text: In an effort to deter and detect cyber threats, we periodically provide all employees with data protection and cybersecurity awareness training, which covers a range of timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, and asset use. The training functions to educate employees on the importance of reporting all security and privacy incidents immediately. We send out bi-weekly simulated phishing tests to all employees for ongoing awareness to relevant phishing campaigns. We also use technology-based tools to mitigate cybersecurity risks and to bolster its employee-based cybersecurity programs.

companyName: Dyne Therapeutics, Inc.

ticker: DYN


text: Our Senior Director of Information Technology, or IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Director of IT has 25 years of experience in building, running, and managing diverse functional areas of IT, including but not limited to enterprise cybersecurity, IT infrastructure, operations, business continuity, and service delivery. He began his IT career overseeing datacenter operations for a pharmaceutical company and has held multiple IT leadership positions at biotechnology companies, including serving as the director of cybersecurity and infrastructure at a biopharmaceutical company prior to joining us over three years ago.

companyName: Generation Bio Co.

ticker: GBIO

secItem: Item 1C


text: The Senior Vice President and Chief Financial Officer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee ("AFC") of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.

companyName: ROYAL GOLD INC

ticker: RGLD


text: The Trust does not have any officers, directors or employees. The Sponsor, an indirect subsidiary of BlackRock, is responsible for the oversight and overall management of the Trust. The Sponsor relies on BlackRock's ERM framework for the Trust's cybersecurity risk management and strategy. Key aspects of the ERM framework are summarized below. The board of directors of the Sponsor (the "Board of Directors") periodically receives reports from BlackRock regarding BlackRock's cybersecurity program.

companyName: iShares Bitcoin Trust ETF

ticker: IBIT


text: In accordance with the Prospect Capital Management Information Technology Operations and Procedures, the cross-functional Change Advisory Board ("CAB") governs and oversees the advancement and implementation of policies and procedures to reasonably prevent security incidents. Prospect Capital Management's cybersecurity program also includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Prospect Capital Management's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: Notwithstanding our risk management and strategy described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Part I, Item 1A, "Risk Factors—Risks Relating to Our Business and Operations—Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations or the operations of businesses in which we invest, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our business, financial condition, and operating results."

companyName: GLADSTONE LAND Corp

ticker: LAND


text: In an effort to deter and detect cyber threats, we provide a monthly cybersecurity awareness newsletter to all employees, including part-time and temporary contractors, which covers timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and reminds employees of the importance of reporting all incidents quickly. We run frequent phishing tests to raise awareness of spam emails, the primary attack vectors for cyber threats and to further raise awareness of cyber threats. We provide annual training on employee responsibilities for protecting company information and data along with our overall compliance responsibility. Each October during cybersecurity awareness month in the U.S., we provide weekly updates on cybersecurity awareness and host a company-wide lunch and learn discussion of our cybersecurity program and the impact of cybersecurity on individuals as well as the company, with a data protection, cybersecurity and incident response and prevention training and compliance program.

companyName: Karyopharm Therapeutics Inc.

ticker: KPTI


text: 2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures to mitigate them.

companyName: NewtekOne, Inc.

ticker: NEWT


text: As is the case for similar companies of our size and industry, we may be the target of cyberattacks and other cyber incidents and, therefore, cybersecurity is an important element of our overall enterprise risk management program. We have certain processes to systematically evaluate, identify, address, and manage cybersecurity risks, which are built into our overall risk management program and are designed to help safeguard our information assets and operational integrity from internal and external cyber threats, protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, and continuity exercises on our systems. We also routinely review our policies and procedures to identify risks and refine our practices. By prioritizing cyber risk comprehension and management, we aim to enhance business resiliency, protect information from unauthorized access or attacks, and secure our digital footprint.

companyName: Sage Therapeutics, Inc.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including engagement of appropriate third parties such as insurance providers and incident response professionals, and timely reporting to our CEO and Board of Directors as appropriate. The Incident Response Plan is coordinated by the Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple areas of our organization and is evaluated at least annually.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications or requirements.

companyName: Avidity Biosciences, Inc.

ticker: RNAM


text: In the ordinary course of our business, we and our third-party service providers collect, maintain and transmit sensitive data on our networks and systems, including confidential business information such as child, parent and employee personal information. The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: Our cybersecurity program provides a program for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer, employee and Company information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with third party reviews of cyber security programs, regulators, and third-party service providers to ensure that these policies are adequately designed to appropriately safeguard such information. The Company's policies and procedures include, and are not limited to: Information Systems and Cyber Security Policy Patch and Change Management Cyber Incident Response Policy and Testing Annual NIST Risk Assessments Business Continuity and Disaster Recovery Plans and Testing Annual CIS Benchmarks Assessments Vendor Risk Management Policies Access to Threat Intelligence Remote Access Policy Dark Web Monitoring Customer Facing Technology Risk Assessments Cyber Risk Insurance Policy Cyber Security Awareness Training Physical Security Policy

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of Confidentiality, Integrity and Availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring: • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Steering Committee, which includes our CEO, CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Even with our extensive and systematic approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the cost related to cybersecurity threats or disruptions may not be fully insured.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity risks and strategy. Management provides regular updates to the Audit Committee on cybersecurity risks facing the Company, the systems management has in place to mitigate and manage those risks, the status of key cybersecurity initiatives through a review of the Company's cybersecurity strategic roadmap and whether any material cybersecurity incidents have occurred. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes an update of the cybersecurity threat landscape, discussion of management's actions to identify and detect threats, and a review of assessments, penetration tests and other audits performed by internal and external parties. In addition, management periodically arranges for outside experts to present to the Audit Committee on cyber governance frameworks, regulatory developments, industry practices and risk management.

companyName: GRACO INC

ticker: GGG


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). Our CISO has worked in various information security roles at other large publicly traded companies.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Our technology structures undergo an annual internal assessment to evaluate risk using the NIST Cybersecurity Framework; our assessment methodology and a thorough sampling of our results are validated annually by a third party. Our IT Security Incident Response Plan defines a cybersecurity incident and outlines the roles, responsibilities, and procedures for us to respond effectively. Having a structured plan enables a rapid response, effective recovery, clear communication and coordinated action to major security incidents. Our plan allows us to reduce recovery time and cost and to also maintain business continuity.

