text: Our cybersecurity program includes comprehensive technology and risk oversight programs designed to ensure that our technology systems and cybersecurity education programs are effective and that we are prepared to report and manage information security risks. Developed using collaboration and transparency principles, we maintain a suite of information and cybersecurity policies, standards and guides based on commonly adopted cybersecurity standards, frameworks and regulatory requirements, including ISO 27001 and publications from the National Institute of Standards and Technology and the Center for Information Security. Furthermore, we perform periodic evaluations of our security programs, information technology infrastructure and information security management systems through internal self-assessments and external independent consultations. In addition, we conduct regular security monitoring for internal and external threats to the confidentiality and integrity of our information assets, and our cybersecurity programs undergo periodic testing with the purpose of achieving swift and orderly restoration of business operations in the event of a cybersecurity incident. Cyber hygiene is integrated into our culture from employee onboarding and lasts throughout the employee life cycle, using various tools, such as frequent information security awareness messages and annual cybersecurity awareness training. As part of testing our programs, we regularly conduct internal simulated phishing campaigns. The Company also maintains comprehensive cyber insurance. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Current Cybersecurity Risk Posture For an additional description of the risks from cybersecurity threats that may materially affect the Company, see "Risk Factors" in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised by a cybersecurity incident, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences."

companyName: KYNTRA BIO, INC.

ticker: KYNB

secItem: Item 1C


text: We have established and maintain a cybersecurity incident response plan that addresses our response to a cybersecurity incident.

companyName: VERACYTE, INC.

ticker: VCYT


text: For the year ended December 31, 2023, there have been no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For a description of risks related to our information technology systems, including cybersecurity threats, see Item 1A, "Risk Factors."

companyName: GENTEX CORP

ticker: GNTX


text: Our risks associated with cybersecurity threats are set forth under " Risk Factors " in Part I, Item 1A in this report. Except as set forth therein, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: The identification of risks is a multifaceted process that involves a range of activities. This includes monitoring of guidance issued by regulatory authorities, participating in professional forums, conducting both internal and external audits, collaborating with third-party services, reviewing policies, and adhering to best practice frameworks including Federal Financial Institutions Examination Council ("FFIEC") guidance and information security requirements established in the Gramm-Leach Bliley Act, along with other relevant state laws and agency regulations. Furthermore, we emphasize the importance of maintaining a collaborative relationship with third-party service providers/vendors. This collaborative approach enhances our risk management capabilities and ensures a shared commitment to maintaining a secure information environment.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Management Strategy maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually by our CIO and Executive Management Team as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our CIO and Executive Management Team to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate whether we have adequate controls in place utilizing a risk-based approach that tailors and applies best practice from various industry standard IT Management frameworks such as Information Technology Infrastructure Library (ITIL), Control Objectives for Information Technologies (COBIT), National Institute of Standards and Technology CyberSecurity Framework, and ISO/IEC 27001.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: The Audit Committee or the full Board of Directors receive quarterly cybersecurity updates, which are prepared by our VP of IT Security. The report provides comprehensive cybersecurity updates, including topics such as security incidents, our threat landscape, compliance, key performance metrics and material risks, along with updates on general cybersecurity project execution.

companyName: SEMTECH CORP

ticker: SMTC


text: Collection and reporting of status information about risks and their mitigation plans, response to changes in risks over time, and management oversight of corrective measures taken in accordance with the mitigation plan.

companyName: CXApp Inc.

ticker: CXAI


text: Our CSO reports to our General Counsel and has principal executive responsibility and oversight for the Company's strategy, planning, and operations on the management of both physical security and cybersecurity risk. Our CSO has extensive cybersecurity and program management experience and previously served in relevant leadership positions at another large multinational corporation and the U.S. Department of Defense. He is supported by our CISO, who has extensive cybersecurity experience in both the private and public sectors, and a team of cybersecurity professionals with relevant and expansive educational and industry experience.

companyName: Dell Technologies Inc.

ticker: DELL


text: In addition, we have Company-wide policies and procedures concerning cybersecurity matters, including access security, system change management, development lifecycle, incident management and business continuity/disaster recovery policies. These policies go through an annual internal review process and are approved by appropriate members of management. Presidio Property Trust uses a third -party consultant to assess the Company's compliance with Sarbanes Oxley requirements.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: As of the date of this report, we have not experienced cybersecurity incidents or are aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information about our cybersecurity risks, please see the section of this report titled " Risk Factors."

companyName: ALPINE IMMUNE SCIENCES, INC.


text: The information security program, policies, and standards are managed by the Vice President of Enterprise Technology Risk Management ("ETRM"), who leads the Company's enterprise-wide technology risk management function. The ETRM function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and Operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: The Information Security Committee meets periodically and as circumstances warrant to discuss and monitor prevention, detection, and remediation of risks from cybersecurity threats. When appropriate, cyber or information security incidents would be escalated by the CISO to our executive leadership team and/or our disclosure committee. On a regular basis, the CISO also updates the executive management team on developments within the cybersecurity sphere.

companyName: Butterfly Network, Inc.

ticker: BFLY


text: Management is responsible for day-to-day monitoring of the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CISO, who reports to our Chief Digital Officer, has primary oversight of material risks from cybersecurity and data privacy matters. Our CISO has more than 25 years of experience across various information technology, information security and management roles, including leading the development and implementation of cybersecurity and data privacy strategies for the member and customer-facing aspects of our business. In addition, our CISO holds degrees in Engineering Technology and Information Systems and Technology, and industry certifications awarded by the International Information System Security Certification Consortium (ISC2); Certified Information Systems Security Professional (CISSP), and Information Systems Security Engineering Professional (ISSEP).

companyName: Wheels Up Experience Inc.

ticker: UP


text: We leverage knowledge, people, processes, and technology to develop, implement, manage, and maintain cybersecurity controls. Our information security program employs several detective and defensive tools designed to monitor, alert, and block suspicious activity, as well as to identify, report and address any suspected threats. Our information security program is a continuous on-going periodically updated program that is supported by policies, procedures, standards and guidelines; an Enterprise-wide Vendor Management Program; a Technology Project Management Office (PMO) and an Enterprise-wide Business Continuity and Disaster Recovery Program. This integration is aimed at ensuring that program is embedded into the organization's lines of business, support functions and third-party vendor management program.

companyName: Amerant Bancorp Inc.

