text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our information security leadership. These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Since the beginning of the last fiscal year, there were no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Business interruptions, including data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business, can limit our ability to operate our business, and adversely impact the success of our commercialization partners."

companyName: Assertio Holdings, Inc.

ticker: ASRT

secItem: Item 1C


text: The information security team maintains incident response policies and procedures designed to help protect the integrity, availability and confidentiality of information and help prevent loss of service. Cybersecurity events and incidents may be reported or detected through a variety of means, including emails to centralized information security addresses, our online information technology ticketing system, automatic alerts and incident detection systems, direct discovery by our information security team, or reports from a third party. Additionally, our incident response policies and procedures specify the process for initial investigation and containment procedures, remediation tactics, retention of documentation and internal and external communications. Our incident response policies and procedures also specify processes for analyzing the severity of an identified incident, which serve to dictate the escalation procedures to notify varying levels of our risk management team. In response to cybersecurity incidents, we may involve external advisors to assist with remediation efforts and communications and we may seek to mitigate associated liabilities through our insurance coverage. Such third parties may include external legal counsel, forensic investigators and public relation firms, among others. These vendors serve to support our existing processes and procedures and operate as an extension of our enterprise risk management and information security functions.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our Cybersecurity Leaders and the dedicated personnel on their teams have industry-recognized certifications such as Certified Information Security Manager, Certified Information Systems Security Professional, and Boardroom qualified Technology Expert, and experienced information systems security professionals and information security managers with many years of technical cybersecurity management experien ce.

companyName: Lucid Group, Inc.

ticker: LCID


text: We face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks, some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.

companyName: HARROW, INC.

ticker: HROW


text: Management meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the Chief Financial Officer reviews with the audit committee at least annually our risk management program, which includes cybersecurity risks and is also reported to the board.

companyName: AAON, INC.

ticker: AAON


text: Our management team, including the ERMC and our Vice President of Information Technology and our legal and compliance function, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes a key employee with over 20 years of experience in information technology and cybersecurity and various members of the senior management team with significant training in cyber incident response.

companyName: Xenia Hotels & Resorts, Inc.

ticker: XHR


text: In response to the growing risks associated with third-party service providers, we do not have any direct connections between our enterprise resource planning ("ERP") system to our third-party suppliers and their access to our IT systems that could significantly disrupt our operations.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: All network environment alerts are reviewed by the third-party SOC team then relayed to Diameter's appointed technology infrastructure employee and its external managed service provider. Pursuant to the CIR Plan, cyber threats will be assessed for their threat level and the appropriate parties will be alerted.

companyName: Diameter Credit Co


text: 2. Our ISMS platform encompasses vendor risk management capabilities, facilitating initial due diligence through the collection of vendor security-related artifacts. It applies risk ratings and delivers and analyzes annual security questionnaires, scheduling reviews and tasks to ensure compliance and security standards are met consistently.

companyName: TRANSCAT INC

ticker: TRNS


text: The CIO provides leadership for the company's technology department. She holds a Bachelor of Science, Communication from Arizona State University, has served in various roles in information technology for over 25 years, holds multiple certifications, and has been actively involved in the information security and cybersecurity domains for over 20 years.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and/or financial risk areas.

companyName: Immuneering Corp

ticker: IMRX


text: Our cybersecurity risk management team - including our Executive Vice President, Chief Administrative Officer, Senior Vice President, Chief Accounting Officer and Controller, Senior Vice President, Corporate Counsel and Senior Vice President, Information Technology - is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel, our retained external cybersecurity consultants, and the simulated exercises of our Cybersecurity Incident Response Plan, conducted at least annually to ensure our team is prepared to respond to any future cybersecurity incidents. The team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel, publicly available information about cybersecurity risks and threats and through alerts from security tools deployed in our IT environment.

companyName: KILROY REALTY CORP

ticker: KRC


text: Our chief technology officer is responsible for our information security team which oversees and implements our cybersecurity program. Our chief technology officer has over a decade of industry experience, and is supported by a team of information security professionals who have relevant educational and industry experience, including holding similar positions at large technology companies. Our chief technology officer and information security team provide regular reports to senior management, other relevant teams and the audit committee of our board of directors on our cybersecurity program, material cybersecurity risks and mitigation strategies, and other cybersecurity developments. In addition to such regular reports, and as part of our incident response processes, our chief technology officer will provide updates on material cybersecurity threats and incidents to our audit committee and, as necessary, to the full board of directors, based on management's assessment of risk.

companyName: Braze, Inc.

ticker: BRZE


text: As a healthcare provider, cybersecurity, data protection, safeguarding patient information and the integrity of our information systems is of the utmost priority. We have developed and maintain a Cybersecurity and Data Protection Program which aligns with industry-standard frameworks and applicable regulatory requirements, integrates with our overall risk management process, and aims to ensure cybersecurity concerns are a requisite element for decision-making at all levels of our business.

companyName: RadNet, Inc.

ticker: RDNT


text: Protect. Our employees are the first line of defense against cybersecurity incidents. As such, employees receive annual security awareness training to understand the behaviors and technical requirements necessary to protect information. We also conduct periodic phishing awareness exercises to educate employees to recognize and report suspicious activity. We also use a combination of tools and in-house technologies to protect Cars Commerce, our employees and our customers, including but not limited to using only SOC 2 compliant hosting providers, anti-malware software, intrusion prevention systems, network and web application firewalls, multi-factor authentication, encryption, and remote access via virtual private network ("VPN") software.

companyName: Cars.com Inc.

ticker: CARS


text: Our internal processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. We determine an overall risk assessment of potential cybersecurity issues with our third-party suppliers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. Additionally, if appropriate, we require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: KINETA, INC./DE


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's Risk Governance Framework, which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The Risk Governance Framework sets forth enterprise-wide operational practices to ensure consistency in the Company's approach to risk identification, assessment and testing, issues management, and mitigation with all aspects of risk management documented within a centrally maintained Governance, Risk and Controls ("GRC") risk management platform. A key aspect of the Risk Governance Framework is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the GRC risk management platform, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will and have satisfactorily addressed the identified issue.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our Executive Director of Information Technology leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The Executive Director of Information Technology has over 25 years of experience working with life science companies and venture capital firms in the information technology field, a certificate from HarvardX (Cybersecurity: Managing Risk), and an active membership in Health-ISAC.

companyName: Inozyme Pharma, Inc.