companyName: JACK IN THE BOX INC

ticker: JACK


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversight of cybersecurity and other information technology risks. Our Board oversees management's implementation of our planned cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Our Board shall also receive periodic reports from management on our cybersecurity risks and cybersecurity risk management program.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: We have a multi-stakeholder team to help identify, assess, and manage the Company's cybersecurity threats and risks, comprised of representatives from our third-party IT administrator, Legal and Compliance Administration, and Finance departments. This team, along with our third-party IT service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, by using automated monitoring tools, subscribing to analysis and services that identify cybersecurity threats, conducting scans of the threat environment, conducting internal and external review of certain data and systems, and having third parties conduct periodic assessments of our threat environment.

companyName: Y-mAbs Therapeutics, Inc.


text: The Company employs a "defense in depth" approach to providing security around our networks, servers, and data. Most of our critical networks leverage redundant components and connections to ensure high levels of availability, reliability, and performance. The Company employs a security architecture that identifies rules for segmentation and access control based on risk and impact to the business. This includes infrastructure, applications, and data in the cloud.

companyName: CINCINNATI BELL INC


text: Cross-Functional Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the disclosure and reporting of such material incidents may be made by management in a timely manner.

companyName: FRESH DEL MONTE PRODUCE INC

ticker: FDP


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we cannot provide assurance that we will not experience any such event in the future. For more information about the cybersecurity risks we face in connection with our business, see the risk factor entitled "Data security breaches, cyberattacks, employee or other internal misconduct, malware, phishing or ransomware, physical security breaches, or other disruptions to our technology system or a compromise of our data security could occur and would materially adversely impact our business and ability to protect the confidential information in our possession or control" in Item 1A of this Form 10-K, "Risk Factors."

companyName: Sezzle Inc.

ticker: SEZL


text: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect our business strategy, results of operations or financial condition. There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including those discussed in Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks although we do not currently believe that such a result is reasonably likely.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: The Vice President of IT Security works directly with the IT Security Operation Team and the Product Security Team to ensure effective and timely monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents. In line with our incident response plan, the Vice President of IT Security provides regular updates about cybersecurity incidents to the Audit Committee, the Chief Operating Officer and other members of the executive management team.

companyName: SEMTECH CORP

ticker: SMTC


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. The Company's Audit Committee annually reviews with management the Company's operational risk exposure and the steps management has taken to monitor and control these exposures.

companyName: Horizon Kinetics Holding Corp

ticker: HKHC


text: Our policies, procedures, and processes are aligned with our technical tools, which include continuous security monitoring and alerting, an AI-based tool to facilitate cybersecurity incident identification and remediation, and other technologies, to ensure the security of our systems and information. We also have implemented certain physical safeguards, such as restricted access to areas containing critical IT and operational technology equipment, to mitigate risks to our physical environment.

companyName: Valaris Ltd

ticker: VAL


text: Board of Directors' Oversight and Management's Role The Board of Directors has primary oversight of risks from cybersecurity threats and recognizes the importance of cybersecurity to the success and resilience of our business. The Board of Directors delegates oversight of our enterprise risk management process, including review of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit Committee. An employee of the Manager is responsible for day to day oversight of our cybersecurity risks and management of our cybersecurity vendor, and that employee escalates higher business cybersecurity risks to the Audit Committee or the Board as appropriate.

companyName: Granite Ridge Resources, Inc.

ticker: GRNT


text: Although we have experienced, and will continue to experience, cyber incidents in the normal course of our business, as of the date of this report, prior cyber incidents have not had a material adverse effect on the Company, including our business strategy, results of operations, and financial conditions. For a further explanation of the cybersecurity risks and threats to which we could be subject, see "A failure of our information technology and data security infrastructure could adversely affect our business and operations" in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.

companyName: STEM, INC.

ticker: STEM


text: Our Chief Financial Officer reports to our CEO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management program. Our CEO and CFO provide prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding the Company's cybersecurity program.

companyName: Maitong Sunshine Cultural Development Co., Ltd

ticker: MGSD


text: Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. Additionally, Concentra receives a certified System and Organization Controls 2, Type 1 assessment, a voluntary compliance standard for ensuring that the Company properly manages and protects the sensitive data in its care, conducted by an independent and qualified external third-party assessor. The Company has not experienced a cybersecurity breach or information security breach during the past three fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: The Company's Vice President of Information Technology is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The Vice President of Information Technology works in coordination with the other members of the Security Advisory Board, which includes our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer and Executive Vice President and Chief Legal Officer. The Company's Vice President of Information Technology has over 26 years in Information Technology leadership including 16 years overseeing security and compliance operations. The Director of Information Security has over 15 years in various security roles in private and public sectors and has attained the professional certification of Certified Information Systems Security Professional (CISSP).

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. The Company works with third party companies to assess, identify, manage, and mitigate material cybersecurity threats, as well as to respond to and recover from cybersecurity incidents.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: Our ISMS includes developing, implementing, and continually improving policies and procedures designed to safeguard information and ensure the availability of critical data and systems. These policies cover areas such as requiring secure coding practices and a secure development lifecycle process, monthly information security awareness training for all employees and enhanced training for specialized personnel, review and assessment by external, independent third parties, who certify and report on our weaknesses and internal response preparedness for the entire Company, and the performance of daily vulnerability scanning of our network infrastructure as well as annual third-party penetration testing.

companyName: TELOS CORP

ticker: TLS


text: Related to Cybersecurity Risks Our board of directors is involved in risk oversight through its attention to our overall business strategy, and it has delegated oversight of risk assessment and management to the audit committee. The audit committee administers its risk oversight function by receiving periodic reports from members of senior management. Our audit committee discusses cybersecurity threats and our risk management processes at least annually, receives updates on relevant developments, and considers steps that our management has taken to monitor and seek to address risk exposures. The full board of directors also discusses with management our major risk exposures, their potential impact on us, and the steps we take to manage them.

companyName: Damora Therapeutics, Inc.