ticker: AMTB


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain management, including our Director of Information Technology, who reports to our Chief Operating Officer. Our Director of Information Technology is responsible for monitoring third-party specialists, helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel. Our Chief Operating Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Our cybersecurity risk management program includes the following: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Extra Space Storage Inc.

ticker: EXR


text: With respect to our employees, we run a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on data protection and malware detection, policy and process awareness, periodic phishing simulations and other kinds of preparedness testing.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: We use information technology and third-party service providers to support our global business processes and activities, which exposes us to cybersecurity risks. KDP's risk management strategy includes ongoing cybersecurity risk assessment and reporting, incident management, and a diligence and risk management process for third-party service providers. Employees with network access participate in ongoing phishing, social engineering, and cybersecurity awareness training efforts, and we also conduct periodic tabletop exercises led by external consultants.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: While we focus on prevention and detection, we have response and recovery plans in place, as well as service agreements and partner engagements should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The plan defines the roles and responsibilities of our IT and security teams and other functional teams that comprise the cybersecurity incident response team, as well as provides controls and procedures for timely and accurate reporting of material cybersecurity incidents. Significant cybersecurity incidents are reviewed by a cross-functional team to determine whether further escalation is appropriate. Any incident that potentially is, or may become, material is reported to senior management for materiality and disclosure determinations. We also maintain cyber liability insurance coverage. While we did not experience any material data breaches in 2023 and no risks from cybersecurity threats have materially impacted or are reasonably likely to materially impact the Company's business strategy, operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: WESCO INTERNATIONAL INC

ticker: WCC


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF), the International Organization for Standardization Information Security Management System Standard (ISO 27001) and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to any cybersecurity incidents.

companyName: Shockwave Medical, Inc.


text: A rule issued by federal financial regulatory agencies imposes upon banking organizations and their service providers notification requirements for significant cybersecurity incidents. Specifically, the rule requires banking organizations to notify their primary federal regulator as soon as possible and no later than 36 hours after the discovery of a "computer-security incident" that rises to the level of a "notification incident" as those terms are defined in the rule. Banks' service providers are required under that rule to notify any affected bank to or on behalf of which the service provider provides services "as soon as possible" after determining that it has experienced an incident that materially disrupts or degrades, or is reasonably likely to materially disrupt or degrade, covered services provided to such bank for as much as four hours.

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: VanEck maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact VanEck's business in the event of a cybersecurity incident affecting those third-party systems. Third-party risks are included within VanEck's NIST framework, and risk identification and mitigation are supported by VanEck's cybersecurity program. VanEck also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Acknowledging the critical importance of cybersecurity, our management and Board are dedicated to maintaining the trust and confidence of our business partners and employees. This includes managing cybersecurity risks as an integral component of our overall risk management framework. While cybersecurity responsibility is shared across all employees, our Board plays a pivotal role in the oversight of our risk management processes, including cybersecurity threats. Our executive officers manage the day-to-day material risks we face, adopting a cross-functional approach to address cybersecurity risks by identifying, preventing, and mitigating cybersecurity threats and effectively responding to incidents when they occur.

companyName: Elvictor Group, Inc.

ticker: ELVG


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate; and • Reviewing and evaluating new developments in the cyber threat landscape.

companyName: Arcosa, Inc.

ticker: ACA


text: Our Information Security Program includes an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: GREEN DOT CORP

ticker: GDOT


text: The CISO is responsible for developing and implementing the Company's cybersecurity and information security program, reporting on cybersecurity matters to the Board and senior management, ensuring compliance with standards, remediating known risks, overseeing incident detection and response and leading the employee cybersecurity awareness training program. The Vice President – Cyber Risk Governance is responsible for third party cybersecurity risk management and cybersecurity risk and controls governance. The Senior Vice President – Enterprise Information Security provides regular updates to senior management and the Board's Risk Committee regarding the effectiveness of security controls and the state of the Company's cybersecurity program and risk level.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: We engage in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We may engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to those charged with governance by our Senior Vice President of Information Technology, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these activities.

companyName: STORE CAPITAL LLC


text: Nominating and Corporate Governance Committee of the Board is responsible for oversight of risks from cybersecurity threats in conjunction with management. The committee receives interim reports and updates from the senior management, and management has committed to updating the full Board on a quarterly basis with respect to the management of risks from cybersecurity threats. Such reports cover the Company's information technology security program, including its current status, capabilities, objectives and plans, as well as the evolving cybersecurity threat landscape. Additionally, the Nominating and Corporate Governance Committee considers risks from cybersecurity threats as part of its oversight of the Company's business strategy, risk management, and financial oversight by requiring quarterly updates from management at its Board meetings.

companyName: ENvue Medical, Inc.

ticker: FEED


text: Our strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors in this Annual Report.

companyName: Townsquare Media, Inc.

ticker: TSQ


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and recovery processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: An Incident Response Committee that includes representatives from key areas of the Company meets in the event of cybersecurity incidents. The Committee ensures the proper notifications are made in order to comply with all relevant laws, rules and regulations.

companyName: WESTAMERICA BANCORPORATION

ticker: WABC


text: Certain significant risks identified by the enterprise risk management process, such as cybersecurity, have a cross-functional team assigned to assess and manage the specific risk and may have oversight by a committee other than the Audit Committee. The Senior Vice President, Chief Technology Officer (CTO) and Vice President, Chief Nuclear Officer (CNO), have overall accountability for the assessment, identification and management of cybersecurity risks on behalf of the Evergy Companies and Wolf Creek, respectively, subject to review by the Evergy Board and its committees. The CTO and CNO leverage the input and operations of the security management and operations team within each organizational structure. The security teams, comprised of cybersecurity professionals, lead the daily cyber risk mitigation efforts including cyber training of the workforce, threat monitoring, identification of potential cyber events and applicable compliance obligations. See Part I, Item 1, Business – Information about Evergy's Executive Officers for a description of the CTO's experience. The CNO has management responsibility of Wolf Creek where he has served in executive capacities since joining Wolf Creek in 2014. Prior to joining Wolf Creek, he served as vice president of engineering and site vice president of another nuclear power plant from 2009 until 2014.

companyName: Evergy, Inc.

