplines, and over 20 years of cybersecurity leadership experience for our VPIT.

companyName: ENERPAC TOOL GROUP CORP

ticker: EPAC


text: Third-party service providers and consultants Cybersecurity partners are a key part of our cybersecurity infrastructure. We partner with cybersecurity companies and leverage their technology and expertise to better protect the Company. From time to time, we engage certain vendors to monitor our environment, which includes an outsourced security operations center. We may also from time to time engage partners for periodic penetration testing and vulnerability assessments. We intend to continue to work to formalize our cybersecurity program, including developing processes for third-party service provider cyber-risk oversight and management.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Each of Ellington and Longbridge employ internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.

companyName: Ellington Financial Inc.

ticker: EFC


text: We have implemented third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes an assessment of vendors during the selection/onboarding process and a review of SOC 1 reports on an annual basis.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer ("CIO"). Our CISO oversees prevention, detection, mitigation, and remediation efforts through regular communication and reporting from information security professionals, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM). These efforts are supported by advanced technological tools, specialized software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following credentials: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly provide reports to the Board, the Audit Committee and the Sustainability and Risk Committee on our cybersecurity posture, key initiatives and ongoing efforts to prevent, detect, mitigate, and remediate cyber incidents. In the event of a cybersecurity incident, we follow established incident response procedures, which includes protocols for timely notification to senior management as well as the Board of Directors, with ongoing updates provided until the issue is remediated, as appropriate.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We are not currently aware of risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information regarding cybersecurity risks, see the risk factor in Part I, Item 1A. Risk Factors captioned: "We are required to maintain the privacy and security of personal and business information amidst multiplying threat landscapes and in compliance with privacy and data protection regulations globally. Failure to do so could damage our business, including our reputation with sellers, buyers, and employees, cause us to incur substantial additional costs, and make us subject to litigation and regulatory action."

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: The Audit Committee of the Board of Directors is responsible for the oversight of risks from cybersecurity threats. The Audit Committee is composed of directors with a wide range of experience, including risk management and controls, and technology. See "Integrated Overall Risk Management" above.

companyName: NUCOR CORP

ticker: NUE


text: BankOnIT leverages certain industry and government associations and threat-intelligence resources to keep up to date on, and respond to, the latest cybersecurity threats.

companyName: Bank7 Corp.

ticker: BSVN