ticker: DMRA


text: Our Board of Directors oversees our risk management program, and because information security is a top priority and an important component of our day-to-day operations, cybersecurity is part of our overall approach to enterprise risk management. The scope of cybersecurity risk management encompasses all aspects of business operations, including supply chain risks and production manufacturing operations. Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology. We recognize the importance of the continued protection of our employee, customer, supplier and partner data and address operational risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, integrity and availability of the information that we collect, process and store.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: The Audit Committee of the Board of Directors is tasked with reviewing the Company's policies and procedures related to cybersecurity risks and incidents. The Company's Chief Information Officer ("CIO") oversees its cybersecurity program, and regularly provides updates to Littelfuse Senior Leadership and the Audit Committee, as well as the full Board, which include information regarding our cybersecurity program initiatives, insurance coverage, acquisition integration processes, program performance as well as the maturity of the Littelfuse cybersecurity program. These cybersecurity maturity updates are based on cybersecurity maturity reporting and analysis by the Littelfuse internal IT team, as well as reporting provided by independent third parties. The updates help Senior Leadership, the Audit Committee, and the Board to understand the risks the organization faces based on changing cybersecurity threats and on changes to the Littelfuse environment due to factors such as acquisitions and new technology upgrades and improvements. Representatives from Littelfuse's technology team and other business functions receive regular cybersecurity risk reports and use this information for its decision making in operational improvements as well as budget and resource allocations. The CIO has managed and evolved the cyber security function at Littelfuse for the past five years and is supported by a cyber security leader with over 20 years of Littelfuse experience in IT infrastructure, IT operations, and cybersecurity.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: We use, store and process data for R&D and business operations. Such data includes, but is not limited to, scientific and clinical data, financial data, strategic information, as well as information about employees, shareholders, suppliers. This makes us subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations through intellectual property theft, financial theft, fraud, extortion; harm to employees, violation of privacy laws, other litigation and legal risk, and reputational risk.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: We design and assess our program based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, but that we use the NIST framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: The Company works to continually assess, identify and manage cybersecurity risks. In addition, the Company engages with third-party cybersecurity specialists to provide an independent assessment of the Company's cybersecurity programs to maintain compliance and operational excellence. Management periodically reviews operational plans and modifies them in response to changes in the threat landscape and otherwise as needed. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" above for more information.

companyName: CAMBRIDGE BANCORP


text: Our overall information security risk management approach is designed to enable us to assess, identify and manage major risk exposures, including from material risks from cybersecurity threats, in a timely manner. As part of our information security risk management program, we perform risk assessments in which we map and prioritize information security risks identified through the processes described below. These assessments inform our information security risk management strategies and oversight processes and we view cybersecurity risks as one of the key risk categories we face.

companyName: ORACLE CORP

ticker: ORCL


text: As of the date of this report, the Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factors within "Item 1A. Risk Factors" in this Form 10-K.

companyName: Oil-Dri Corp of America

ticker: ODC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials and product, product candidates, and technology or our Information Systems and Data.

companyName: Y-mAbs Therapeutics, Inc.


text: Our cybersecurity program is designed to protect the integrity of our information and the proper functioning and availability of the information systems that help operate our business. We utilize the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) to inform our cybersecurity program and maintain International Organization for Standardization 27001 (ISO 27001) certification. We have created and implemented processes that assess, identify, respond to and manage cybersecurity threats and incidents, and we oversee these processes to minimize the occurrence and impact of any unauthorized access, disruption or use of our information or that of our customers. We have a robust set of information security policies related to encryption of data, anti-virus, firewalls, multi-factor authentication, training of employees, as well as incident response capabilities designed to proactively identify risks and mitigate attacks and unauthorized access attempts to our systems, amongst other measures.

companyName: RYDER SYSTEM INC

ticker: R


text: of Third-Party Risk: The Company's comprehensive third-party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: As part of the Sponsor's ISSP for the Trust, the CISO will document in a risk assessment the Information Systems for the Trust, risks identified in Information Systems, and related risk mitigation processes and controls. Included in the risk assessment will be an assessment of each risk's potential impact on the operations affecting the Trust, on the security of the Trust's data, and also potential business consequences of each risk.

companyName: VanEck Merk Gold ETF

ticker: OUNZ


text: We are developing and implementing a robust and comprehensive cybersecurity program that aligns with industry best practices, regulatory requirements, and our Company's specific risks in the evolving threat landscape. This program is designed to not only address current challenges but also proactively position us to mitigate future risks and maintain a resilient digital posture.

companyName: MONARCH CASINO & RESORT INC

ticker: MCRI


text: Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside partners to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.

companyName: Village Bank & Trust Financial Corp.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board of Directors and management. Our Audit and Finance Committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the Audit and Finance Committee receives an overview covering current and emerging cybersecurity threat risks and the Company's ability to mitigate those risks, and discusses these topics with our Chief Information Security Officer and Chief Technology and Digital Officer. Cybersecurity risk management is also considered at least annually during separate Board meeting discussions with management.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data"). Our information security function is led by our Director of Information Technology, with the support of our third-party specialists. Our information security function helps identify, assess and manage risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including automated tools, domain name system filtering, antivirus protection, vulnerability scanning and penetration testing.

companyName: Ovid Therapeutics Inc.

ticker: OVID


text: Our cybersecurity strategy prioritizes prevention, detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers and other third parties, our information systems, our business operations, and our produced products and related services. We have adopted security-control principles primarily based on the National Institute of Standards and Technology Cybersecurity Framework (NIST). We also leverage industry and government associations, third-party benchmarking, internal and external Company audit results, threat intelligence feeds, and other similar resources to form our cybersecurity processes and allocate resources.

companyName: Amplify Energy Corp.

ticker: AMPY


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Director of Operations & Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: The Company is committed to securing our information technology systems, including accounting software, point-of-sale software, and back-of-house software, against cybersecurity threats and protecting the privacy of the data of our customers', employees', franchisees', licensees' and other business partners. However, as described in "Item 1A. Risk Factors – Cyberattacks and breaches could cause operational disruptions, fraud or theft of sensitive information " of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's digital world and that, despite devoting resources to secure our information technology systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Cybersecurity threats include any potential unauthorized occurrence on or conducted through our information technology systems or information technology systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or access to our information technology systems.

companyName: NATHANS FAMOUS, INC.

ticker: NATH


text: The team also reviews a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: Allied Gaming & Entertainment Inc.

ticker: AGAE


text: While tools and processes are in place to mitigate cybersecurity risks, we are continuing to establish an Incident Response Plan, or IRP, to analyze, contain, and remediate any cybersecurity incidents which may occur despite these mitigations. The IRP, based on the National Institute of Standards and Technology framework, defines a timely, consistent, and compliant response to cybersecurity incidents and includes notifications to the Audit Committee and any relevant governing bodies such as the SEC in the event that the cybersecurity incident is deemed to be material.