ticker: EVRG


text: Cybersecurity risk identification, assessment, and management are integrated into Ford Credit's overall enterprise risk management program. As part of its enterprise risk management efforts, the Ford Credit Board meets with senior management to assess and respond to critical business risks. These critical enterprise risks are assessed by senior management annually and discussed with the Ford Credit Board. Then each of the top risks are validated, prioritized, and assigned risk owners who are responsible to oversee risk assessment, develop and implement mitigation plans, and provide regular updates to the Board (and/or Board committee assigned to the risk). In this way, critical business risks, including cybersecurity risk, benefit from both top-down and bottom-up risk management efforts that we believe are reasonably designed to escalate key risk and control issues to senior management and the Ford Credit Board.

companyName: FORD MOTOR CREDIT CO LLC


text: The Information Security Director, who reports to the CIO, is responsible for establishing basic policies and procedures related to cybersecurity. The Information Security Director is also responsible for selecting the CIRT and the CIC to lead the response to each incident. Established policies and procedures are employed by the CIRT in planning and executing a response to a cybersecurity incident. The CIO and the Information Security Director have over 56 combined years of information technology and program management experience and have served over 32 combined years in the Company's corporate information security organization. They are familiar with the Company's cybersecurity landscape, risks and best practices for mitigation of those risks identified.

companyName: Coca-Cola Consolidated, Inc.

ticker: COKE


text: The members of management who are primarily responsible for assessing and managing our material risks from cybersecurity threats are our Chief Information Security Officer and our SVP, Engineering and Support. Our Chief Information Security Officer joined Snowflake in 2023 and previously served in various cybersecurity roles for over 12 years across multiple technology sectors, including manufacturing, software, and services. Our SVP, Engineering and Support joined Snowflake as VP of AI Engineering in 2023 in connection with our acquisition of Neeva, where he served as the head of engineering and, prior to that, he served in various roles at Google, including as VP Engineering in various technical leadership roles. Each of our Chief Information Security Officer and SVP, Engineering and Support is responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into our overall risk management strategy, communicating key priorities to relevant personnel, approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Snowflake Inc.

ticker: SNOW


text: Disclosure of Management's Responsibility The Company's Chief Financial Officer is responsible for overseeing the Cybersecurity Risk Management Program and leading the Company's efforts to mitigate technology risks in partnership with various business leaders in the organization. For qualifications of the CFO refer to Item 10 of the Form 10-K. We have protocols, policies and tools in place to mitigate cybersecurity risk. They also provide the administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and availability of confidential information and personal information from unauthorized access, use, disclosure, alteration, destruction or theft. In addition, we engage an independent third party annually to assess our IT general controls and IT security. Special focus is given to maintaining and improving our alignment with ISO 27001. Additionally, we have a cybersecurity incident response plan in place that provides a documented framework for handling high and low severity security incidents and facilitates coordination across multiple parts of the business. Finally, cybersecurity is integrated into the Company's training as all employees are required to take security awareness training.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Service Providers. Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Company maintains a Third-Party Risk Management Program, which is implemented through a Vendor Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive the Company data. The Vendor Management Policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Vendor Management Program is audited as part of the Company's annual Internal Audit Risk Assessment.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Our VP of Information Technology oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our VP of Information Technology or department designee are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include weekly assessments for all endpoints and real-time notifications from security solutions, which include a combination of cloud and client-based applications.

companyName: PMV Pharmaceuticals, Inc.

ticker: PMVP


text: Board Governance The Audit Committee and the Board consider cybersecurity part of the Company's overall enterprise risk management ("ERM") function, which the Audit Committee oversees. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Our Board of Directors is responsible for overseeing cybersecurity risk, primarily through the Audit Committee. Cybersecurity reviews by the Audit Committee and the Board of Directors are scheduled to occur at least quarterly and annually, respectively, or more frequently, as deemed necessary or advisable. Such presentations to the Audit Committee and Board of Directors, as applicable, are made by our COLO and Global CISO and address topics such as cybersecurity threats, incidents, risks, results from internal and third-party assessments, progress towards risk-mitigation goals, the functioning of our incident response program, and regulatory developments. At times, the Audit Committee may receive additional cybersecurity risk reviews from other members of management and/or internal cybersecurity experts on certain of our key business segments and products. The Audit Committee regularly reports to our Board of Directors regarding the committee's oversight of such cybersecurity matters. Additionally, the COLO and Global CISO may provide ad hoc updates to the Board of Directors and/or the Audit Committee if necessitated by a security incident or other significant developments.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: Management Leadership Team, with oversight from the Board of Directors, has implement ed a comprehensive cybersecurity program, including incident response process, aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and NIST Computer Security Incident Handling Guide (NIST SP 800-61) to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: The Company's information security program consists of various processes designed to ensure that the Company and its electronic assets are shielded from cyber events that may compromise the Company's ability to successfully execute its business on a day-to-day basis. These processes cover areas such as, but not limited to, risk management, access control, anti-virus management, sensitive data management, electronic communication, risk/security reporting, incident response planning and business continuation planning. Our Information Security Team is comprised of our Chief Financial Officer and third-party IT support. It is responsible for (i) administering the Company's policies and procedures in conjunction with our third-party information technology provider, Netranom Communications ("IT Provider"); (ii) distributing our policies to consultants and providing training; (iii) responding to consultant inquiries regarding our policies; (iv) overseeing our cybersecurity program and leading incident response efforts; (v) monitoring for cybersecurity-related legal or regulatory developments; coordinating with management, our IT Provider and /or legal counsel to discuss cybersecurity-related issues or topics; and (vi) reviewing and updating our policies as necessary and on an annual basis.

companyName: ProtoKinetix, Inc.

ticker: PKTX


text: Cybersecurity partners, including assessors, consultants, advisors and other third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data and services. The cybersecurity partners provide services including, but not limited to systems inventory monitoring, configuration management, periodic network scanning, user management, mobile device monitoring, capacity monitoring, network protection and monitoring, IPS/IDS management, remote access monitoring and management, user activity monitoring, data backups management, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We recognize the value of personal and financial information and are dedicated to protecting the confidentiality, integrity, and availability of our data and systems. From the Board of Directors to our Customer Service Representatives, all individuals at the organization are responsible for handling confidential data with care.

companyName: WAFD INC

ticker: WAFD


text: The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and the ERM Committee. These committees meet quarterly, and their activities are reported to the full Board of Directors.

companyName: RENASANT CORP

ticker: RNST


text: In addition, the Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents. Furthermore, the information security team develops and provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.