text: Our Chief Information Officer, who has information technology, engineering, product and security knowledge, experience and skills gained over a decade of experience leading product and engineering organizations, our Chief Information Security Officer, who also has over two decades of cybersecurity experience in both public and private organizations, and certain members of their teams as well as outside advisors who have cybersecurity experience are responsible for implementing and maintaining cybersecurity and data protection practices at the Company and reporting on cybersecurity matters to the relevant members of management. This team is supported, from time to time, by third-party consultants and service providers with specific areas of cybersecurity expertise. Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, and maintaining cybersecurity policies and procedures. Management also regularly communicates cybersecurity risks and activities with other members of management and, as appropriate, to our Board or relevant members or committees thereof, including the Audit Committee.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Certain members of our management team are responsible for hiring appropriate personnel and third-party IT service providers, helping to integrate cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Marker Therapeutics, Inc.

ticker: MRKR


text: The Company (or the third parties it relies on) may not be able to fully, continuously, or effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine whether and how to implement certain security controls and it is possible that we may not implement the necessary controls if we are unable to recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate cybersecurity risks. Cybersecurity events, when detected by security tools or third parties, may not always be identified immediately or addressed in the manner intended by our cybersecurity incident response plan.

companyName: Digital Media Solutions, Inc.


text: We have established an internal cross-functional Steering Committee and a leadership committee with the objective of overseeing the cyber security program, incidents, risks and initiatives. The Steering Committee is chaired by our VP of Information Technology and is comprised of leaders from Software Development, Research and Development and Data teams. The Steering Committee oversees the cybersecurity program relevance and effectiveness through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment. Updates from the Steering Committee are provided quarterly to an executive leadership committee, which is chaired by our VP of Information Technology and is comprised of the President and Chief Financial Officer, Chief People Officer, Chief Data Officer, Chief Operations and Product Development Officer and the SVP of Product Development.

companyName: Seer, Inc.

ticker: SEER


text: Preparation for and, where possible prevention of cybersecurity incidents involves regular and structured briefings to key management on risk remediation measures that should be taken to decrease, among other things, the likelihood and severity of incidents and to mitigate and manage their effects. The CEO, COO, CLO and other members of management receive detailed updates on cybersecurity risks on a regular basis, no less frequently than monthly, or when significant risks or incidents are identified. These briefings enable the management team to, among other things, stay informed of the latest threats, assess the effectiveness of current security measures and make timely decisions on strategic security initiatives. In addition, the Board of Directors is regularly briefed, no less frequently than quarterly, on cybersecurity risks as part of its oversight functions and to ensure that cybersecurity practices align with the company's overall risk management framework and business objectives. In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.

companyName: Hughes Satellite Systems Corp


text: While the ONES Committee has primary committee responsibility for cybersecurity due to the operational issues involved, the Board of Directors has determined that the topic is of sufficient importance to warrant this comprehensive oversight approach. Augmenting such oversight efforts, the Board conducts drills to practice its response in a possible emergency situation to ensure it is well prepared and positioned to perform in a possible crisis.

companyName: NORTHERN STATES POWER CO /WI/


text: Risk Management and have established cybersecurity risk assessment procedures to ensure effectiveness in cybersecurity management, strategy and governance and reporting cybersecurity risks. The process is in alignment with our strategic objectives and risk appetite.

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: our Enterprise Risk Management ("ERM") team, which is responsible for evaluating and assessing overall enterprise risk, including cybersecurity risk, and advising senior management and the Board regarding our overall risk profile and priorities as they evolve;

companyName: ON SEMICONDUCTOR CORP

ticker: ON


text: Threat Detection and Response. In addition to aligning our cybersecurity risk management program to NIST standards, we have also engaged with third party providers of security information and event management and cybersecurity services to provide continuous monitoring and operational threat detection and response. Our partners integrate threat intelligence into their platforms, providing us with a proactive view of possible threats.

companyName: Archer Aviation Inc.

ticker: ACHR


text: Our information security processes are designed to assess, identify and manage material risks from cybersecurity threats. In conducting our business activities, we are entrusted with confidential information from our clients, business partners and employees. Confidential information may include sensitive business, proprietary and technical information, as well as personal information. Our Information Security Management System ("ISMS"), based on ISO/IEC 27001, is an integral part of our overall enterprise risk management system, and serves as a framework for handling cybersecurity threats and incidents, including such threats and incidents associated with our use of services by information technology suppliers. The ISMS is operated by our Global Information Security team headed by our Global Chief Information Security Officer ("CISO"). We maintain physical, electronic and procedural safeguards designed to guard confidential and proprietary information contained within our information systems from loss, misuse, unauthorized access, disclosure, alteration or destruction. We have layered defenses designed to protect against intrusions that could affect the confidentiality, integrity and availability of information.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: Our customers rely upon Akamai to power and protect the online experiences of their end user customers. We provide security, content delivery and compute services through Akamai Connected Cloud and maintain internal systems and other data associated with running our business. We have implemented cybersecurity risk management programs and procedures designed to identify and address threats to both internal and customer facing data and systems that are subject to ongoing compliance assessments, certifications and testing.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and cybersecurity incident response plan that includes procedures for responding to cybersecurity have not identified risks from known cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. "Risk Factors – Our Risks Related to Our Business - Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity. "

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: Prior to engagement, the Company undertakes security assessments of third-party providers that process or store confidential Company information, and monitors their activities for alignment with the Company's cybersecurity standards. This monitoring involves evaluations performed by the Company's team of security analysts, and annual review by the Company's Chief Information Security Officer ("CISO").

companyName: Global Indemnity Group, LLC

ticker: GBLI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Internal Controls and SOX Compliance, who has over 20 years in the areas of internal controls and SOX compliance reporting; our Director of IT Security and Compliance, who has over 20 years of IT experience, the past four of which have been in security; and our CFO, who has over 20 years of business development experience.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our CIO reports to the CEO, and the CISO reports to the CIO. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. Cybersecurity and data governance risks are aligned with our overall Enterprise Risk Management process to help ensure potential cyber threats are identified, assessed and mitigated. Our top risks, such as cybersecurity, identified sub-risks and current and proposed mitigation strategies are reviewed regularly by the Enterprise Risk Management Committee. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO and CISO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO and CISO provide a cybersecurity update to the full Board at least annually.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer ("CISO") is primarily responsible for this cybersecurity component and, as discussed below, periodically reports to the Information Technology/Cybersecurity Committee ("IT/Cybersecurity Committee") of our board of directors.