companyName: Third Harmonic Bio, Inc.


text: The Director of Information Technology is responsible for leading the assessment and management of cybersecurity threats. We have implemented a governance program for our cybersecurity efforts. This includes regularly updating privacy notices, terms of use, and lease documents. The Advisor and its affiliates have developed and implemented policies to identify and mitigate cybersecurity risks and provide training to their employees at onboarding and thereafter as necessary. Such updates are communicated to all their employees, and actionable guidance is provided when new risks arise.

companyName: Lightstone Value Plus REIT V, Inc.


text: The Information Technology team collaborates with key functions across the company, including risk management, legal, finance, and operations to assess organizational exposure to cybersecurity risks. These assessments are integrated into Alternus' Information Security Policy, which is regularly reviewed and updated in coordination with company leadership.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Cybersecurity Incident Response Plan and Testing: We have an incident response plan supported by a dedicated team to address cybersecurity incidents. This includes vulnerability identification, initial assessment, and engagement of external experts as needed.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We do not believe that risks from cybersecurity threats, including the previously disclosed cyber-attack that occurred in April 2023, have materially impacted or are reasonably likely to materially impact our overall business strategy, results of operations, or financial condition. We maintain cybersecurity insurance to cover the costs resulting from cyber-attacks; however, the policy may not cover all losses from cybersecurity incidents. Refer to the discussion on the April 2023 incident in Note 15 - Commitments and Contingent Liabilities of our Consolidated Financial Statements and the discussion of cybersecurity risk in Part I, Item 1A, "Risk Factors".

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers and stakeholders.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: In the ordinary course of our business, we collect, use, store, and transmit digitally large amounts of confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Director of IT, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we perform daily vulnerability scans on our endpoints; we have a dedicated security operations center ("SOC"), which is run by a third-party; and we conduct data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key vendors, CROs, and other contractors and suppliers. We also conduct regular employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts, including our SOC, on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: MoonLake Immunotherapeutics

ticker: MLTX


text: We are subject to numerous cybersecurity threats and the cybercriminals are becoming more sophisticated and are increasingly targeting electric utilities. A major cyber incident could result in significant business disruption, compromised or improper disclosure of data, and expenses to repair security breaches or system damage and could lead to litigation, regulatory action, including penalties or fines, and an adverse effect on our financial condition, results of operations, and reputation. See "RISK FACTORS – General Risks" for additional information. While there have been immaterial incidents such as phishing and attempted financial fraud across our system, there has been no material impact on business or operations from these attacks. However, we cannot guarantee that security efforts will prevent breaches, operational incidents, or other breakdowns of information technology systems and network infrastructure and cannot provide any assurance that such incidents will not have a material adverse effect in the future.

companyName: Tri-State Generation & Transmission Association, Inc.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to Hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").

companyName: Airbnb, Inc.

ticker: ABNB


text: Our Chief Information Officer has served in various roles in information technology and information security for over 25 years, including serving as Chief Information Officer for us for the past four and one-half years, as well as for another large public company, a private consulting firm providing technology and cybersecurity advisory services and a privately held fuel oil blending and distribution company. The Chief Information Officer holds an undergraduate degree in management and leadership from Northeastern University.

companyName: U.S. SILICA HOLDINGS, INC.


text: We acknowledge that—even with advanced security tools—we are only as strong as the people that use our technology. That is why we design phishing simulations and require multiple security trainings for every employee annually. Our partnerships with law enforcement, the Oil and Natural Gas Information Sharing Center and our third party partners continually mature our cyber program as threats evolve.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Inland's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help our sponsor and Advisor to prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, our Advisor, and Dealer Manager. Inland's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our Advisor, and Dealer Manager, is integrated into Inland's risk management program. In addition, Inland periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs, including performing penetration testing of Inland's networks, and security assessments of the effectiveness of Inland's information technology environment to identify potential vulnerabilities.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: We have developed a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.

companyName: Douglas Emmett Inc

ticker: DEI


text: We have not had any reportable cybersecurity breaches, including what we may perceive or recognize as cybersecurity incidents or credible threats during the fiscal year ended December 31, 2024. To date, as a result, there has not been any material adverse effect on our business operations or financial condition. If there is a cybersecurity attack and an infiltration of our files, data, customer data and the like, there would be a material adverse effect on our business, our reputation, our operations and financial condition. For example, our reputation would be damaged in the event of a cybersecurity infiltration. If there were a cybersecurity infiltration, we could lose access to our data which would disrupt our operations, and we even may not be able to operate. Such a loss of access might be temporary or permanent, and it might be localized or general. The level of disruption will depend on our backup systems. Our clients financial and other data could be taken and used against us to damage our reputation or cause harm to our clients in different ways. In the latter instance, we may be liable for monetary damages to our clients. We may be held for cyber ransom, which would be loss to our financial resources. Our inability to operate, payment of damages, payment of ransom, and the costs of reparation of our systems, consultants and tangential expenses will all result in damage to our business and our financial resources.

companyName: MDB Capital Holdings, LLC

ticker: MDBH


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements. Additionally, we operate an Artificial Intelligence ("AI") governance program to ensure proper risk management and regulatory compliance where applicable with this expanding capability; managing ethical, legal, cyber, data privacy and other technology risks associated with the use of AI and Generative AI technologies.