companyName: IMAX CORP

ticker: IMAX


text: Although, as a blank check company, we do not have any operations, we are nonetheless subject to the risk of cybersecurity incidents. Among other things, the investments in our Trust Account and bank deposits may be vulnerable to such incidents, and we may depend on the digital technologies of third parties.

companyName: Merlin, Inc.

ticker: MRLN


text: Processes and Risk Assessment Blue Owl's cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that they store or process; (ii) maintaining the security and availability of systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and its responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: Blue Owl Real Estate Net Lease Trust


text: Due to our structure as a REIT, the cybersecurity program, processes and strategy described in this section are limited to the corporate systems, information and service providers belonging to or supporting the REIT. In order to maintain REIT status, the Company does not operate or manage its hotels. We lease each of our hotels to the TRS Lessee or one of its subsidiaries, which engages with third-party eligible management companies to operate and manage all aspects of the properties; and those third-party managers, in turn, rely on systems that they manage directly or indirectly (through their own service providers), including but not limited to reservation systems, billing, building and property management systems, point-of-sale systems, and financial transactions and records that store and process proprietary or personal information. In light of this structure, we do not have actual or contractual access to the systems or information maintained by the third-party managers, and we must instead rely on such managers' programs and processes to protect the properties in which we invest from risks associated with cybersecurity threats.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Alternus employs a strategic, multilayered approach to cybersecurity based on the National Institute of Standards and Technology (NIST) framework. The company maintains a dedicated internal cybersecurity team that oversees the development, implementation, and continual improvement of cybersecurity policies, tools, and procedures to identify, prevent, detect, respond to, and recover from evolving cyber threats.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: The Audit Committee reviews and considers our risks relating to cybersecurity and receives and reviews from our Information Security Steering Committee ("ISSC") regular reports on our cyber readiness, adversary assessment, risk profile status, and any countermeasures undertaken or considered by us. Our ISSC also updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: TechnipFMC plc

ticker: FTI


text: The Company maintains a comprehensive information security program that is designed to identify, protect against, detect, and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Our Board of Directors (the "Board") and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees. The Board and the Audit Committee of the Board (the "Audit Committee") are actively involved in oversight of our cybersecurity program as part of our approach to risk management. Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework. In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information with the aim to continually improve security to keep pace with the evolving cyber threat landscape.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: We have implemented a cybersecurity program to address all levels of cybersecurity threats based on our determination of the risk level. Our program includes policies and procedures that dictate the method in which we develop, deploy, and maintain security measures and controls. We use a cybersecurity framework to select security controls to protect against identified risks. When designing the controls, we consider the severity of risk and its impact on the Company, including the cost of the control and the impact it may have on the Company operations. We use various combinations of controls and tools to mitigate the risk to the Company such as firewalls and intrusion devices, endpoint threat detection systems, multi-factor authentication systems, endpoint threat detection systems as well patch management to prevent exploitable vulnerabilities.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: Verma, joined MicroVision in 2021 as our Chief Financial Officer. He is an experienced risk management professional and currently oversees the Company's accounting and finance strategies, including risk management. Mr. Verma also oversees our IT team and, with regular communication with the team, is responsible for approving the IT budget, hiring of IT personnel, including third-party consultants, and approving cybersecurity processes and other cybersecurity-related matters. Although we do not currently employ a chief information security officer, we are working with an outside consulting firm that is serving in this role and assisting our internal team with the primary responsibility of overseeing our cybersecurity measures and risks.

companyName: MICROVISION, INC.

ticker: MVIS


text: The day to day operations of our cybersecurity risk management program are overseen by our IT and Information Security teams. Our cybersecurity program is run by our Vice President of Engineering for InfoSec, Darren Redmond, who reports to our COO, Filip Popovic. Our COO has served in that position since June 2024. Mr. Redmond has served in this position for the last 2 years and has worked at Groupon for over 8 years, and, prior to Groupon, his experience includes serving as the CTO of Knowledge Point, a learning materials management service provider. Our Information Security Officer reports to Mr. Redmond and monitors prevention, detection, mitigation and remediation efforts through regular communication and reporting from professionals in the Information Security team, many of whom hold cybersecurity certifications such as a Certified Information Systems, Security Professional or Certified Information Security Manager, and through the use of technological tools, software and results from third party audits. Our Information Security Officer joined Groupon in November 2023, and, prior to Groupon, was previously in Vodafone, based in Hungary. Our Security Manager and Security Operation Center Manager also have extensive experience assessing and managing cybersecurity programs and cybersecurity risk.

companyName: Groupon, Inc.

ticker: GRPN


text: Our CCO, supported by our Information Security Team, has primary responsibility for managing our cybersecurity threat management program. We maintain rigorous standards for our information security leadership positions, including requiring extensive experience in building and leading cybersecurity security teams and implementing enterprise-wide cybersecurity programs. Our CCO and Information Security Team continue to execute on our established cybersecurity strategy and risk management framework.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We employ a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Nerdy Inc.

ticker: NRDY


text: We rely on a multidisciplinary team, including our information security function, management, and third-party service providers to identify, assess, remediate and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, utilizing internal and external audits, and conducting threat and vulnerability assessments.

companyName: Red Cat Holdings, Inc.

ticker: RCAT


text: We have controls in place intended to assess our cybersecurity posture and prevent successful access to our critical systems, including, but not limited to: vulnerability scanning on systems and applications; endpoint detection capabilities to identify malware and other indicators of threat activity; multifactor authentication; and blocking of malicious e-mail. In addition, we also provide annual cybersecurity awareness training for our employees. Further, we engage with an external security firm to perform regular penetration testing. We subject our critical third-party service providers to risk assessment prior to engagement, and periodically thereafter, to identify material risks. Additionally, we have a process to engage with these third parties to understand potential impacts of, and remediation efforts associated with, critical vulnerabilities.

companyName: MediXall Group, Inc.

ticker: MDXL


text: Risks from Cybersecurity Threats We and our third-party administrators, vendors and partners are subject to ongoing cybersecurity threats. While we cannot guarantee that these threats will not have an adverse impact on us, these threats did not materially affect us during the year ended December 31, 2024 and we do not believe such threats are reasonably likely to materially affect us in the future, including with respect to our business strategy, results of operations, or financial condition. For more information on risks related to cybersecurity, refer to "Risk Factors—Risks Related to Cybersecurity, Data Privacy and Intellectual Property Protection."