companyName: TRICO BANCSHARES /

ticker: TCBK


text: The Board, in coordination with the Risk Management Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board, Audit Committee and the Risk Management Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Management Committee also receive prompt and timely information regarding any cybersecurity incident that meets or could potentially meet materiality reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Company's senior executives and CISO discuss the Company's approach to cybersecurity risk management.

companyName: LKQ CORP

ticker: LKQ


text: The IRT is responsible for providing an orderly response to security incidents and risk events; preventing a serious loss of profits, public confidence, or information assets by providing an immediate, effective, and skillful response to any unexpected event which negatively impacts the confidentiality, integrity, and/or availability of our systems, network, or the non-public personal information of its customers, interruptions to customers' experiences, or other anomalous situations; taking the steps it deems necessary to contain, mitigate, or resolve a security incident or risk event; and investigating suspected security incidents and risk events in a timely and cost effective manner, reporting findings to management, determining an appropriate course of action, and coordinating communications to customers, regulatory authorities, and law enforcement agencies as necessary. Investigations at the lowest level of risk are coordinated by the IRTC. The IRT has increasing levels of responsibility and involvement in the next three levels of risk.

companyName: CapStar Financial Holdings, Inc.


text: We also maintain multiple groups that help oversee risks associated with our third-party service providers. These groups include (1) our third-party risk management department, which facilitates reviews of certain third parties by our assurance providers, including our information security and business continuity teams, (2) our vendor council, which reviews contractual terms (including, at times, terms related to confidentiality and data protection) for certain third-party relationships, and (3) our architecture review board, which reviews certain new business initiatives that may impact the Company's technical and/or security architecture.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: Management has implemented risk management structures, policies, and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our operations department that focuses on current and emerging cybersecurity matters, which is overseen by our CISO. Senior management, including our CISO, regularly report to our Board, which actively oversees our risk management activities, including those related to cybersecurity. Our CISO is well qualified in the field of cybersecurity. These qualifications include years of experience in the IT and cybersecurity industry. The CISO works closely with key stakeholders, including internal committees such as the Finance and Audit Committee of the Board, in order to manage cybersecurity and information security risk. Our internal team, supplemented by outside cybersecurity advisors, is responsible for the testing and audit of our information-technology internal controls. In addition, leaders from our finance, legal and operations teams participate in incident response training designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency. The Finance and Audit Committee provides oversight relative to senior management's handling of cybersecurity risks.

companyName: 5&2 Studios, Inc.


text: In furtherance of assessing, identifying, and managing material cybersecurity risks; the Company: • Employs advanced technology solutions, such as proactive detection tools, to safeguard our assets and identify threats within its environment. • Conducts routine cyber education and awareness training sessions to empower team members with the necessary knowledge and cultivate a strong security culture across the organization. • Regularly assesses our cybersecurity program against the NIST Cybersecurity Framework, using the findings to develop action plans and track progress to completion. • Organizes tabletop exercises and drills to simulate cyber incidents, enhancing its incident response and recovery capabilities. • Analyzes internal and external cybersecurity incidents and threat intelligence to assess their relevance to its environment and industry, crafting actionable plans accordingly. • Manages an enterprise-wide disaster recovery governance program, including cybersecurity-related standards and compliance procedures. • Performs regular cybersecurity-related disaster recovery testing to ensure the recoverability of its critical systems, supporting business continuity across various lines. • Fosters integration between business units and corporate divisions with its internal cybersecurity team, embedding cybersecurity requirements into operational environments and influencing strategic decisions, budgeting, and processes (e.g., Security by Design). Additionally, senior management, executives, and the Board of Directors consistently review financial planning processes concerning cybersecurity initiatives.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Our Enterprise Security Program is led by the ISO. The ISO reports to the Chief Risk Officer (CRO). FHLBank's Information Security area is led by the Director of Information Security, who reports to the Chief Information Officer (CIO). The Business Resiliency Management Program is led by the Director of Enterprise Risk Management, who reports to the CRO.

companyName: Federal Home Loan Bank of Topeka


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.

companyName: Delek US Holdings, Inc.

ticker: DK


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage and mitigate those risks. The Board's Audit and Compliance Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit and Compliance Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our CISO, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives updates from management and the Audit and Compliance Committee on cybersecurity risks on at least an annual basis. In addition, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board and Audit and Compliance Committee.

companyName: DocGo Inc.

ticker: DCGO


text: Our CISO and the Head of Digital Office regularly report on cybersecurity to the Audit Committee and/or the Technology and Innovation Committee and the Board of Directors.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: Vendor due diligence is performed for all third parties with access to the Company's information assets to ensure such parties maintain effective cybersecurity practices in accordance with the Company's vendor management program. The Company performs ongoing monitoring, including the review of cybersecurity practices, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Annual cybersecurity assessments are conducted by the Company's information technology team on its information systems using industry-standard guidelines and tools.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: To further protect our business, we partner with a third party vendor to provide cybersecurity and risk management as a managed service offering. They provide cybersecurity risk assessment and threat intelligence to the Company, in addition to acting as a managed service provider for our information technology program. We decided to retain a third party for these services given the small size of our Company and internal information technology staff and the quality, comprehensiveness, and cost-effectiveness of the services offered. An internal team, led by our Vice President of Information Technology, oversees and works collaboratively with this third party vendor to evaluate the strength of our cybersecurity protocols and the results of testing to determine what additional actions, such as trainings or remedial actions, are necessary to lessen cybersecurity risks. We intend to continue to make investments to monitor and maintain the security of our data and cybersecurity infrastructure.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Our CISO has over 23 years of information technology experience. He has held technology positions across various areas — including infrastructure management, application management, architecture, operations, and cybersecurity — and brings expertise from Farmers Insurance and Zurich Insurance.

companyName: Vistra Corp.

ticker: VST


text: The Chief Financial Officer and Treasurer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee ("AFC") of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.