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: The Company has a Governance, Risk, and Compliance (GRC) IT function to address enterprise risks; cybersecurity is a category handled by that function. Cybersecurity is a vital pillar within a comprehensive risk management framework, fostering cross-functional collaboration to fortify organizational resilience against digital threats. The Company has a privacy and security governance committee. The company operates a privacy and security governance committee and a cybersecurity team led by a Chief Information Security Officer. With cybersecurity experience across IT services, Telecom, and Manufacturing sectors, the Chief Information Security Officer spearheads cybersecurity risk and strategy and directly reports to the Chief Information Officer. Additionally, as part of our overall enterprise risk management strategy, our Audit Committee, which consists solely of independent directors, oversees cybersecurity and receives updates from the Chief Information Security Officer on a periodic basis on cybersecurity matters, which include a review of potential digital threats and vulnerabilities, cybersecurity priorities, and our cybersecurity framework.

companyName: WK Kellogg Co


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is included into our overall enterprise risk management program.

companyName: Shimmick Corp

ticker: SHIM


text: Employee Training and Awareness Astrana Health fosters a culture of cybersecurity awareness through mandatory training programs, phishing simulations, and engagement campaigns. These efforts seek to enable employees to identify and report potential threats, thereby reducing organizational vulnerability to common attack vectors.

companyName: Astrana Health, Inc.

ticker: ASTH


text: Our cybersecurity risk management program is overseen by management at multiple levels. Our Vice President, Information Technology plays a key role in assessing, monitoring and managing our cybersecurity risks with support from dedicated information technology and security personnel. Our cybersecurity and risk management protocols are led by our Vice President of IT, who has served in this role since 2019. Our Vice President, Information Technology has an MS in Engineering and Technology Management and over 20 years of experience in managing and leading information technology or cybersecurity teams and oversees a team of information technology professionals who identify, assess, and manage cybersecurity threats on an ongoing basis.

companyName: LGI Homes, Inc.

ticker: LGIH


text: The Data Protection Officer ("DPO") is responsible for ensuring that we have a Personal Data Protection program in place that is compliant with data privacy laws such as the EU GDPR, UK GDPR, China's PIPL, and data privacy laws enacted at the state level, as applicable to us. Our corporate Personal Data Protection program includes policies, practices, and training directed to protecting personal data.

companyName: Simulations Plus, Inc.

ticker: SLP


text: As of the date of this Annual Report on Form 10-K, we have not detected any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition. For further discussion of the risks associated with cybersecurity incidents, refer to Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: CHS INC

ticker: CHSCP


text: Our CISO and cybersecurity and information technology governance departments collectively possess relevant expertise in cybersecurity architecture, engineering, governance, risk management, and compliance, operations, vulnerability management, third-party risk management, threat intelligence, and cloud security areas. Our CISO and the personnel of our cybersecurity and information technology governance departments are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through various means, which include briefings with internal security personnel and external consultants and information from governmental, private, and industry threat intelligence sources, as well as through alerts and reports produced by security tools and technologies deployed in and around the information technology environment.

companyName: Hyatt Hotels Corp

ticker: H


text: The Company maintains a Business Continuity Plan (the "Plan") that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board of directors-approved management committees, as discussed further below, and to the IT Steering Committee. The Plan is coordinated through the SVP/IT Manager and ISO and key members of management are embedded into the Plan by their design. The Plan facilitates coordination across multiple parts of the Company and is evaluated at least annually.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Overseeing Third-Party Risk As part of our evolving cybersecurity roadmap, we plan to implement and conduct security assessments of all third -party service providers before engagement and maintain ongoing monitoring to ensure compliance with relevant cybersecurity standards.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: The Audit Committee also conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Our key cybersecurity processes include: • Risk-based controls for information systems and information on our network. We seek to maintain an IT infrastructure that implements physical, administrative, and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity, and availability of our information systems and information stored on the Company's networks, including customer information, employee information, IP, and proprietary information. • Cybersecurity incident response plan and testing. We have a cybersecurity incident response plan and a dedicated team to respond to cybersecurity incidents. When a cybersecurity incident occurs or a vulnerability is identified, GE Vernova has cross- functional teams that are responsible for leading the initial assessment of priority and severity. External experts may also be engaged as appropriate. GE Vernova's cybersecurity team assists in responding to incidents depending on severity levels and seeks to improve our cybersecurity incident management plan through periodic tabletops or simulations at the enterprise and business levels. • Training. We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to applicable employees based on customer requirements, regulatory obligations, and industry risks. • Supplier risk assessments. We have implemented a third-party risk management process that includes expectations regarding information protection and cybersecurity. That process, among other things, provides for GE Vernova to perform cybersecurity assessments on certain suppliers based on their risk profile and a related rating process. GE Vernova also seeks contractual commitments from key suppliers to appropriately secure and maintain their IT systems and protect our information that is processed on their systems. • Third-party assessments. We have third-party cybersecurity companies engaged to periodically assess GE Vernova's cybersecurity posture and assist in identifying and remediating risks from cybersecurity threats.

companyName: GE Vernova Inc.

ticker: GEV


text: ("SOC") real-time monitoring, Data mandatory Multi-factor Authentication ("MFA") in our IT environment. In addition, the any monitor our cybersecurity threat our security cybersecurity practices consistent the security the workforce, security management which for crisis scenarios. This also includes regular phishing simulations and campaigns.

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: In the event of a cybersecurity incident, our incident response team refers to the Company's Security Incident Response Plan. Pursuant to this process, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon internal reporting obligations, escalating information about the incident to senior management, as appropriate, and performing post-incident analysis and program enhancements, as needed.

companyName: KESTRA MEDICAL TECHNOLOGIES, LTD.

ticker: KMTS


text: The Company's Board of Directors is charged with overseeing the establishment and execution of the Company's enterprise risk management framework, including cybersecurity risk, and monitoring adherence to related policies required by applicable statutes, regulations and principles of safety and soundness. The Company's Information Security Officer ("ISO") provides the Board Risk Committee with regular updates on information security risk management and an annual comprehensive information security status report, which assesses the effectiveness of the program and updates the Risk Committee on developing trends and emerging threats.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems, networks and information, and those of our third-party providers and customers, to date, these incidents have not had a material impact on our financial condition or results of operations. In the event of a cybersecurity incident, we assess whether such incident had a material impact, and in certain cases, such assessment is reviewed by our leadership team, including the Chief Executive Officer, outside legal advisors and other third-party advisors. Refer to Item 1A. Risk Factors for further information regarding risk related to cybersecurity incidents and other breaches of our systems and information technology.

companyName: RYDER SYSTEM INC

ticker: R


text: Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants.

companyName: DIH HOLDING US, INC.


text: We have established processes to oversee and identify cybersecurity risks associated with our use of third-party service providers. We conduct due diligence assessments and evaluate contractual obligations to mitigate potential risks arising from third-party relationships.