companyName: MKS INC

ticker: MKSI


text: The CISO, in coordination with the other members of the executive management team, works collaboratively across BlackLine to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. To facilitate the success of such programs, we designate certain employees as security champions throughout BlackLine to respond to cybersecurity incidents in accordance with our incident response plan. Through communications with these employees, the CISO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, and reports such incidents to the Board, the Audit Committee, and the Technology and Cybersecurity Committee, when appropriate, as discussed above.

companyName: BLACKLINE, INC.

ticker: BL


text: Evolving Threats The program utilizes various resources, inclusive of third-party partners, to support an awareness and understanding of evolving cybersecurity threats, allowing the organization to be actively engaged in understanding and staying abreast of risks, and thereby supporting informed decision-making.

companyName: CROSS COUNTRY HEALTHCARE INC

ticker: CCRN


text: Management's Role Managing Risk The CISO, General Counsel & Chief Compliance Officer (GC & CCO), Chief Operating Officer (COO) and the Chief Executive Officer (CEO) play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a quarterly basis. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Risk mitigation efforts and insurance; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CISO, GC & CCO, COO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Flywire. Our Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Flywire Corp

ticker: FLYW


text: As part of our cybersecurity risk management and strategy, the Company invests in processes, resources and incremental technical defenses to help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. We have enterprise-level compliance processes, policies and insurance coverage in place, including related to data protection and cybersecurity. We utilize the ISO 27001:2022 information security standard to drive our risk assessment and to identify and prioritize technology and process investments. Additionally, Ferguson maintains a Security Operations Center ("SOC") with enterprise event visibility.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Our CISO leads the strategy, engineering and operations of cybersecurity across the Company and is responsible for providing annual updates to our Board, the ERMC and the ORMC on our TRIS program, as well as ad hoc updates on information security and cybersecurity matters. Our current CISO has held a series of roles in telecommunications, networking and information security at American Express, including promotion to the CISO role in 2013 and the addition of responsibility for technology risk management in 2023. Prior to joining American Express, our current CISO served in a variety of technology leadership roles at a public pharmaceutical and biotechnology company for 14 years. Our CISO reports to the Chief Information Officer, information about whom is included in "Information About Our Executive Officers" under "Business." For more information on our risk governance structure, see "Risk Management — Governance" and "Risk Management —Operational Risk Management Process" under "MD&A."

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Material Risks and Integrated Overall Risk Management have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management continuously evaluate and addresses cybersecurity risks in alignment with our business objectives and operational needs. from Cybersecurity Threats have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Alset Inc.

ticker: AEI


text: The Company's Senior Vice President and Chief Information Officer ("CIO"), who reports to the Company's Chief Executive Officer, is responsible for the operation of the Company's information security program. Our CIO is an IT veteran with over 25 years of experience in building and maturing cyber programs for large public companies. The CIO is supported by an internal team of certified security analysts who work in conjunction with leading security operations managed service providers to manage detection and response.

companyName: Dorman Products, Inc.

ticker: DORM


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including assessments, tabletop exercises, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company also engages third parties to perform assessments on our cybersecurity measures.

companyName: BRC Inc.

ticker: BRCC


text: AEP maintains dedicated cybersecurity and physical security teams which are responsible for the design, implementation and execution of AEP's security risk management strategy, which includes cybersecurity. AEP's cybersecurity team operates a 24/7 Cybersecurity Intelligence and Response Center responsible for monitoring the AEP System for cyber risks and threats. The cybersecurity team constantly scans the AEP System for cyber risks and threats. In addition, the cybersecurity team actively monitors best practices, performs penetration testing, leads response exercises and internal awareness campaigns and provides training and communication across the organization. AEP's security awareness training is mandatory for all employees and includes regular phish email testing to train employees to identify malicious emails that could put AEP at risk.

companyName: AEP Transmission Company, LLC


text: As part of the above processes, we engage various professional services firms that use external third-party tools to assess our internal cybersecurity programs and compliance with applicable practices and standards. Our use of these third parties allows us to leverage specialized knowledge, insights and industry best practices.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: Management is responsible for managing risks and informing the Board of the Company's material near- and long-term risks and risk management strategies. Management presents the Company's risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.

companyName: IMAX CORP

ticker: IMAX


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our information assets and communication networks and mitigate risks to our assets, data, employees and customers. Our cybersecurity risk management program includes a cybersecurity incident response plan which is regularly updated to include structured processes encompassing preparation, identification, notification, containment, analysis, eradication, recovery and follow up.

companyName: COOPER COMPANIES, INC.

ticker: COO


text: Cytokinetics' Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board has established oversight mechanisms designed to ensure effective governance in managing material risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: CYTOKINETICS INC

ticker: CYTK


text: Cyber Risk Management and Strategy The Company relies on electronic systems and information technologies to conduct its operations. We have adopted and maintain a cybersecurity risk management program, in accordance with our risk profile and business, that is informed by industry standards. The risk management program and the security policies that have been established as part of it, are reviewed annually as part of our overall risk management procedures.

companyName: Adicet Bio, Inc.

ticker: ACET


text: Failure to maintain the security and functionality of our information systems and data, to prevent a cybersecurity attack or breach, or to comply with applicable privacy and consumer protection laws, including HIPAA, could adversely affect our business, reputation, and relationships with our residents, associates, and referral sources and subject us to remediation costs, government inquiries, and liabilities, any of which could materially and adversely impact our revenues, results of operations, and cash flow. Further information is discussed in "Item 1A. Risk Factors." To date, the aforementioned cybersecurity risks and any incidents that we, or our third-party vendors, have experienced have not materially affected us, including our business, strategy, results of operations, or financial condition.

companyName: Brookdale Senior Living Inc.

ticker: BKD


text: The Company employs third parties in certain aspects of its information security and cybersecurity risk management. For example, we utilize third parties to conduct certain security operations and maintain certain information security infrastructure. We have adopted a Third Party Risk Management Policy, which addresses the identification, measurement, monitoring, and management of our third-party service provider relationships, including those related to information security. The Director of Third-Party Risk Management, along with the CISO, assess and monitor information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the Director of Third-Party Risk Management works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such incidents to the CRO, ERMC, TOC, and, if applicable, the Board.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including " If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation and mass arbitration demands; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: GENELUX Corp

ticker: GNLX


text: We also have adopted a cybersecurity incident response and recovery plan to enable us to properly respond to cybersecurity incidents that may affect the function and security of the Company, our IT assets, customer and employee data, information resources, and business operations. We have adopted cyber and data security policies, which address matters including user access, incident response, third-party compliance, personal devices, and data privacy. These policies are reviewed annually, including by our independent auditor. We also maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: A-Mark's Chief Information Officer (CIO) chairs the CCDC. Our CIO brings over 14 years of IT experience to A-Mark. Since joining A-Mark in 2019, he has been pivotal in enhancing our data privacy compliance program, significantly strengthening our data protection and privacy measures, particularly ensuring protection of sensitive data. The co-vice chairs of the CCDC are A-Mark's Vice President of IT and JM Bullion's Vice President of Digital and Technology. Our Vice President of IT has over 25 years of experience in IT working in various industries including ecommerce, health care, and financial industries focusing on IT operations, cybersecurity and compliance. Since joining the company in 2014, he has been instrumental in the creation and growth of our cybersecurity program. Our Vice President of Digital and Technology at JM Bullion has comprehensive experience in the cybersecurity field. He successfully established a 24/7 security operation center (SOC) to continuously detect and respond to security incidents, as well as implemented various advanced services to proactively detect vulnerabilities on potential attack surfaces with high accuracy spanning across assets, applications, data, endpoints and network. He also centralized the workforce identity and access management (IAM) of the various systems for improved administration and control at the subsidiary level. He joined JM Bullion in 2015 and has served in his current role as Vice President of Digital and Technology since 2021.

companyName: Gold.com, Inc.

ticker: GOLD


text: We have implemented policies, standards, and technical controls based on the National Institute of Standards and Technology ("NIST") framework with the aim of protecting our networks and applications, to safeguard the confidentiality of sensitive information entrusted to us. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology. ISG performs annual assessments, by two independent third parties, against the International Organization Standardization ("ISO") 27001 Information Security Management System requirements for which we maintain certification. ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials, and is preparing for SOC2 attestation across our GovernX platforms.

companyName: Information Services Group Inc.

ticker: III


text: Key elements of our cybersecurity risk management program includes: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external advisors and service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and alignment with the broader corporate business continuity plan; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Verona Pharma plc

ticker: VRNA


text: To evaluate and enhance its cybersecurity program, the Company periodically utilizes third-party experts to undertake maturity assessments of the Company's information security program.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas:

companyName: Apollo Infrastructure Co LLC


text: Cybersecurity incidents: Our public-facing website complies with WCAG 2.2 level AA standards for accessibility. We manage various databases, including those on Amazon and Google Clouds, each with three sets of development, testing, and production environments. Our main data warehousing solutions is Amazon Redshift, complemented by Amazon S3 for object storage.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Cybersecurity incidents are investigated and remediated in accordance with our incident response procedures and other policies and procedures. Cybersecurity is overseen by the Audit Committee of the Board of Directors. The Senior Director - Information Security coordinates with and directs cybersecurity initiatives through information technology and cybersecurity personnel throughout RPM.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: Product Cybersecurity The Product Security Incident Response Team (the "PSIRT"), which is supervised by the CTO, is responsible for responding to product related cybersecurity incidents, which at times involve collaborating with the Enterprise Cybersecurity SOC. The PSIRT team regularly analyzes vulnerabilities reported by threat intelligence and public vulnerability reporting databases and determines whether any of those vulnerabilities are present in the Company's products. Vulnerabilities identified are reviewed by the Vice President of Product Security on a weekly basis with involvement from the CTO and the Company's legal staff as necessary. For all vulnerabilities identified, the PSIRT reviews whether adequate mitigations are already in place. In situations where adequate mitigations are not present, the PSIRT works with the customer to address the concern which may involve adding additional mitigations to the product.

companyName: Aptiv PLC

ticker: APTV


text: Managing Material Risks and Integrated Overall Risk Management We have developed an Information Security Program (the "Program") as part of our overall risk assessment and Enterprise Risk Management ("ERM") to address material risks from potential cybersecurity threats, as well as to facilitate the governance and oversight of cybersecurity risks. The Program, which is administered by our Chief Risk Officer, includes policies and procedures that identify how security measures and controls are developed, implemented, maintained and assessed.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Our Director of Information Technology is responsible for monitoring and assessing the the day-to-day management of cybersecurity risks. The individual who currently holds the position of Director of Information Technology has approximately fifteen years of IT management and cybersecurity experience. Our IT Committee, which is comprised of senior leadership team members across our Information Technology, Finance, Law and Innovation departments, is responsible for overseeing our cybersecurity policies and processes. Our IT Committee meets regularly with our Director of Information Technology to evaluate cybersecurity threats. We maintain an established process to notify the IT committee of identified cyber incidents and to provide an assessment of the potential criticality and impact of such incidents. We have also implemented procedures for response and containment efforts to address the actual or potential impact of identified cybersecurity incidents, as applicable.

companyName: Absci Corp

ticker: ABSI


text: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate. We use a number of means to assess cyber risks related to our third-party service providers, including vendor questionnaires, conducting due diligence in connection with onboarding new vendors and annual due diligence with respect to key third-party vendors. We also seek to collect and assess cybersecurity audit reports and other supporting documentation when available.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: The Board has primary responsibility for oversight of the Company's cybersecurity risks. The Audit Committee is also responsible for reviewing the Company's cybersecurity risks and the steps that management has taken to protect against threats to the Company's information systems and security. The Audit Committee has formed a Cybersecurity Risk Subcommittee consisting of two independent directors to assist the Audit Committee in its oversight of cybersecurity risks. By its charter, all members of the Cybersecurity Risk Subcommittee must have a background or experience in information technology or cybersecurity and an understanding of cyber threats, risk mitigation and policy.

companyName: AGILYSYS INC

ticker: AGYS


text: Our board of directors is responsible for risk oversight, including cybersecurity risks, which occurs at the board of directors level and through the Audit Committee's oversight of cybersecurity and other information technology risks. Additionally, we have a Cybersecurity Disclosure Committee ("CDC"), which includes representation from our Information Technology, Legal, Internal Audit and Accounting and Reporting teams. The CDC is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The CDC also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, and ensuring the cybersecurity strategy is in alignment with business objectives.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Our security efforts are managed by a team of IT, engineering, operations, and legal professionals. We have established a cross-functional leadership team, consisting of executive-level leaders, that meets regularly to review cybersecurity matters and evaluate emerging threats. With oversight and guidance provided by the cross-functional leadership team, our information security teams refine our practices to address emerging security risks and changes in regulations. Our leadership team also participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct the company's response to and assessment of certain cybersecurity incidents.

companyName: Blaize Holdings, Inc.

ticker: BZAI


text: Our Board of Directors is primarily responsible for oversight of risks from cybersecurity threats. Our audit committee is specifically responsible for oversight of cybersecurity risks within the Board of Directors. The audit committee is informed of our cybersecurity risk management practices at regularly scheduled meetings, including: • Our cybersecurity policies and strategies. • Incident response and recovery plans. • Employee training and awareness programs. • Cybersecurity audits and engagement with external cybersecurity experts and advisors on an as-needed basis.

companyName: HAWKINS INC

ticker: HWKN


text: Our Chief Operating Officer and Systems Administrator are primary responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.

companyName: VACCINEX, INC.

ticker: VCNX


text: The Board receives annual updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any material cybersecurity risk, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.

companyName: TCW Direct Lending VII LLC


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected, or are reasonably likely to materially affect, our business strategy, financial condition or results of operations. However, there can be no assurance that the controls and procedures in place to monitor and mitigate the risks of cyber threats will be successful or sufficient to avoid material losses or consequences in the future. Additionally, while we have insurance coverage in place that is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: Surgery Partners, Inc.

ticker: SGRY


text: Our risk management framework activities include the identification, assessment, and monitoring of reasonably foreseeable internal and external risks, including risks associated with key third-party vendors and service providers. The risk assessment, monitoring, and review process address the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. In this context, under our risk management framework, we periodically work to re-design, implement, update, and maintain reasonable safeguards to minimize identified risks, including risks related to third-party vendors and service providers; monitor the effectiveness of our safeguards; and reasonably address any identified gaps in existing safeguards.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: The Board of Directors has overall oversight responsibility for the Company's risk management function, and primarily relies on the Audit Committee to administer this oversight. With respect to cybersecurity, the Board and Audit Committee are responsible for confirming that the Company's management maintains appropriate cybersecurity policies and has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed, to manage cybersecurity risks and to mitigate any cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes for monitoring and mitigating potential cybersecurity risks, exposures, implementing appropriate mitigation measures and maintaining our cybersecurity program. The Company's cybersecurity program is under the direction of our Vice President, Technology who receives reports from its cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. The Company's dedicated personnel are certified and experienced information systems security professionals and information security managers with many years of experience. Management reports to either the Board of Directors or the Audit Committee at least annually on, among other topics, updates to the Company's cybersecurity program and mitigation strategies, developments in cybersecurity practices generally, and third-party assessments of the Company's cybersecurity program. Management also provides general program updates and industry trends to the Board and Audit Committee on a more ad hoc basis.

companyName: TIMKEN CO

ticker: TKR


text: We continually strengthen our cybersecurity defenses through significant investments in resources and maintaining comprehensive cybersecurity insurance coverage. We maintain an insider threat detection program to proactively identify and mitigate both external and internal threats in a timely manner.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Compliance Officer and Chief Operating Officer who both report to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's ongoing activities related to our cybersecurity risk management program.

companyName: Mersana Therapeutics, Inc.


text: Our CISO and Chief Information Officer ("CIO") are primarily responsible for the management of cybersecurity-related risks. Our CISO reports to our CIO, who is a member of our executive committee. The CIO collaborates closely with the CISO to align cybersecurity risk management with business goals. Our Governance, Risk and Compliance team is responsible for implementing the Company's security risk management program, and our security engineering and Threat Management teams manage the technical aspects of cybersecurity and incident detection, response, and remediation. These teams report to the CISO and CIO to keep them informed of the matters for which they are responsible. The CISO and CIO report quarterly to the Committee on current and emerging strategies and trends, the Company's approach to technology and operations, developments with respect to cybersecurity events and risks and the Company's cybersecurity roadmap. More frequent reporting occurs when circumstances dictate, such as pursuant to the escalation procedures included in the Company's Security Incident Response Plan.

companyName: StoneX Group Inc.

ticker: SNEX


text: The Audit Committee of the Board of Directors oversees cybersecurity related risks. Members of the Audit Committee receive the above referenced notifications and updates on a quarterly basis from the Company's Chief Information Officer as the designated representative of the Executive Information Security Oversight Committee.

companyName: TREX CO INC

ticker: TREX


text: Security risks to both the Company and its customers data and information are continuously evaluated and monitored. We actively monitor security 24 hours a day and seven days a week through our global Security Operations Center. We have implemented a multi-layered defense-in-depth approach using technologies that meet or exceed industry standards. Additionally, we expect our vendors to adhere to our data privacy and security standards and we evaluate their ability to comply as part of our vendor assessment process. This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations. Embecta utilizes the ISO 27001 framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness. As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments. Additionally, under our third-party risk management program, we assess vendor cybersecurity risks, including those associated with our cloud vendors and other third-parties. We maintain security and privacy policies and procedures that align with industry-standard control frameworks and comply with applicable regulatory requirements, laws, and standards. Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee ("ISRC").

companyName: Embecta Corp.

ticker: EMBC


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Interim Enterprise Transformation Leader. The current CISO has more than six years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.

companyName: Chemours Co

ticker: CC


text: Overall Risk Management and Strategy The Company manages its cybersecurity risk in a manner consistent with its overall risk management process in which recognized and emerging risks are identified, assessed, controlled, and monitored on a continual basis. The Company's cybersecurity risk management follows the "Three Lines of Defense" framework, which is as follows: (1) in the first line of defense, our Information Security function manages cybersecurity risks and controls; (2) in the second line of defense, independent internal risk management provides cybersecurity risk governance oversight; and (3) our Internal Audit function provides independent assurance over cybersecurity practices as the third line of defense.

companyName: EVANS BANCORP INC


text: Continuous Evaluation: We update our information security management system periodically and employ standards and frameworks as we deem necessary to assist us in monitoring compliance with regulatory, industry and evolving data privacy requirements. In addition, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures and policies regularly as we deem necessary in response to identified threats and risks.

companyName: CELESTICA INC

ticker: CLS


text: The Company's Chief Executive Officer and Chief Information officer work to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response Policy will include reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: SunPower Inc.

ticker: SPWR


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board and to our full Board, if appropriate.

companyName: Monroe Capital Income Plus Corp


text: Our Chief Privacy Officer has over 20 years of experience overseeing corporate data privacy and intellectual property policies and procedures. To maintain high levels of awareness and aptitude, all of our employees are required to complete annual trainings regarding current security risks and our InfoSec and privacy policies. Additional education and training are also required for specific groups based on their roles and access within the organization.

companyName: ADT Inc.

ticker: ADT


text: We have designed our cybersecurity risk management program and strategy to protect the confidentiality, integrity, and availability of our critical information technology systems and information. Our program is integrated into, and among the risks evaluated and considered by, our broader enterprise risk management program, through which we identify, assess, prioritize, and mitigate risks across the Company to support the achievement of our strategic objectives.

companyName: Kimball Electronics, Inc.

ticker: KE


text: We utilize third-party service providers to perform certain business functions. We seek to engage reliable and reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, we may review the cybersecurity practices of such provider, contractually impose obligations on the provider, conduct information security risk assessments, and conduct periodic reassessments during their engagement.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: The Company engages a variety of IT assessors to evaluate and test the Company's cybersecurity and cybersecurity controls. Additionally, the Company engages IT consultants to provide tabletop exercises, ransomware simulations, cyber policy and standards development, cybersecurity, data security, and IT training events, cybersecurity and data security testing and monitoring, and cybersecurity implementation projects.

companyName: STEPAN CO

ticker: SCL


text: Our CISO and cybersecurity department collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third party risk management, threat intelligence, and cloud security areas. Our CISO and cybersecurity department personnel are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.

companyName: Hyatt Hotels Corp

ticker: H


text: Our approach consists of, among other things, cybersecurity threat and vulnerability prevention, detection, mitigation and remediation of potential cybersecurity risks. We employ cybersecurity intrusion detection systems and continuous monitoring, in order to help defend against unauthorized access. We also employ identity-based access controls and identity authentication requirements. Access to the Company's data is monitored and controlled according to access control policies. Data protection and privacy practices, including data loss prevention, help to safeguard sensitive information. We have also outsourced significant elements of our information technology infrastructure; as a result, we manage independent vendor relationships with third parties who are responsible for maintaining significant elements of our information technology systems and infrastructure.

companyName: Tenon Medical, Inc.

ticker: TNON


text: Our Board of Directors receives periodic reports and annual updates on our cybersecurity posture, and both the Chief Information Security Officer and the Chief Financial Officer share responsibility for our program and solicit support from third-party experts as necessary. Our cybersecurity team consists of highly senior resources holding multiple certifications and degrees relating to cybersecurity and best practices.

companyName: USBC, Inc.

ticker: USBC


text: Vendor Risk Management—We evaluate third-party and partner risks through initial assessments, enforce security through contractual obligations, when applicable, and conduct ongoing oversight. Privacy Risk Management—We ensure that our products and platforms comply with privacy laws and regulations. Incident Response—We maintain robust protocols to address and mitigate cyber threats promptly.

companyName: Crypto Co

ticker: CRCW


text: In 2023, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Cybersecurity and Artificial Intelligence" under Risk Factors in this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We evaluate each third-party service provider to verify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: A formal Incident Response Plan ("Plan") is maintained by the Information Security Department, and approved by the Board of Directors or designated Committee thereof at least annually. The Plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident ("Incident"). The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified Incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an Incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: Our Board is responsible for understanding the primary risks to our business. The Board is responsible for reviewing periodically our and the Adviser's information technology security controls and related compliance matters, with management. Blackstone's CSO, or designee, reports to the Board, or a committee thereof, at least annually on cybersecurity matters, including risks facing us and the Adviser and, as applicable, certain incidents. In addition to such periodic reports, the Board or a committee thereof may receive updates from management as to our and the Adviser's cybersecurity risks and Blackstone cybersecurity program developments.

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: In doing so, our Global IT Security Team, which is comprised of dedicated privacy and security professionals and run by our Chief Information Security Officer ("CISO"), stays abreast of security industry and threat trends and regularly seeks to improve our cybersecurity risk management program. Our executive leadership team, with input and guidance from our CISO, is responsible for our overall enterprise risk management system and processes, and regularly considers cybersecurity risks in the context of other material risks to the Company.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: We have a formalized breach management protocol that utilizes a cross-functional team to address global cybersecurity efforts that includes partnership with Legal, Risk, our CFO, IT&S Strategy and Business Partnering and Enterprise HR which lead matters when they occur. This collaborative approach, working with a wide range of key stakeholders to manage risk, allows us to effectively share and respond to threat intelligence. In the event of a specific cybersecurity threat or incident, management is notified in accordance with established escalation procedures. If appropriate, management then notifies the NGC, which may meet to describe the cybersecurity threat or incident before reporting out to the Board regarding the matter. We use forensic and other key third party service providers to assist the Company with its response in the event of a cybersecurity incident.

companyName: PERRIGO Co plc

ticker: PRGO


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or cybersecurity incidents may not be fully insured. See Item 1A. – Risk Factors for additional information regarding cybersecurity threats.

companyName: WORLD KINECT CORP

ticker: WKC


text: We manage risks associated with cybersecurity threats first and foremost through our information security program. We have implemented a comprehensive, layered security approach, across our computing environment, that is designed to facilitate the reduction of cybersecurity risk through the establishment of technical, physical and administrative controls oriented towards the maintenance of the confidentiality, integrity and availability of our information and technical assets. The structure of the information security program is informed by the NIST Cybersecurity Framework, and the program includes controls designed to facilitate the compliance of our cardholder data environments with PCI-DSS. The information security program is under the responsibility of the Chief Information Security Officer ("CISO"), while governance and oversight is provided by the Technology Committee as set forth in the Technology Committee Charter. The CISO is responsible for the strategy, execution and administration of the program and reports directly to the Chief Information Officer ("CIO"), while also maintaining reporting lines to the Technology Committee, its chair and the full board of directors. We have also established a Management Risk Committee ("MRC"), composed primarily of executive management, that is responsible for identifying, assessing, prioritizing and monitoring action plans to mitigate key risks. The MRC meets regularly.

companyName: GLOBAL PAYMENTS INC

ticker: GPN