companyName: ROYAL GOLD INC

ticker: RGLD


text: require employees, as well as contractors who have access to our systems or the data of our employees or customers, to treat information as confidential; performed internal audits of our use of single sign-on and multifactor authentication for key information systems;

companyName: GLAUKOS Corp

ticker: GKOS


text: The CISO is a senior-level executive responsible for establishing and executing the Company's information security strategy. Management provides regular reports to the CISO detailing on-going cybersecurity risk management. The CISO and the head of Global Technology & Operations present updates to the Audit Committee quarterly and, as necessary, to the full Board of Directors. These regular reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The Audit Committee also reviews with management, as necessary, but at least annually, the adequacy and effectiveness of the Company's policies and internal controls regarding information security and cybersecurity. Additionally, the CISO periodically and on an event-driven basis informs and updates the Board of Directors about information security incidents and the related risks posed to the Company.

companyName: METLIFE INC

ticker: MET


text: The Company has not experienced any material cybersecurity incidents that caused us to incur any material expenses or materially affected our business, results of operations or financial condition, but we cannot assure that our business, results of operations and financial condition will not be materially affected in the future by cybersecurity risks or future incidents. Breaches in IT security, system interruptions and unauthorized disclosures of data, whether perceived or actual, could adversely affect our business, assets, revenues, results of operations, brands and reputation and result in fines, litigation, regulatory proceedings and investigations, increased insurance premiums, remediation efforts, indemnification expenditures, lost revenues and other potential liabilities. Although we have taken and will continue to take significant steps to protect the security and integrity of our information and although we have implemented policies and procedures to enhance data privacy and security, there can be no assurance that our efforts will prevent breakdowns, system failures, breaches of our systems or other cyber incidents or otherwise be fully effective. Any such breakdown, breach or incident could adversely affect our business, prospects, financial condition or results of operations, and any insurance that we may have for cyber incidents may not cover such risks or be sufficient to compensate us for losses that may occur.

companyName: Sotera Health Co

ticker: SHC


text: We have not identified any risks from cybersecurity threats, including any that resulted from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Lazydays Holdings, Inc.

ticker: GORV


text: As discussed above, the Board has delegated to the Audit Committee the responsibility for monitoring and overseeing the Company's cybersecurity and other information technology risks, controls, strategies and procedures. The Audit Committee periodically evaluates the Company's information security strategies to ensure its effectiveness and, if appropriate, may also include a review from third-party experts. The Company's Vice President of IT reports to the Audit Committee as part of every regularly scheduled quarterly meeting of the Audit Committee (or more frequently, as needed) regarding technological risk exposure and cybersecurity risk management strategy. In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for oversight of the Company's broad ERM program.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: SSG and Key Personnel We have a standing SSG whose members include, among others, our CISO, Chief Product Officer, and Chief Technical Systems Officer. The SSG is charged with providing strategic direction for the implementation and ongoing operation of our cyber security program. The SSG meets at least quarterly. Our CISO chairs the SSG and decisions and recommendations are based on a consensus of the members.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The Partnership's management has processes in place by which it is informed of and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. These processes include, but are not limited to: • Maintaining an updated inventory and management of digital assets; • Ensuring familiarity and compliance with cybersecurity frameworks, including the National Institute of Standards and Technology's Cybersecurity Framework and ISO 27001; • Updating and maintaining an internal incident response plan; • Conducting risk assessments of the Partnership's cybersecurity policies, practices, and tools; • Employing appropriate antivirus, anti-malware, firewall, endpoint detection and response, backup and recovery software, multifactor authentication, virtual private network, account change monitoring, patch management, web content filter, spam filter and reporting, and vulnerability management software; • Conducting regular vulnerability scans of the Partnership's digital and operational infrastructure; • Requiring employees to complete a Cybersecurity Awareness Program, which includes computer-based training; and • Reviewing and evaluating developments in the threat landscape.

companyName: Summit Midstream Partners, LP


text: Our Board, including the Governing Body, considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Endeavor Group Holdings, Inc.


text: Blue Owl has implemented an information security governance policy (the "ISG Policy") governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes and the maintenance of critical services and systems. Blue Owl's cybersecurity program is managed by Blue Owl's Chief Technology Officer and Head of Technology Infrastructure (together, "Blue Owl IT Management"), who report to Blue Owl's Chief Operating Officer. Blue Owl IT Management and its team are responsible for implementing proactive and reactive measures, including Blue Owl's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. Blue Owl's cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Blue Owl's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Blue Owl's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure, and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Blue Owl's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Blue Owl Capital Corp

ticker: OBDC


text: We have implemented a written information security program ("WISP") to create administrative, technical and physical safeguards at KVH for the protection of confidential information of KVH and its employees and customers and other third parties. The WISP sets forth our procedures for evaluating our electronic and physical methods of collecting, storing, accessing, using, transmitting, and protecting confidential information, including personal information, as defined by federal and state law. We have utilized the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) as a baseline for the WISP procedures in addition to General Data Protection Regulation (GDPR) standards. In addition to our data privacy policy, the WISP policy defines how sensitive and private data is protected. Under our procedures, we perform an annual risk assessment to identify and prioritize key cybersecurity risks, and we update this assessment when we receive information about material new cybersecurity risks. Once we identify material cybersecurity risks, we seek to identify and implement prevention measures. Current prevention measures include, among other things, to the extent we determine to be appropriate for our information systems in light of our financial, personnel and other resources, restricted physical access, restricted systems access, multi-factor authentication, software solutions such as intrusion detection systems, anti-virus, anti-malware, email filtering and quarantining programs, routine system maintenance and updates, backup and recovery systems, routine employee cybersecurity training and testing, and quarterly internal audits. The measures we take may be inadequate to protect us from cybersecurity risks. See "Item 1A. Risk Factors – Risks related to our dependence on third parties and third-party technology – Cybersecurity breaches could disrupt our operations, expose us to liability, damage our reputation, and require us to incur significant costs or otherwise adversely affect our financial results."

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: As described in Item 1A "Risk Factors," several features of our operations heighten our susceptibility to cyber-attacks, including (i) our material reliance on systems owned, operated or controlled by unaffiliated third-party operators and (ii) our processing and storage of large amounts of sensitive customer data. Cyber-attacks on our systems may be initiated by a wide variety of intruders, including employees, cyber-criminals, nation state actors and other advanced persistent threat actors, and may include attempts by outside parties to gain access to sensitive data that is stored in or transmitted across our network. Cyber-attacks can take many forms, including computer hackings, computer viruses, ransomware, worms or other destructive or disruptive software, denial of service attacks, or other malicious have implemented cybersecurity risk management procedures, in accordance with our risk profile and business size. We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: iQSTEL Inc

ticker: IQST


text: Our Information Security team oversees our cybersecurity risk management program, which is described in more detail above. In conjunction with the Company's in-house legal team, this team is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity threats and incidents. Our Information Security team is segmented into six subteams and includes a dedicated Governance, Risk and Compliance subteam that is responsible for risk assessment, risk mitigation strategies, regulatory compliance, audits, internal governance and policy enforcement.

companyName: Compass, Inc.

ticker: COMP


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology ("NIST") Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups stored at off-site locations and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: During the year ended September 28, 2025, we incurred $10.5 million loss of cash flows related to the Cyber Incident. Approximately $3.7 million of this was incurred expenses that are recognized in "Restructuring and Other" in the Consolidated Statements of (Loss) Income and Comprehensive (Loss) Income. We have filed insurance claims for the remaining $6.8 million to cover business interruption and other costs. The Cyber Incident remains under legal and forensic investigation, including evaluation of the extent and potential risk related to unauthorized access to sensitive data.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: Our Audit Committee of the Board of Directors ("the Audit Committee"), is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: Entera Bio Ltd.

ticker: ENTXW


text: While our Board of Directors has overall responsibility for the oversight of our enterprise-wide risk management, of which cybersecurity risk management is one component, our management team is responsible for day-to-day risk management, including the implementation of our cybersecurity program. We have established an information security council (the "Information Security Council"), with full participation from our senior management team, to serve as the steward of our information security program. Designed to meet quarterly or more frequently as needed, the council reviews security performance metrics, stays abreast of industry trends and regulatory changes, and evaluates progress on security initiatives. The council plays a crucial role in promoting a culture of security awareness and ensuring OppFi remains resilient against evolving cyber threats.

companyName: OppFi Inc.

ticker: OPFI


text: The Company has experienced cybersecurity threats and vulnerabilities in its information systems and those of third-party providers. Such prior events have not had a material impact on the Company's financial condition, results of operations or liquidity. If, in the future, the Company's or a third-party provider's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation with third parties, government enforcement actions, penalties, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption of data or remediation costs, which could materially adversely affect the Company's operating results, financial position or reputation. See "Risks Related to Cybersecurity" in "Risk Factors" beginning on page 11 of this Annual Report on Form 10-K.

companyName: HYSTER-YALE, INC.

ticker: HY


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, of the date of this report, we do not believe that any risks from cybersecurity threats, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA, "Risk Factors - "Cybersecurity risk."

companyName: Glimpse Group, Inc.

ticker: GGRP


text: We operate in the transportation and logistics sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. We have implemented a risk-based approach aligned with industry standards to identify and assess the cybersecurity threats that could affect our business and information systems. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive Incident Response Protocol that is tested on a regular cadence and an information security training and awareness program. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: Hub Group, Inc.

ticker: HUBG


text: Papa Johns' cybersecurity program includes a defense-in-depth model that utilizes a variety of techniques and tools for protecting against, detecting, responding to and recovering from cybersecurity incidents. Our cybersecurity program is designed to prioritize detection, analysis and response to known and anticipated cyber threats, effective management of cyber risks, and resilience against cybersecurity incidents. Our program leverages industry frameworks, including the Payment Card Industry Standards (PCI) and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: As a defense contractor, we must also comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI"). The Department of Defense ("DoD") will require defense contractors to comply with its CMMC program in the near future. We are incorporating the requirements of the CMMC program into our overall cybersecurity program and anticipate we will be in position to meet such requirements by the time it becomes fully rolled out in 2028.

companyName: DUCOMMUN INC /DE/

ticker: DCO


text: o Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified; o Implementing solutions designed to solve underlying problems and prevent re-occurrence; o Recovery and restoring normal business functionality;

companyName: TTM TECHNOLOGIES INC

ticker: TTMI


text: While prior incidents have not had a material impact on us, future incidents could have a material adverse effect on our business, results of operations and cash flows. For additional information about our cybersecurity risks, see Item 1A — Risk Factors on this Annual Report on Form 10-K.

companyName: Bridgeline Digital, Inc.

ticker: BLIN


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our Audit Committee of the Board of Directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party business partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Related to Cybersecurity and Data Privacy" in our Risk Factors in Item 1A of this Form 10-K.

companyName: STARBUCKS CORP

ticker: SBUX


text: We maintain a cybersecurity program that is reasonably designed to protect our information against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our information systems as well as our business operations, financial condition and overall performance.

companyName: ESAB Corp

ticker: ESAB


text: Our Board of Directors is responsible for oversight of risk management, including cybersecurity risks. The Audit Committee is updated quarterly on current cybersecurity events, metrics and other technology risks by our Chief Information Officer and Senior Director of Technical Operations & Security. The Audit Committee, in turn, provides the Board of Directors with updates regarding cybersecurity risks as it deems necessary or appropriate.

companyName: CARROLS RESTAURANT GROUP, INC.


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party security service provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: Management & Strategy MetLife manages information security risk through, and as part of, MetLife's Information Security Program (the "Program"), instituted to maintain controls for the systems, applications, and databases of MetLife and of its third-party providers. The primary goal of the Program is to protect the confidentiality, integrity and availability of all data MetLife owns or possesses, as well as its technology assets, through physical, technical, and administrative safeguards. This includes controls and procedures across business units and at the enterprise level for monitoring, detecting, reporting, containing, managing, and remediating cyber threats. The Program aims to prevent data exfiltration, manipulation, and destruction, as well as system and transactional disruption. The Program's threat-centric and risk-based approach for securing the MetLife environment takes into consideration applicable guidelines from the cybersecurity framework developed by the U.S. Government's National Institute of Standards and Technology along with the sensitivity of the systems and the potential severity of the associated risks to MetLife and its relevant lines of business, and is managed by MetLife's CISO, collaborating with lines of business and corporate functions. The Board of Directors of MetLife, Inc. (the "Board" or "Board of Directors") oversees the Program.

companyName: METROPOLITAN LIFE INSURANCE CO


text: Governance Framework Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Technology and Innovation team, led by our Senior Vice President, Chief Information Security Officer, Sara Schmidt, with support from the Internal Audit and Legal functions. Ms. Schmidt has served in the role since 2022. Before joining US Foods, Ms. Schmidt served as Chief Information Security Officer for Farmers Insurance, a national insurance company, from 2019 to 2022, and various other positions from 2015 to 2019. Ms. Schmidt began her career as a cryptography analyst with the National Security Agency ("NSA"), learning best practices and tactics to be an effective hacker and defender. After eight years with the NSA, she transitioned into the private sector, joining Perrigo Company from 2011 to 2015, before joining Farmers Insurance.

companyName: US Foods Holding Corp.

ticker: USFD


text: Ik Adeyemi, age 47, is Senior Vice President, Chief Legal Officer and Corporate Secretary. Ms. Adeyemi has leadership responsibility for Eastman's legal organization, which includes corporate governance, commercial law, litigation management and intellectual property, as well as responsibility for product stewardship and regulatory affairs, global business conduct, global trade compliance, and global public affairs. Before joining Eastman, Ms. Adeyemi served as vice president, corporate secretary, and associate general counsel of The Clorox Company. Prior to that, Ms. Adeyemi's work experience includes serving as the head of legal, corporate/M&A at BHP Billiton, and working at the law firms of Skadden, Arps, Slate, Meagher & Flom in the U.S. and White & Case LLP in London. Ms. Adeyemi was appointed to her current position effective September 2024.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The Audit Committee receives regular reports from our Chief Information Security Officer ("CISO") regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential. The Chief Information and Customer Officer ("CICO") and CISO periodically report to the full Board regarding cybersecurity risks and our cyber risk management program. Board members periodically receive presentations on cybersecurity topics from our CICO, our CISO, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We may face risks from cybersecurity threats that, if realized, are likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A: Risk Factors— Risks Relating to our Business: We are susceptible to cybersecurity breaches and cyber-related fraud.

companyName: INVO Fertility, Inc.

ticker: IVF


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Fund has no directors, principal officers or employees, the Managing Owner is responsible for managing cybersecurity risks to the Fund. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Managing Owner's parent company, has a designated Global Chief Security Officer (GCSO) who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO has over 28 years of experience in the public and private sectors, specializing in security, investigations, and incident response. The global security department oversees the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, Corporate Security, Business Security Officers and Strategy and Projects & Governance. This converged security structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees, and critical assets safe, upholding their privacy rights, while enabling a secure and resilient business.

companyName: Invesco DB Multi-Sector Commodity Trust


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to participants in preclinical studies and clinical trials involving certain of our product candidates. (Information Systems and Data).

companyName: Climb Bio, Inc.

ticker: CLYM


text: Our cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats; effective management of security risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, suppliers and other third parties, our information systems, our business operations, and our products and related services. We have adopted security-control principles based on the National Institute of Standards and Technology (the "NIST") Cybersecurity Framework.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: a dedicated security team responsible for managing (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents; cybersecurity awareness training including spear-phishing resistance for employees, and senior management;

companyName: Hour Loop, Inc

ticker: HOUR


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our board of directors, or Board, and management.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Our cybersecurity oversight includes our internal control environment, cybersecurity standards, benchmarks, and internal governance committees. Annually, we assess, either internally or by an independent third-party, against multiple cybersecurity maturity models. We also leverage other industry standards and benchmarks, such as those from the National Institute of Standards and Technology (, Department of Energy and Cybersecurity and Infrastructure Security Agency best practices to inform our oversight strategy. The governance committee functions to ensure adherence and accountability to these standards and deploy appropriate resources to keep pace with the shifting cybersecurity threat landscape.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our Information Security program is led by our Chief Information Officer ("CIO"), who reports to our Chief Operating Officer ("COO"). Our CIO works with our Chief Privacy Officer ("CPO") to address cybersecurity and data privacy risks and concerns. The Information Security Governance Committee ("ISGC"), composed of executives from various corporate functions, oversees our cybersecurity policy and strategy. Our Board of Directors (the "Board") oversees our enterprise risk management activities in general, including cybersecurity risks. The Audit Committee of the Board has been designated with specific oversight responsibility with respect to cybersecurity and data privacy risk management. The Board receives a comprehensive update on the status of risks related to cybersecurity annually and periodic updates on particular matters. The COO and the ISGC meet with the CIO and CPO on a regular basis to review and monitor our cybersecurity risks and mitigation efforts. We engage external assessors, consultants, and auditors to assist us in evaluating and enhancing our cybersecurity risk management processes. We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: We face risks associated with cybersecurity. For additional details on risks from cybersecurity threats, please refer to "Item 1A. Risk Factors - The occurrence of security breaches and cyber-attacks could negatively impact our business." and "- If the Chinese government chooses to exert more oversight and control over offerings that are conducted overseas and/or foreign investment in China-based issuers, such action could significantly limit or completely hinder our ability to offer or continue to offer securities to investors and cause the value of such securities to significantly decline or be worthless. "

companyName: GULF RESOURCES, INC.

ticker: GURE


text: We have not had previous cybersecurity incidents that have materially affected us. Our risks associated with cybersecurity threats are set forth under "Risk Factors" in Part I, Item 1A in this report.

companyName: Edwards Lifesciences Corp

ticker: EW


text: The Company has adopted processes designed to identify, assess and manage material risks from cybersecurity threats, which are integrated into the Company's overall risk management systems and processes. Those processes include response to and an assessment of internal and external threats to the security, confidentiality, integrity and availability of our data and information systems, along with other material risks to our operations. The Company references the National Institute of Standards and Technology Cybersecurity Framework to help identify, assess and manage cybersecurity risks and has adopted and tested a formal cybersecurity incident response plan. As part of our risk management process, the Company also engages third-party providers to conduct periodic internal and external penetration testing and maturity assessments. The Company stores data on premise and in cloud environments, with security appropriate to the data involved and has adopted controls around, among other things, access and acceptable use, backup and recovery and vendor risk assessment.

companyName: Ecovyst Inc.

ticker: ECVT


text: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which interacts with our Manager's Director of Information Technology and other members of management of our Manager that implement and oversee our Manager's cybersecurity program.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: As part of our cybersecurity risk management procedures, we perform system monitoring and scanning and utilize security tools supported by a third-party managed services provider. We also conduct penetration testing performed by a third-party provider. Employees are enrolled in cybersecurity awareness training courses designed to help them identify cybersecurity concerns and take appropriate actions, and we conduct periodic simulated phishing tests in an effort to further raise cybersecurity awareness and reduce the risk of a successful cyberattack. We have established an incident response plan to guide us in responding to cybersecurity incidents. We also take steps to protect against business interruption and conduct annual restoration testing for major systems. In addition, we are developing a cybersecurity risk management program for our third-party vendors. This program aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity practices.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Risks from Cybersecurity Threats To date, no cybersecurity incident or any risk from cybersecurity threats has materially affected, or has been determined to be reasonably likely to materially affect, us or our operations or financial condition.

companyName: NERDWALLET, INC.

ticker: NRDS


text: During Fiscal 2025, GPS hired a cybersecurity engineer whose mission is to design and implement a comprehensive cybersecurity architecture that elevates the current risk management and strategy while leveraging existing platforms, policies and best practices.

companyName: ARGAN INC

ticker: AGX


text: Our CSPO is responsible for overseeing the day-to-day operation of our cybersecurity risk management program, including reporting systemic cybersecurity risk matters to our senior management and, as appropriate, to the Board of Directors. Our CISO oversees our cybersecurity operations, including all identity and access management functions, cybersecurity incident response operations and the effective operation of the suite of security tools we employ. The CISO and CSPO track key cybersecurity metrics across the enterprise, including metrics related to threat and vulnerability management, cybersecurity incidents and asset management and protection. Our CISO reports the status and efficacy of our cybersecurity operations to our senior management and, as appropriate, to the Board of Directors.

companyName: CENTENE CORP

ticker: CNC


text: To date, cybersecurity risks, including those resulting from any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations or financial condition. We do not believe that cybersecurity risks resulting from any previous cybersecurity incidents, of which we are aware, are reasonably likely to materially affect us. Refer to the risk factor captioned "Cybersecurity incidents and technology disruptions or failures could damage our business operations and reputation, increase our costs and subject us to potential liability" in Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Rithm Capital Corp.

ticker: RITM


text: We also engage the assistance of third-party consultants to increase protection of our information and IT systems and network to help secure long-term value for our stakeholders. Services provided by third-party consultants include, but are not limited to: regular assessments to our cybersecurity program including cyber maturity assessments and penetration tests; risk scoring of our critical business partners and vendors; and participating in incident response processes.

companyName: Robinhood Markets, Inc.

ticker: HOOD


text: Identify, analyze, and determine strategic risk tolerance and/or mitigation direction for compliance risks identified as high and/or those with an increasing risk profile.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: The Company has several security policies that are published and accessible to all employees. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. Marine Products has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine if further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors, outside legal counsel and our independent registered public accounting firm, as appropriate, including on materiality analyses and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions. The Company has a periodic touchpoint with all third-party information technology service providers to identify materials risks from cybersecurity threats.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: annual security awareness trainings are required to be completed by employees, and monthly phishing campaigns and additional function-specific cybersecurity trainings are also conducted; security and risk metrics are reviewed monthly and reported to leadership regularly; external penetration tests are conducted annually by independent third parties and appropriate actions are taken to strengthen controls;

companyName: TE Connectivity plc

ticker: TEL


text: We use multiple mechanisms to identify risks associated with cybersecurity threats, including, but not limited to, the following: • Our information security program describes three levels of risk assessment exercises to be performed or obtained on a periodic basis by the Information Security function, ranging from enterprise-level to system-level risk assessments; • Our Information Security function also includes a threat intelligence team that performs continual threat monitoring activities; • Our Operations and Technology Solutions functions include teams that provide risk review, architectural review, security advisory and application testing services in connection with the development of new solutions, applications and integrations with the potential to create new information technology or information security risks; • Our Internal Audit function performs annual reviews designed to evaluate selected systems' compliance with our information security program and/or recognized external control frameworks; • Independent consultants and auditors evaluate selected systems and applications on an annual basis; and • All team members are empowered to submit self-identified information security risks for analysis by our internal risk management professionals.

companyName: GLOBAL PAYMENTS INC

ticker: GPN


text: With respect to cybersecurity, the audit committee engages in regular discussions with management regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats. Pursuant to our Cybersecurity Policy, our audit committee has appointed a dedicated member of the board of directors who is primarily responsible for our cybersecurity oversight (the "Board Cyber Lead"). TPG's chief information security officer periodically briefs the audit committee and/or the Board Cyber Lead on TPG's information security program and cybersecurity risks, and will brief the Board Cyber Lead or audit committee as needed in connection with any potentially material cybersecurity incidents affecting the Company. Periodic briefings of the Board Cyber Lead and/or audit committee by TPG's chief information security officer typically include topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.

companyName: TPG RE Finance Trust, Inc.

ticker: TRTX


text: a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;

companyName: Associated Capital Group, Inc.

ticker: ACGP


text: As a U.S. Government defense industry contractor, we have experienced cybersecurity attacks and may be subject to significant cybersecurity attacks in the future. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For additional information, see "Our business could be adversely impacted by significant cybersecurity attacks" in Item 1A. Risk Factors above.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Cantor engages third parties from time to time that assist it in the identification, assessment, and management of cybersecurity risks. Cantor also engages cybersecurity specialists to complete assessments of its cybersecurity processes, program and practices, including data protection practices, as well as to conduct targeted attack simulations. The feedback from these assessments and guidance from external specialists informs Cantor's overall risk management system and the development and improvement of our processes to mitigate cybersecurity risks throughout the Company.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: The Company has no employees and is externally managed by our Manager. Pursuant to the terms of the Management Agreement, our Manager manages, operates and administers our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company and our Manager are committed to protecting the confidentiality of all nonpublic information related to the Company's borrowers, shareholders and their personnel.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.

companyName: Outset Medical, Inc.

ticker: OM


text: Following best practices in cyber risk management, we have worked with recognized third-party experts to align the foundational processes, metrics, monitoring, and reporting of the Security Plan with common frameworks such as NIST.

companyName: EGAIN Corp

ticker: EGAN


text: Risk Assessment and Management We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: We recognize the importance of information security practices designed to protect the confidentiality, integrity, and availability of company information and the personal information that we process. Cybersecurity risk management is an integral part of our overall enterprise risk management efforts. We manage cybersecurity risks using a framework based on applicable regulations, industry standards and recognized best practices. Through this framework, we devote significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with our use of third-party software, applications, services, and cloud infrastructure.

companyName: Gold.com, Inc.

ticker: GOLD


text: We have an incident response team comprised of our CIO, executive leaders, management, and internal and external legal counsel, whose primary responsibilities include: • evaluating and validating the impact of an incident; • approving certain incident response countermeasures and remediation actions; • escalating incidents and response countermeasures for approval; and • acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: The Managing Director – Enterprise Technology and Manager, Cybersecurity has extensive experience in technology and cybersecurity, respectively. The cybersecurity team of Onex Corp. is responsible for all aspects of cyber security across Onex.

companyName: Onex Direct Lending BDC Fund


text: Employee Cybersecurity Training. We provide ongoing cybersecurity training and compliance programs to facilitate education for employees who may have access to our data and critical systems. Employee phishing tests are conducted on a monthly basis.

companyName: Knife River Corp

ticker: KNF


text: Innovex's VP of IT reports to Innovex's Chief Financial Officer and is the head of the Company's cybersecurity team. The VP of IT is responsible for assessing and managing Innovex's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Innovex. The Audit Committee of the board of directors oversees Innovex's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The IT department briefs the Audit Committee on the effectiveness of Innovex's cyber risk management program, typically on a semiannual basis. In addition, cybersecurity risks are reviewed by the Innovex board of directors, at least annually, as part of the Company's corporate risk mapping exercise. Innovex faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Innovex has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on Innovex's business, financial condition, results of operations, or cash flows. See "Item 1A. Risk Factors—Risks Related to Technology Advancement—We are subject to cyber security risks. A cyber incident could occur and result in information theft, data corruption, operational disruption and/or financial loss" and "Item 1A. Risk Factors—Risks Related to Technology Advancement—We have experienced IT system disruptions and cyber attacks in the past, and a failure of our IT infrastructure and cyber attacks could adversely impact us in the future."

companyName: Innovex International, Inc.

ticker: INVX


text: We are a member of the Center for Internet Security (CIS), which assists our management in policy and technical support. Some of the benefits of our CIS membership include direct access to cybersecurity advisories and alerts, vulnerability assessments and incident response for entities experiencing a cyber threat, secure information sharing through the Homeland Security Information Network (HISN) portal, tabletop exercises, and weekly malicious domains/IP reports.

companyName: Century Communities, Inc.

ticker: CCS


text: Our Vice President of Information and Business Systems and members of our management team in accordance with our cybersecurity incident response plan, which includes the following members from the following function – legal, IT, finance, audit, operations, engineering, human resources, communications, and additional executives as applicable under the plan – and external cybersecurity support providers (collectively, "IRP stakeholders"), are primarily responsible to assess and manage our material risks from cybersecurity threats.

companyName: ESS Tech, Inc.

ticker: GWH


text: We will develop and implement a cybersecurity risk management program to safeguard the confidentiality, integrity, and availability of our Confidential Information and Critical Systems. Our cybersecurity risk management program will be integrated into our broader enterprise risk management framework and includes a cybersecurity incident response plan.

companyName: Hour Loop, Inc

ticker: HOUR


text: Cybersecurity threats are assessed as part of our enterprise risk management assessments. Our cybersecurity strategy includes procedures for identifying material cybersecurity risks, prioritizing risks and analyzing risk mitigation. Our cybersecurity strategy also includes developing and implementing policies and procedures, escalating any issues as necessary that present a material risk and ensuring that all employees have sufficient cybersecurity training. We have engaged consultants and other third parties in connection with our enterprise risk management assessments, including with respect to cybersecurity.

companyName: Royalty Pharma plc

ticker: RPRX


text: The CFO also notifies the Board and Audit Committee of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Tonix Pharmaceuticals Holding Corp.

ticker: TNXP


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition. However, there can be no assurances that a cybersecurity threat or incident that could have a material impact on the Company will not occur in the future. In response to the rapidly evolving cyber threat environment, the Company continues to invest in data security and system resiliency. See also Item 1A, "Risk Factors" for additional discussion regarding risks related to information technology systems.

companyName: Mayville Engineering Company, Inc.

ticker: MEC


text: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure The Company's cybersecurity program is designed to protect its digital assets and information, and to allow for the secure storage and transmission of proprietary or confidential information regarding our customers, employees, job applicants, and other parties, including financial information, intellectual property, and personal identification information. The Company's cybersecurity program is formed on a risk-based approach in accordance with industry best practices, and is calibrated with recommendations from third party risk management consultants, auditors, cybersecurity professionals, and cybersecurity insurers. Portions of our business are certified under the Cyber Essentials program. Additionally, the Company has performed an ISO 27001 gap analysis and goals have been set forth to comply with ISO 27001 company-wide.

companyName: FOSTER L B CO

ticker: FSTR


text: Implementation of a multi-faceted threat intelligence gathering process. The Information Security and Information Technology teams subscribe to several threat intelligence news feeds and regularly attend cybersecurity threat intelligence webinars, trainings, and peer groups. Information on threat gathering is included in a quarterly report to the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Our Chief Technology Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Technology Officer is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our Director of Engineering Security works with our Chief Technology Officer and Vice President of Engineering Security to develop a cybersecurity strategy that aligns with our business strategy and is responsible for implementing that strategy through his leadership of the day-to-day operations of our Engineering Security team.

companyName: YELP INC

ticker: YELP


text: The CQRC is responsible for oversight of our cybersecurity policy, procedures and risk mitigation. Our information technology (IT) leadership briefs the CQRC on a periodic basis on information security matters, including the current cybersecurity landscape, progress on information security initiatives and accomplishments, and reports on material cybersecurity incidents, as needed. Our enterprise risk management team reports address the Company's cybersecurity risk management processes. Our Chief Legal Officer oversees the management of our ERM program and has over a decade of experience in risk management. The Chair of the CQRC is an expert in enterprise risk assessment and mitigation and holds a CERT Certificate in Cybersecurity Oversight.

companyName: AtriCure, Inc.

ticker: ATRC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have established cybersecurity measures, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks.

companyName: ARTIVION, INC.

ticker: AORT


text: We have continued to expand our security controls, investment, and oversight of our cybersecurity program. The Information Security and Technology management team regularly monitors alerts and reviews the resolutions. We regularly test and review our defenses by performing internal tests, including phishing and vishing tests, external red team penetration testing, and by reviewing our operational policies, procedures, and controls with third-party experts. Prior to engaging a third-party vendor, IT management reviews and approves service organizational control reports. The review of vendor SOC reports for existing vendors is completed annually. Tests, reviews, and assessments are important tools for properly maintaining a robust cybersecurity program.

companyName: Manitex International, Inc.