companyName: EXPONENT INC

ticker: EXPO


text: The Chief Information Security Officer, in coordination with the Chief Technology Officer, Chief Financial Officer, Chief Accounting Officer, certain members of the Company's legal team and certain third-party service providers ("Cybersecurity Risk Management Team"), is primarily responsible for identifying, assessing, and managing the Company's cybersecurity threats and risks. Through our Cybersecurity Risk Management Team, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example manual and automated tools, conducting scans of threat environment, use of external intelligence feeds, internal and third-party threat assessments and evaluating our industry's risk profile, subscribing to reports and services that identify cybersecurity threats, red/blue team testing and tabletop incident response exercises, evaluating threats reported to us, and conducting red/blue team testing and tabletop incident response exercises.

companyName: Confluent, Inc.

ticker: CFLT


text: Cyber Risk Management Personnel The Company's director of cybersecurity reports to the CIO and the CIO reports directly to the Company's chief executive officer. The Company's CIO who served as the first CIO of the Company since 2016, oversaw the information technology and cybersecurity portfolios until her retirement on January 10, 2025. A new CIO from within the Company was named to succeed the retiring CIO and holds both a bachelor's and master's degree in business administration with over 25 years of information technology experience in the energy and utilities business. The director of cybersecurity has a bachelor's degree in computer information systems, over 25 years of information security experience, and holds certified information systems security professional and certified risk and information systems control certifications. The other members of information technology director level leadership also responsible for managing cybersecurity risks have degrees including Bachelor of Computer Information Systems, information systems management, electronics, electrical engineering, business administration, and accounting, along with certified information systems auditor certification and a cybersecurity fundamentals certificate.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: As a part of the cybersecurity program, we conduct assessments, both internally and by independent third parties, to identify and prioritize the mitigation of cybersecurity risks. We also maintain a formal and mandatory cybersecurity awareness training program for all employees that includes annual training on information security best practices in high risk areas such as phishing and authentication. All employees are also tested periodically for their cybersecurity awareness.

companyName: Third Harmonic Bio, Inc.


text: The CISO manages the Security Operations Center (SOC) and is responsible for implementing and maintaining controls designed to detect and defend us against cyber-attacks and includes a dedicated function for incident response and ongoing monitoring for cybersecurity threats and vulnerabilities, including those among the Bank's third-party suppliers. The CISO conducts a quarterly review of our inherent risk posture against the effectiveness of our cyber risk management strategies. This review helps in measuring the effectiveness of controls and identifying areas for improvement ensuring cyber controls is commensurate with our inherent risk profile and the Board's risk appetite.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.

companyName: PEPSICO INC

ticker: PEP


text: Management and Internal Cybersecurity Team Our Chief Information Officer ("CIO"), who has over 30 years of relevant work experience in information technology, including cybersecurity, is responsible for the Company's information technology systems and cybersecurity and is an integral part of the Company's management of cybersecurity and related risks. The CIO reports to the Senior Vice President, Operations and Supply Chain, who reports directly to the Chief Executive Officer.

companyName: Xylem Inc.

ticker: XYL


text: The Company's Information Security Officer and Chief Information Officer are responsible for completing additional mandatory training to understand the processes, procedures, and technical requirements for securing information assets across the Company.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: As noted above, our CIO leads our cybersecurity risk management program. Our CIO has over a decade of executive-level experience managing information systems and cybersecurity programs in the healthcare industry. The CIO serves as an Executive Officer who reports directly to senior management and, at least quarterly, makes reports to the Audit Committee. Senior management reports to the full Board of Directors with respect to cybersecurity matters on at least a quarterly basis.

companyName: InfuSystem Holdings, Inc

ticker: INFU


text: Cybersecurity is critical to preserving our documents and records and enabling us to reach our ultimate goals. Inasmuch as we have no current operations, no customers, no contractors, no supply chains, no current revenue stream, and only one employee, we do not face the multitude of cybersecurity threats common to most companies and most industries. We believe a cybersecurity incident would have a minimum impact on our operations. However, common cybersecurity threats and risks make it imperative that we maintain adequate precautions with respect to cybersecurity and, to this extent, we have industry standard security controls in place to protect our systems and our data.

companyName: DIAMONDHEAD CASINO CORP

ticker: DHCC


text: Our approach to addressing cybersecurity threat risks also includes mitigating risk associated with our use of third-party service providers. For example, when we enter into contracts with third-party collaborators or vendors pursuant to which sensitive business or personal data will be shared or accessible, we include provisions safeguarding the protection of confidential information. We also utilize a third party service provider to maintain our information systems and assets and to employ technical safeguards that are designed to protect our information systems from cybersecurity threats.

companyName: TAO Synergies Inc.

ticker: TAOX


text: Risks from Cybersecurity Threats From time to time, the Corporation has experienced attempts by unauthorized parties to access or disrupt its information technology systems. To date, it has not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of the Corporation's information systems or a cybersecurity breach could materially and adversely affect its business, results of operations and financial condition. See additional information provided under Item 1A, Risk Factors. The Corporation manages its cybersecurity risk by limiting its threat landscape. For example, the Corporation does not store, transmit or process many of the types of data commonly targeted in cyber-attacks, such as consumer credit card or financial information. The Corporation recognizes cyber-threats are a permanent part of the risk landscape, and new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: We regularly engage third party service providers to assist with management of cybersecurity risks. For instance, as noted above, we engage third parties to conduct frequent, independent vulnerability and penetration testing of our systems. In addition, in 2023, we engaged Grant Thornton LLP to conduct a SOC 2 audit of our systems and controls. Further, our enterprise level IT general controls are audited annually by our independent registered public accounting firm.

companyName: HEIDRICK & STRUGGLES INTERNATIONAL INC


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to respond to, remediate, and resolve any cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.

companyName: ETSY INC

ticker: ETSY


text: We utilize ISO 27001 to identify, assess and manage information security risk and maintain a compliant Information Security Management System ("ISMS"). Our global information security management program is ISO 27001:2013 certified.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Chubb uses risk-based processes to oversee and identify cybersecurity risks associated with the use of third-party service providers and third-party hardware. These processes include contractual controls as well as risk-based diligence processes, periodic assessments, and monitoring. Chubb recognizes the growing risk associated with third-party hardware, software, and services, and we have taken steps we believe are appropriate to manage those risks. We review third-party software and hardware in our environment to understand the components used and what impact they could have on our overall cyber risk environment.

companyName: Chubb Ltd

ticker: CB


text: A failure of one or more key information technology systems, networks or processes may materially adversely affect our ability to conduct our business." in Item 1A. " Risk Factors."

companyName: SRx Health Solutions, Inc.

ticker: SRXH


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Nominating and Governance committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our Nominating and Governance committee consist of members with years of experience in cybersecurity oversight.

companyName: Enovix Corp

ticker: ENVX


text: We evaluate the security practices of certain third-party service providers to identify potential cybersecurity risks, including by reviewing documentation concerning their security measures. Where appropriate, including for third-party contracts under which our data will be stored, we contractually obligate providers to implement and maintain reasonable administrative, technical, and physical safeguards and other security measures designed to maintain the confidentiality, security and integrity of our data, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: We have a cross-functional approach to addressing cybersecurity risk, with our information technology, legal, and internal audit functions regularly presenting to the Audit Committee and Technology & Operations Committee on key cybersecurity topics. Our CISO, together with our CIO and other members of the senior leadership in our information technology organization, also provide the Audit Committee and Technology & Operations Committee with these updates on at least a quarterly basis, and more often as needed. These reports include topics such as analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status.

companyName: WORLD KINECT CORP

ticker: WKC


text: Our entire board of directors is responsible for the strategic leadership and direction of our cybersecurity program and has oversight over cybersecurity risks. Our management may provide periodic presentations to the board on our cybersecurity program, including updates on cybersecurity risks, strategy and incident management, as applicable. Our cybersecurity risk management is also administrated at a management level through a multi-disciplinary Technology Business Review Committee comprised of members of our operational and organizational management, as well as our outsourced Virtual Chief Information Officer. The Technology Business Review Committee is tasked with identifying and monitoring what we believe to be the key technology risks currently facing the Company, including cybersecurity risks. The committee meets on at least a quarterly basis and on an as-needed basis to address risks, regulatory requirements, potential threats, vulnerabilities, available mitigation strategies and technologies, operational imperatives and changes, and progress updates on relevant projects related to our IT and cybersecurity.

companyName: PACIFIC HEALTH CARE ORGANIZATION INC

ticker: PFHO


text: The full board of directors receives quarterly updates from the audit committee on its oversight of cybersecurity risk and engages in further review for the full board of directors from time to time as appropriate.

companyName: Frontdoor, Inc.

ticker: FTDR


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. The Chief Compliance Officer oversees the Company's risk management function generally and relies on the Chief Technology Officer of the Advisor to assist with assessing and managing material risks from cybersecurity threats. The Chief Technology Officer of the Advisor has over 26 years of experience in actively managing information technology programs, including cybersecurity, and is supported by an experienced team who assist with the cyber programs applicable to the Company. The Chief Compliance Officer has been responsible for this oversight function as Chief Compliance Officer to the Company for over one year and has worked in the financial services industry for over 32 years, during which the Chief Compliance Officer has gained expertise in assessing and managing risk applicable to the Company.

companyName: Overland Advantage


text: Our Director of Global Cybersecurity has over 15 years of cybersecurity and information technology experience, including as Director of Cybersecurity for various institutions. Our Director of Global Cybersecurity has a Bachelor of Science in Information Science and Technology and a master's degree in information sciences, cybersecurity and information assurance, and he has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Network+ ce certification. Our CIO has over 25 years of cybersecurity and information technology experience, including serving in the information technology function at Cummins Inc., where she served as the information technology leader in Cummins Filtration Inc., and as a programmer, analyst and information technology architect. Our CIO holds an undergraduate degree in business administration with emphasis in management information systems. Our Chief Financial Officer, Chief Technical Officer, Chief Legal Officer, VP of Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management each have relevant educational and industry experience, including managing risks at our Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes the implementation of a cybersecurity incident response plan.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: Our board of directors has established oversight mechanisms to manage risks from cybersecurity threats. The audit committee of our board of directors, or audit committee, has primary responsibility for oversight of cybersecurity and is briefed on cybersecurity risks at least once a year and following any material cybersecurity incidents. Our board of directors receives periodic updates from our audit committee regarding matters of cybersecurity. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any significant updates to our cybersecurity risk management and initiatives.

companyName: iTeos Therapeutics, Inc.


text: Our cybersecurity program is managed and directed by our Head of Information Technology, or IT, who has nearly thirty years of experience in information technology and information systems management. Our Head of IT reports to our Chief Financial Officer. Our Cybersecurity Governance Team, which is made up of representatives from across the organization, is responsible for oversight of cybersecurity risks and addressing potential cybersecurity risks to business programs, employees, clients, vendors and partners.

companyName: Aura Biosciences, Inc.

ticker: AURA


text: At the management level, our Global Information Security Team monitors alerts and informs relevant global senior management of all incidents and related mitigation and remediation, and escalates to the Cybersecurity Special Committee as needed. Global senior management monitors initiatives to prevent, detect, mitigate, and remediate cybersecurity risks and incidents.

companyName: COTY INC.

ticker: COTY


text: Monroe Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser or our administrator, is integrated into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: MONROE CAPITAL Corp

ticker: MRCC


text: Our cybersecurity program provides a program for compliance with applicable cybersecurity and data protection laws. Our program is designed to ensure the security and confidentiality of customer, employee and Company information, protect against known or evolving threats to the security or integrity of customer records and personal information and protect against unauthorized access to or use of such information. We work with third party firms to review and monitor our cyber security programs, our regulators, and other third-party service providers to ensure that these policies are adequately designed to appropriately safeguard such information. The Company's policies and procedures include, and are not limited to: Information Systems and Cyber Security Policy Patch and Change Management Cyber Incident Response Policy and Testing Annual NIST Risk Assessments Business Continuity and Disaster Recovery Plans and Testing Annual CIS Benchmarks Assessments Third Party Risk Management Policies Access to Threat Intelligence Remote Access Policy Dark Web Monitoring Customer Facing Technology Risk Assessments Cyber Risk Insurance Policy Cyber Security Awareness Training Physical Security Policy

companyName: Embassy Bancorp, Inc.

ticker: EMYB


text: We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements (collaborating with service providers to help assess the sufficiency of their cybersecurity measures, and requiring service providers to notify us promptly of cyber incidents that may affect our systems or data).

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: The key processes, or components, of our cybersecurity risk management include: conducting periodic risk assessments to assist in identifying cybersecurity threats or risks; cybersecurity strategic roadmap;

companyName: CarParts.com, Inc.

ticker: PRTS


text: We are committed to safeguarding our customers and the sensitive information shared in the application of software and services provided. Our cybersecurity program, risk management and governance reflect our dedication to not only meeting industry standards but exceeding them.

companyName: Certara, Inc.

ticker: CERT


text: Risks From Cybersecurity Threats To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Trent Cox, Vice President of Product and Business Operations, is serving as our interim CSO. In that role, he chairs the Council and is responsible for overseeing a unified security program that provides cybersecurity, fire and protection operations, physical security, insider threat, and classified security. Mr. Cox has over 25 years of experience in the aerospace and defense industry, including, prior to joining Boeing in 2024, Chief Information Officer of Raytheon UK, Deputy CIO and Executive Director of Collins Aerospace and Raytheon Intelligence and Space, and Executive Director for Program Execution for the Raytheon Missile Systems businesses. He reports directly to the CIDO and meets regularly with other members of senior management and the Audit Committee.

companyName: BOEING CO

ticker: BA


text: While our audit committee has oversight responsibility for risk management generally, the Director of Information Technology is specifically responsible for overseeing our cybersecurity program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. Our Director of Information Technology provides periodic updates to senior management in this regard and covers the state of our cybersecurity program to information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents of interest, including those associated with our third - party service providers. The board of directors will be informed promptly of material risks from cybersecurity threats.

companyName: CYPHERPUNK TECHNOLOGIES INC.

ticker: CYPH


text: The Technology and Operations Committee receives regular and prompt information from the Information Security Department as reported by the CISO which in turn provides periodic, regular and prompt reporting to the Management Committee on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted the Bank, as applicable and needed.

companyName: Federal Home Loan Bank of New York


text: Role of Management To more effectively assess and manage cybersecurity threats, we have a dedicated Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide information security strategy, policy, process, and technology. Our current CISO has 20+ years of information security and risk management experience and holds a Certified Information Systems Security Professional (CISSP) certification. Our CISO regularly briefs our Audit Committee on our cybersecurity and information security program and cybersecurity incidents deemed to pose a risk of a critical business impact or reputational harm.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: Our cybersecurity risk management program is integrated with our ERM program and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal compliance, strategic, operational and financial risk areas. Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. In addition, we conduct risk assessments of enterprise third-party software and cloud vendors by utilizing security questionnaires prior to procurement. On a regular basis, we engage consultants, including external counsel and cybersecurity firms, to conduct penetration tests and architecture design reviews.

companyName: ONEOK INC /NEW/

ticker: OKE


text: To address any gaps in the Company's collective expertise and to account for the ever-evolving nature of cybersecurity risks, the Company retains various consultants as noted above. The internal and external headcount, and the expertise of the employees and consultants, will change from time to time as we adapt to the changing cybersecurity environment.

companyName: Portillo's Inc.

ticker: PTLO


text: Incident Response and Recovery Planning: CTO and the MSP have established a written information security incident response plan that addresses the response to a cybersecurity incident, which plan will be tested and evaluated on a regular basis.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: Trustmark's information security program is primarily administered at the management level by the Information Security Department, which is led by Trustmark's Chief Information Security Officer (CISO), and is supported by the Information Technology Department, which is led by Trustmark's Chief Information Officer (CIO). The CISO reports to the CIO, who in turn reports to Trustmark's Chief Credit and Operations Officer. Trustmark's Information Security Department is responsible for day-to-day management of Trustmark's information security program, including data loss prevention, access control, threat monitoring, incident response, insider threat monitoring and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, Trustmark's Information Technology Department maintains policies that govern technical aspects of Trustmark's information security program. Each policy is reviewed and approved by the Enterprise Risk Committee at least every three years and is mapped to applicable regulatory guidance. The Cybersecurity Operations team within the Information Technology Department maintains and runs Trustmark's security operations center and is responsible for cybersecurity event management and maintaining security tooling. Trustmark also maintains an Information Security / Cybersecurity Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Corporate Security, Internal Audit and Legal departments and members of executive management. This committee meets quarterly to discuss and review Trustmark's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department and Information Technology Department.

companyName: TRUSTMARK CORP

ticker: TRMK


text: Our Board considers cybersecurity risk one of the most significant risks to our business. The Board has delegated to the Audit Committee oversight of cybersecurity, data privacy, and other information technology risks affecting the Company. Our CTO and CISO typically provide quarterly reports to the Audit Committee, which also provides quarterly reports on its activities to the Board. Annually, the Board receives a comprehensive update regarding the Company's cybersecurity efforts, which may include a cybersecurity tabletop exercise, presentation by third party cybersecurity experts, or similar events. Several members of our Board and Audit Committee have cybersecurity, data privacy, or related experience from their principal occupation or other professional experience.

companyName: Public Storage

ticker: PSA


text: Our Information Technology Steering Committee ("ITSC") is central to the Board's oversight of cybersecurity risks, which are incorporated into our overall risk management program overseen by our Board Risk Committee. These Committees meet no less than quarterly and are composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. While, as of the date of this Annual Report on Form 10-K, we have not encountered cybersecurity challenges that have materially impaired our operations or financial standing, our systems and those of our customers and third-party service providers are under constant threat and it is possible that we could experience a significant event in the future.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: BlackRock's cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by BlackRock's CISO. As of December 31, 2024, the CISO had over 30 years of experience in information technology with a 25-year concentration in information security, including previously serving as the CISO at several global financial institutions, and held the Certified Information Systems Security Professional certification. The CISO works closely with the leadership team and other subject matter experts in the global cybersecurity group, who collectively have extensive prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and overseeing cybersecurity controls in technology risk and audit functions, as well as having relevant degrees and industry-leading certifications.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: The IRP includes: • Identifying the incident response team (the "IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents. • Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents. • Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. • Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP. • Reviewing the IRP at least annually, or whenever there is a material change in Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: Our CTO and CISO manage our cybersecurity strategy. Our CTO has over 14 years of experience in information security and risk management and reports directly to our President and Chief Executive Officer. Our CISO has over 11 years of experience in information security and risk management, including at a federal law enforcement agency, and has a Master of Science degree in Cybersecurity.

companyName: STEELCASE INC


text: The performance and effectiveness of our cybersecurity program are also tested on a regular schedule by outside consulting third-party experts.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC