text: ADP has implemented a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats. Our cybersecurity policies, processes, and standards are informed by industry practices and by industry frameworks and standards such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and the International Organization for Standardization information security standards, including those standards for which we do not have a certification, but we do exercise judgment in selecting applicable controls from such framework or standards. Our cybersecurity program includes: • Technical Safeguards. We have implemented a layered approach to defend against cybersecurity threats. We periodically evaluate technical controls through application security assessments, vulnerability management, penetration testing, and security audits. • Incident Management and Response. A global team monitors our key applications and systems 24/7/365 to detect, investigate and respond to anomalies and incidents. This team addresses reported or detected issues by following a defined incident lifecycle and uses an incident management system to record facts, impact and remedial actions taken. We have established a cybersecurity incident response plan and escalation process, outlining processes for responding to incidents from identification to mitigation and notifying members of senior leadership, the board of directors and external advisors, as appropriate. We test our plans and processes through simulation exercises, scenario planning and tabletop exercises, using findings to improve processes. • External and Internal Assessments. We periodically engage assessors, consultants, auditors, and other third parties to evaluate our technology, security, and related controls and benchmark against industry practices. We engage in both internal and external assurance and audit activities across the company multiple times a year including an annual third-party review of our overall cybersecurity program. • Threat Intelligence. We maintain affiliations with cybercrime task forces and other third-party monitoring organizations. In addition, we collaborate with professional security organizations, law enforcement and technology companies to proactively identify malicious activity. • Business Resiliency Program. We have established a global, integrated business resiliency program designed to manage the impacts of technological, environmental, process and health risks on service delivery. This program uses an integrated framework that lays out our mitigation, preparedness, response and recovery process. • Third-Party Risk Management. We maintain a third-party risk management process, designed to identify and manage risks associated with our vendors and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement. We also seek to include security and privacy terms, where appropriate, in our contracts with third-party service providers that require third parties to maintain security controls to protect our data and notify us in the event of a cybersecurity incident.

companyName: AUTOMATIC DATA PROCESSING INC

ticker: ADP


text: We leverage industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and Center for Internet Security ("CIS") framework to inform how we identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKECHERS USA INC

secItem: Item 1C


text: Role of Management Our management and information technology teams, collectively, have decades of experience in the areas of information technology, finance, legal, human resources, data privacy and risk management. Our internal information technology organization, overseen by our Controller, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The day-to-day activities of our information technology organization are managed by our current head of information technology, who has more than 30 years of experience in information technology systems and cybersecurity, including experience in safeguarding and monitoring networks and systems, responding to incidents, and reducing the risk of business exposure, and holds multiple industry-recognized certifications. The information technology organization also engages legal and cybersecurity professionals with appropriate subject matter expertise in support of its cybersecurity efforts. The information technology organization manages and continually enhances our enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience to minimize the business impact should an incident occur.

companyName: Liquidia Corp

ticker: LQDA


text: Role of management Led by our CIO and CISO, our information security management team oversees the design, implementation and evolution of our security practices to protect critical business processes, information systems and IT assets across our business. The information security management team is primarily responsible and accountable for the awareness, oversight and control of enterprise information security and the implementation of cybersecurity policies, procedures and strategies. Our information security management and risk assessment teams regularly communicate to senior management about the effectiveness and efficiency of our information security program's risk management processes. Senior management reviews such assessments, reports any potential threats and vulnerabilities and responds accordingly, including by providing regularly scheduled reports and escalating items, as necessary, to our Disclosure Committee and Risk Committee.

companyName: PRA GROUP INC

ticker: PRAA


text: While to-date we have not experienced a material cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers, we are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Cybersecurity for our Company is conducted by our United States based operations and European based operations. For our United States based operations, our Information Technology department ("ITUS") in New York, New York is in charge of our cybersecurity for offices in the United States, Italy, and other remote locations. For our European based operations, our Information Technology department ("ITEU") in Paris, France is in charge of our cybersecurity for offices in France, and other remote locations.

companyName: INTERPARFUMS INC

ticker: IPAR


text: We use third-party service providers to perform a variety of functions throughout our business, such as software application providers, hosting companies, and contract research organizations. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including reviewing security questionnaires and imposing contractual obligations related to cybersecurity on the provider.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The IRP is executed by an Incident Response Team ("IRT"), led by our Information Systems Director. The exact composition of the IRT varies depending on the severity and potential impact of an incident and will typically include internal IT professionals and stakeholders across corporate and business functions. The team collaborates with internal experts and may engage external resources to assess and contain a threat if deemed necessary. Such external resources may potentially include forensic investigation and response firms, law firms, forensic accountants, and consultants who are on retainer contracts for expedited availability.

companyName: RICHARDSON ELECTRONICS, LTD.

ticker: RELL


text: As part of our approach to cyber risk management, we regularly perform internal audits of internal processes and controls relating to cybersecurity.

companyName: GULF RESOURCES, INC.

ticker: GURE


text: To manage risks associated with third-party service providers, we typically require new vendors with access to our computing environment or sensitive data to undergo a risk assessment from our information security team. We conduct periodic reviews of these vendors to evaluate compliance with our cybersecurity policies. We strive to ensure that our contracts with such vendors require them to maintain security controls in line with industry best practices, applicable laws and our policies. We rely on vendors to notify us in a timely manner of material cybersecurity incidents, by virtue of the documents governing their relationship with us or applicable law.

companyName: FLUOR CORP

ticker: FLR


text: We engage consultants and auditors in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to affirm that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: A cornerstone of our cybersecurity governance is the annual performance of comprehensive cybersecurity risk assessments performed by third party cybersecurity advisors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as monitor and test our safeguards. The insights gained from these assessments inform the continuous refinement of our cybersecurity strategies and defense mechanisms. As a core component of our risk management process, all employees are required to participate in annual information security training.

companyName: Urgent.ly Inc.

ticker: ULY


text: Our cybersecurity incident response process is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances including our CISO, our Chief Financial Officer and our Chief Legal Officer. Upon consultation with our Chief Financial Officer and our Chief Legal Officer, our CISO works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response process includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Freshworks Inc.

ticker: FRSH


text: Aemetis contracts with a primary Managed Security Provider (MSP) to provide services that assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk management programs and responding to incidents. Aemetis maintains cyber recovery plans as well as a cybersecurity insurance policy.

companyName: AEMETIS, INC

ticker: AMTX


text: We, like other companies in our industry, face a number of cybersecurity risks, including cybersecurity incidents, in connection with our business. Although such risks and incidents have not materially affected us, including our business strategy, results of operations or financial condition, to date, we and/or our vendors have, from time to time, experienced threats to, or security incidents, related to our data and systems or that had the potential to otherwise impact our business. For more information about the cybersecurity risks we face, refer to "Item 1A. Risk Factors."

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: Annually, the Security Committee (defined below) conducts a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes and inform a broader enterprise-level risk assessment that is analyzed by the Security Committee and presented to the board of directors, Audit Committee and members of management.

companyName: CPI Card Group Inc.

ticker: PMTS


text: We utilize third party service providers to support and facilitate business and operational activities to achieve strategic goals. However, third parties may expose us and our customers to various risks. We have implemented a Vendor Risk Management ("VRM") framework, which provides the tools and practices utilized in the oversight of third-party service providers, with an objective to meet legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. For the 2024 period, there were no material incidents affecting the VRM framework or controls.

companyName: BAR HARBOR BANKSHARES

ticker: BHB


text: Park's information security and cybersecurity operations teams have defined escalation paths for issues and events, which include engaging Park's Incident Response Plan, and working issues and events through Park's Cybersecurity Response Playbook. Evaluation of escalated events is performed first by the Information Security Officer and Chief Legal Officer, who track and log cybersecurity incidents across Park and Park's vendors. Any incident assessed as potentially being or becoming material is further escalated to a leadership team that includes the Chief Financial Officer, Chief Operations Officer, Chief Risk Officer, Chief Information Officer, and Chief Accounting Officer. Events that leadership determines may be material are shared with the Board of Director's Executive Committee for final review and evaluation. Park engages teams, including but not limited to information security, information technology, and fraud and security, to address and remediate cybersecurity events and issues as they arise. Park engages outside legal counsel for assistance in evaluating and remediating cybersecurity issues and events. Information regarding issues and events is also shared by Park leadership with both internal and external auditors.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: Our processes for assessing, identifying, and managing risks from cybersecurity threats, including operational risks, financial reporting risks, reputational risks, personal data theft, fraud, and other potential risks, are integrated into our overall enterprise risk management process, and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: Our cybersecurity risk management processes are led by our CIO and our VP Infrastructure. Our CIO has served our company in that capacity since 2018 and held CIO or other IT and cybersecurity leadership roles at other companies for more than 10 years prior to that. He has a master's degree in computer systems from the Naval Postgraduate School. Our VP Infrastructure, who is responsible for our information technology infrastructure and our information security strategy and operations, has more than 30 years of experience in information technology, serving in senior IT leadership roles with responsibility for cybersecurity at our company since 2007. His IT expertise was established prior to that through education and work experience in a variety of technical positions in the consumer goods, health care, and aerospace industries. They are supported by a team of skilled information security professionals within our Information Technology function. This team provides periodic updates to our ERM Committee, composed of our Chief Executive Officer, Chief Financial Officer, General Counsel, and other members of our senior leadership.

companyName: MARZETTI CO

ticker: MZTI


text: While the Company has experienced minor cybersecurity incidents in the past, to date none have materially affected the Company or its financial position, results of operations and/or cash flows. The Company continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems, infrastructure, and the information they contain.

companyName: BOSTON BEER CO INC

ticker: SAM


text: Material cybersecurity incidents are required to be reported to the Board of Directors and to the SEC on Form 8-K. Our systems and services are vulnerable to interruptions or other failures resulting from cybersecurity attacks, such as computer viruses, ransomware, phishing, hackers, or other security issues. In addition, the rapid evolution and increased adoption of new technologies, such as artificial intelligence, may intensify our cybersecurity risks. An interruption or cybersecurity breach, disruption or misuse of our information systems, or the information systems of our third-party service providers, could have a material negative effect on our business, financial condition and results of operations but we have processes in place to mitigate these risks. As of the date of this report, we have not experienced material business disruption, monetary loss, and/or data loss as a result of phishing, business email compromise or other types of attacks.

companyName: Primo Water Corp /CN/


text: Management's Role Managing Risk Our Co-CEOs, CFO, and IT Manager play a primary role in informing the Audit Committee on cybersecurity risks. Our IT Manager has 7 years of experience with the Company, which includes managing cybersecurity. These individuals monitor activity and potential risks related to the day-to-day operations of the business, including reviewing results of the work of our outside consultants. They will provide briefings to the Audit Committee on a periodic basis regarding cybersecurity matters, including but not limited to the following: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reporting, if any, and learning from any cybersecurity events; • Risk mitigation efforts and insurance, and • Compliance with regulatory requirements and industry standard.

companyName: GEN Restaurant Group, Inc.

ticker: GENK


text: As an externally managed BDC, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Investment Adviser, an indirect subsidiary of AGM. AGM determines and implements appropriate risk management processes and strategies as it relates to cybersecurity for us and other affiliated entities managed by AGM, and we rely on AGM for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: An incident response plan is in place to ensure swift and effective action in the event of a cybersecurity incident. The plan defines the Incident Response Team (IRT) which includes representatives from executive management, critical business lines, and communications. The plan outlines responsibilities of the IRT to meet in the event of an incident and ensure proper containment, investigation and forensic analysis, recovery procedures, and notifications are made within the parameters of all applicable laws and regulations. The IRT participate in testing of the plan at least annually through simulated cyberattack exercises. The Board of Directors reviews and approves the plan annually.

companyName: FRANKLIN FINANCIAL SERVICES CORP /PA/

ticker: FRAF


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate cybersecurity risks. The Risk and Compliance Committee is a board-level committee designated by our board to oversee cybersecurity risks. The Risk and Compliance Committee receives updates on cybersecurity matters at least quarterly, and our processes require ad hoc updates within two days of a breach as part of the Bank's cybersecurity risk management strategy designed to protect the information and assets that are critical to our business. The full Board of Directors receives an Annual Report from the Chief Information Security Officer on the Bank's Information Technology Systems, including cybersecurity risk.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Our program is regularly evaluated by internal and external experts with the results of those reviews reported to the Board of Directors, Audit Committee, and senior management. We also collaborate with thought leaders in cybersecurity including with key vendors, business partners, cybersecurity and data breach response counsel, and industry participants as part of our continuing efforts to evaluate and improve the effectiveness of our information security policies and procedures. This collaboration allows us to rapidly adopt industry best practices developed through firsthand experience mitigating cyber incidents.

companyName: Clean Energy Fuels Corp.

ticker: CLNE


text: In order to promote a culture of security awareness across our organization, all employees are required to complete an annual cybersecurity awareness training and are provided with periodic information updates on cybersecurity threats. We also maintain cyber insurance policies to help partially mitigate the financial impact of a significant cybersecurity incident.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to safeguard our information assets and operations from internal and external cyber threats, including protecting employee and patient information from unauthorized access to or attacks on our networks and systems. These processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine reviews of our policies and procedures to identify risks and enhance our practices. We also employ processes to identify material risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Rezolute, Inc.

ticker: RZLT


text: The Company maintains robust processes for assessing, identifying and managing materials risks from cybersecurity threats. The Company's cybersecurity program is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the GLBA and the risk of cybersecurity threats is integrated into the Company's Enterprise Risk Management ("ERM") program, governed by the Board level Risk Committee. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level and led by the Director of Information Security. Periodically, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a security operations center with round-the-clock monitoring, and the Director of Information Security along with the Chief Information Officer ("CIO") receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party vendors and cloud suppliers before utilizing their services. The assessment identifies cybersecurity-related risks an includes recommendations to enhance the security of new cloud computing services. The Company reassesses cloud suppliers quarterly.

companyName: CAMBRIDGE BANCORP


text: We have also formed a steering committee, composed of IT staff and relevant business leaders responsible for the Company's material information, including commercially sensitive data. The goals of this steering committee include overseeing our annual material risk assessment and documenting and reporting to senior management. The steering committee also reviews changes to procedural and other controls. We have also formed a risk register subcommittee to review and formally discuss any critical risks identified during our vISO annual assessment of our cyber environment.

companyName: ENANTA PHARMACEUTICALS INC

ticker: ENTA


text: Our Information Security Program is integrated into our risk management program and is aligned to the Company's business strategy and Enterprise Risk Management program. It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk, including legal, compliance, strategic, operational, and financial risk. Key elements of our Information Security Program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment are conducted on at least an annual basis; • internal testing of our security controls and our response to cybersecurity incidents; • the use of external service providers, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for all employees that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • maintenance and regular testing of a Business Continuity Plan that includes redundant back-up systems for critical functions; • a physical security program that is tested regularly; • obtaining and maintaining cyber insurance; and • a third-party risk management program for service providers, suppliers, and vendors, that provides for the assessment, monitoring and management of cybersecurity risk presented by the Company's use of such third parties, as well as contractual protections related to cybersecurity incidents affecting third party vendors and service providers.

companyName: First Internet Bancorp

ticker: INBK


text: Further, we currently maintain a cybersecurity insurance that provides coverage for certain types of incidents; however, such insurance may not be sufficient in type or amount to cover claims related to all cyber threats or risks.

companyName: MCCORMICK & CO INC

ticker: MKC


text: Our Compliance and Security Officer ("CSO") is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.

companyName: STEM, INC.

ticker: STEM


text: The Audit Committee and Board of Directors receive routine updates from senior management, including leaders from our information technology and legal functions regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and mitigating those risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.

companyName: Prime Medicine, Inc.

ticker: PRME


text: Company's cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats. The Company relies on Saratoga Investment Advisors to implement the cybersecurity program. The cyber risk management program involves risk assessments relating to the information systems of Saratoga Investment Advisors, incident response training and testing, implementation of security measures, identification of sensitive information assets ("Critical Information") and ongoing monitoring of systems and networks and assessment of the associated risks on an annual basis, including networks on which the Company relies on. The Chief Compliance Officer, along with the Company's external information technology consultant (the "IT Consultant"), actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company and Saratoga Investment Advisors have engaged external experts, including consultants, such as the IT Consultant, to evaluate cybersecurity measures and risk management processes, and depends on and engages various third parties, including suppliers, vendors, and service providers.

companyName: SARATOGA INVESTMENT CORP.

ticker: SAR


text: Our cybersecurity risk management program is integrated into, and forms an integral part of, our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: ITT INC.

ticker: ITT


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity challenges that have materially impaired our operations or financial standing in Fiscal 2025 and Fiscal 2024.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: The Board's ROC has primary oversight responsibility for management's efforts to mitigate cybersecurity risk and respond to cybersecurity incidents. The ROC receives quarterly cybersecurity reports, including any reportable incidents, and reviews and approves the Information Security Program at least annually or whenever significant changes are made to the program. These updates include information regarding management's ongoing efforts to manage cybersecurity risk and the steps management has taken to address and mitigate the evolving cybersecurity threat environment. The ROC members include independent directors from the Board who have expertise in areas relevant to their responsibilities over cybersecurity, including senior leadership experience in financial services and information technology.

companyName: EAST WEST BANCORP INC

ticker: EWBC


text: In response to the growing use of AI, by bad actors, we adapt our internal policies, procedures, and control mechanisms to address AI-driven threats, including: Automated phishing campaigns and deepfake content used for impersonation or fraud. code generation via large language models. attacks that manipulate input data to bypass security algorithms. vulnerability scanning and exploitation of system weaknesses. monitoring and anomaly detection powered by machine learning to identify AI-driven attack patterns. SDLC with static and dynamic code analysis to detect AI-generated vulnerabilities. training on AI-related risks, such as synthetic media, prompt injection, and suspicious automation. risk assessments that evaluate the AI capabilities of vendors and partners to prevent external exposures. response playbooks tailored to AI-specific scenarios, such as automated botnet coordination or synthetic identity fraud. practices ensure our organization remains agile, secure, and prepared for the evolving AI-driven threat landscape.

companyName: Zedge, Inc.

ticker: ZDGE


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our business could be damaged, and we could be subject to liability, if there is any unauthorized access to our data or our users' content, including through privacy and data security breaches or incidents," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: DROPBOX, INC.

ticker: DBX


text: We rely on a multidisciplinary team (including from management and third-party service providers) to assess how identified cybersecurity threats could impact our business. These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats. Management also conducts periodic and on-demand assessments of our cybersecurity risks.

companyName: RELMADA THERAPEUTICS, INC.

ticker: RLMD


text: The Company does not believe that any risks from cybersecurity threats to date, including as a result of any previous cybersecurity incidents of which the Company is aware, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial conditions. Refer to the risk factor captioned, "Security breaches through cyber attacks or intrusions, or other significant disruptions of the Company's information technology ("IT") networks, communications, and related systems could impair our ability to operate, adversely affect our financial condition, and damage our reputation," in Part I, Item IA. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: No less frequently than annually, the Manager completes an assessment to identify potential cybersecurity threats and vulnerabilities and to better prioritize and mitigate the Trust's cybersecurity risk. The Manager maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including key vendors, service providers and other external users of the Trust's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Manager provides regular, mandatory training for its employees regarding cybersecurity threats as a means to equip its employees with effective tools to address cybersecurity threats, and to communicate the Manager's evolving information security policies, standards, processes and practices.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and products (Information Systems and Data).

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: The Committee includes, but is not limited to, the Company's IT Security Officer, Data Privacy Officer, Safety Officer, and Senior VP of Global IT and System Operations.

companyName: ENZO BIOCHEM INC


text: Employees are an important defense against cybersecurity threats. Each employee is responsible for protecting Corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: The potential impact of risks from cybersecurity threats are assessed regularly, including how such risks could materially affect our business strategy, operational results, and financial condition. During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: PhenixFIN Corp

ticker: PFX


text: Education and Awareness: Security Awareness training is provided for all new and existing employees that reviews information concerning cyber risks and user responsibilities and heightens awareness of cyber threats. Training is documented and reported to senior management when appropriate.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: Our management team supervises our efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including through briefings from internal IT personnel, which may include threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in our IT environment.

companyName: Zeo Energy Corp.

ticker: ZEO


text: We employ a cybersecurity program which we believe is appropriate for the potential of cybersecurity threats faced by us and is built upon a set of policies, procedures and standards supported by training and education. Our information systems employ local and cloud storage and recovery services from various third parties. We have established processes to assess, identify, and manage risks from cybersecurity threats as part of our broader enterprise-wide risk management system and processes and engaged third-party consultants to assess and gather threat intelligence and cyber risk trends and conduct assessments and testing of our cybersecurity procedures and protections, which is overseen by our Board of Directors through our Audit Committee, along with our executive management.

companyName: FEMASYS INC

ticker: FEMY


text: We design our cybersecurity program for compliance with industry-specific and other regulations (e.g., the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)) demonstrating our commitment to both domestic and international information security standards.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: As of December 31, 2023, we have not detected any cybersecurity threats, including prior incidents, that have materially impacted the Company, our business strategy, our financial results, or our financial health. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to our Risk Factors discussion in the section titled "We face risks relating to Cybersecurity attacks, loss of confidential information and other business disruptions" in this Form 10-K.

companyName: Whitestone REIT

ticker: WSR


text: Our CISO reports to our Chief Financial Officer and leads our cybersecurity risk management efforts and our dedicated information security team. Our CISO has over 20 years of information security experience, including over four years as a director in the information security management practice of a big four accounting firm. He holds multiple information security certifications and has a B.S. in Network Security. Our CISO leads our Information Security Steering Committee ("ISSC"), comprised of key executives and operating personnel from across the company, that oversees ongoing day-to-day management of our risks to information systems. The ISSC tracks risks and security initiatives, reviews the results of annual cybersecurity risk assessments, reviews the results of internal and third-party information security audits and assessments, identifies significant risks that threaten the achievement of security commitments and identifies controls to mitigate such risks. The CISO, along with other members of the ISSC and information security teams, remains apprised of developing cybersecurity trends through communications with the intelligence and law enforcement communities, vendors and industry engagement so that our cybersecurity risk management and governance controls and processes address new and evolving cybersecurity threats.

companyName: Paylocity Holding Corp

ticker: PCTY


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by Great Elm's Information Technology & Security Committee ("IT Committee"), comprised of GECM's Chief Operating Officer and other members of Company management as well as its third-party IT and consultant. In order to oversee and identify risks from cybersecurity threats associated with its use of large vendors and material third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs periodic reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.

companyName: Great Elm Capital Corp.

ticker: GECC


text: We design and assess our program based on International Organization for Standardization ("ISO") and National Institute of Standards and Technology ("NIST") information security risk management frameworks. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the above frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Risks Related to Cybersecurity."

companyName: Confluent, Inc.

ticker: CFLT


text: At the management level, Atkore's cybersecurity program is led by the Company's Vice President - Chief Information Officer ("CIO"), who reports to Atkore's Vice President – Business Development and Strategy, who in turn reports to Atkore's Chief Executive Officer. Atkore's CIO has over 30 years of experience in information technology roles with responsibilities including global cyber security strategy, global IT strategy, technology platforms and internal controls. The CIO has a Master of Business Administration from Kellogg School of Management at Northwestern University and a Bachelor of Science in Computer Information Systems from DeVry Institute of Technology. Reporting to the CIO is a Director of Cybersecurity. The current Director of Cybersecurity has over 20 years of experience in information technology roles with responsibilities including cyber security and security architecture and engineering. The CIO is supported by the Cybersecurity Steering Committee ("CSC"), a management committee comprising members of the Executive Leadership Team and includes the leaders of the information technology, legal, finance, human resources, commercial and communications functions and that report to the Chief Executive Officer. The CSC supports the CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation, and remediation.

companyName: Atkore Inc.

ticker: ATKR


text: Our information security program and cyber risk management program is managed and overseen by Jeff Dell, our Chief Information Officer ("CIO") and a team of information security personnel reporting to the CIO. Our CIO reports directly to the CEO and is responsible for the assessment and management of material risks for cybersecurity threats. Mr. Dell brings over 30 years of experience in information technology and information security, working as an executive within data-driven companies for the last 20 years, including serving as CIO since our formation in August 2017 and continuing through our Spin-off from cogint. Mr. Dell holds a Bachelor of Science in Business from Arizona State University and has earned GCIA, GCWN, GWAPT and CISSP certifications. For additional information regarding Mr. Dell's business experience, see Part 1, Item 1 Business – Information About Our Executive Officers included in this Annual Report.

companyName: Red Violet, Inc.

ticker: RDVT


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and risks incidents. Management is responsible for the establishment of our cybersecurity environment, as well as the assessment and management of cybersecurity risks. Management provides regular updates on our cybersecurity risk profile to the Audit Committee of our board of directors.

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, including our Information Technology Disaster Recovery Plan, are designed to comply with several regulatory requirements including DFARS/NIST 800-171 controls, and for our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We require all of our third-party information technology vendors to undergo evaluations by our internal data privacy and data security team as part of our efforts to assess, document and mitigate potential cybersecurity threats associated with our use of such vendors and the software, applications and services they provide. In addition, we have implemented measures designed to address the risks associated with the use of industrial control systems to help maintain the reliability and safety of our operations. Our information technology and operational technology disaster recovery program is designed to help maintain the continuity of critical business operations in the event of a disruptive cybersecurity incident through procedures for data recovery, system restoration, and business resumption.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Our cybersecurity incident response and vulnerability management processes and policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including senior management. Senior management works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes and policies include reporting to the management disclosure committee and to the audit committee of the board of directors for certain cybersecurity incidents.


text: We engage consultants in connection with our risk assessment processes. These service providers assist us in designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: Our Audit Committee of the Board of Directors is responsible for overseeing cybersecurity risk and periodically updates our Board of Directors on such matters. The Audit Committee regularly reviews and discusses with management the strategies, processes, procedures and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. The Audit Committee regularly and management the strategies continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements controls, as appropriate, to mitigate these risks.

companyName: Greenland Technologies Holding Corp.

ticker: GTEC


text: Supplier Management Program Through our Supplier Management Program, we maintain procedures that specify requirements for the assessment of suppliers and contractors who provide services that may impact our product and process quality. These procedures allow us to identify risks from potential cybersecurity incidents associated with our use of products and services from these suppliers and ensure that there is an appropriate level of oversight of our vendors' quality systems. We perform initial audits and then periodic, risk-based audits on our suppliers to ensure their products and services conform to our established quality standards.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents experienced by us or, to our knowledge, by any of our third-party service providers, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. For further discussion of cybersecurity and data privacy risks that may materially affect the Company and how they may do so, see "Risk Factors—If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could face clinical trial delays; regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational Governance

companyName: Celcuity Inc.

ticker: CELC


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide practice of cybersecurity risk management. This integration ensures that cybersecurity considerations are part of our decision-making processes. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, employee training, contractual arrangements, tools and related services from third-party providers, and management oversight to identify, assess, and manage material risks from cybersecurity threats. As part of our cybersecurity risk management process, we have conducted simulated cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cyber incident preparedness.

companyName: Liberty Energy Inc.

ticker: LBRT


text: We rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations. We have established a security program and processes to assess, identify and manage cybersecurity risks related to our IT and OT systems, as well as our products. Our global cybersecurity organization is led by our chief information security officer (CISO), who reports directly to our chief information officer (CIO) and under the organization of our chief information and digital officer (CIDO). Our current CISO has extensive information technology experience, including in security architecture, software development and engineering, as well as leading security operations and incident response, offensive and defensive cyber projects in increasing roles of responsibility. He also previously held Certified Information Systems Security Professional (CISSP) and GIAC Certified Forensics Analyst certifications. Our current CIDO has extensive experience overseeing information technology and security programs, including roles of increasing leadership within our Information and Digital organizations over the last ten years, and prior to that in increasing roles of responsibility managing information systems, including over 18 years at General Electric. Our current CIDO holds CISSP and other IT certifications.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Chief Operating Officer and our Director of E-Commerce are responsible for the oversight of risks from cybersecurity threats. The Board receives information and updates periodically with respect to the effectiveness of our cybersecurity and information security framework, data privacy and risk management. The Board will also be provided updates on any material incidents relating to information systems security and cybersecurity incidents.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.

companyName: Trade Desk, Inc.

ticker: TTD


text: Board of Directors considers cybersecurity risk as part of its risk oversight function. It has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees the implementation of the cybersecurity risk management program.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Integration efforts continue between legacy Viasat and Inmarsat's cybersecurity departments. Viasat is actively merging policies, processes, and operations security practices and operational footprints ensuring we have appropriate security tools and solutions that align with our business objectives and security requirements. The combined Viasat and Inmarsat cybersecurity organizations report to Viasat's CISO and remain focused on the overall Viasat and Inmarsat satellite service network and corporate integration activities.

companyName: VIASAT INC

ticker: VSAT


text: We routinely assess material risks from cybersecurity threats, including from any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. These risk assessments are designed to identify internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain safeguards intended to address and minimize identified risks and continue monitoring and testing the effectiveness of such safeguards.

companyName: QuantumScape Corp

ticker: QS


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: We have endeavored to implement policies, standards and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. Regular assessments of our cybersecurity safeguards are conducted both internally and by independent third-party cybersecurity vendors. Additionally, our internal audit department conducts regular audits to identify, assess and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response to audit findings. • Incident Identification and Response: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. While processes are in place to minimize the chance of a successful cyberattack, we have established incident response procedures to address a cybersecurity threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cybersecurity incidents that occur. In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan, which includes the involvement of our executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks to our Board of Directors, outside counsel and law enforcement, if deemed material or appropriate. Further, we conduct periodic incident response tabletop exercises and planned incident response drills with various members of our management team to continuously refine and update our incident response processes. • Cybersecurity Training and Awareness: We maintain a formal information security training program for all employees and contractors that includes training on matters such as phishing and email security best practices. We have implemented a requirement that all employees and contractors participate in information security training at least quarterly and have deployed internal phishing campaigns to measure the effectiveness of the training program. • Access Controls: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. • Systems and Processes: We use a combination of tools to identify cybersecurity incidents. We use firewalls and protection software in addition to working with a third-party cybersecurity vendor to scan internal and external networks for threat and intrusion detection. Our cybersecurity team regularly tests our controls through penetration tests, vulnerability scans and attack simulations. • Encryption and Data Protection: We have encryption methods in place to protect certain sensitive data. This includes the encryption of customer data, financial information and other confidential data. We also have multiple programs in place to monitor our retained data and take actions to secure the data.

companyName: Chord Energy Corp

ticker: CHRD


text: Our cybersecurity program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Our cybersecurity leadership regularly reports to the board of directors and its audit and risk management committees on information security and cybersecurity matters. For example, the risk management committee in conjunction with management and our enterprise risk management team reviews and discusses on at least a quarterly basis certain cybersecurity metrics that include reporting on phishing incidents and training, vulnerability management, security incident trends, detection and response effectiveness, recovery measures and incident resiliency.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: The risk assessment process is designed to identify assets requiring risk reduction strategies and includes an evaluation of the key factors applicable to the operation. The Company conducts a variety of information security assessments throughout the year, both internally and through third-party specialists. We partner with the Cybersecurity and Infrastructure Security Agency (CISA), under the Department of Homeland Security (DHS), to conduct regular vulnerability scanning against our public facing assets, and on a recurring basis we partner with outside firms to conduct thorough security assessments against our external and internal environment. Results of those assessments are further evaluated, and remediation activity is prioritized.

companyName: WAFD INC

ticker: WAFD


text: Risks from Cybersecurity Threats On February 16, 2022, we became aware of a cybersecurity intrusion that caused a network disruption and impacted certain of our systems. Upon detection, we took steps to address the incident, including engaging both internal resources and a team of third-party experts to investigate and respond to this intrusion. While the February 2022 cybersecurity intrusion did not materially and adversely affect our results of operations, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws and could have a material adverse effect on our business, results of operations and financial position. See "Risk Factors - Risks Related to Cybersecurity - The failure of our information technology systems, network disruptions, cyber-attacks or other breaches in data security could have a material adverse effect on our business, results of operations and financial position."

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: Our cybersecurity risk management program also includes: • a continuous vulnerability management process to monitor and identify threats in our environment, including our IT networks and legacy systems, that could potentially have a materially adverse impact on our critical systems, information and broader enterprise IT environment; • the use of reputable cybersecurity consultants and other third-party experts to enhance our cybersecurity posture, assist us in evaluating risks, conduct security assessments and provide guidance so the Company can maintain a posture of continual enhancement of our cybersecurity management and strategy; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a risk management process for critical third-party service providers, suppliers and vendors that includes due diligence in selection and periodic monitoring to ensure that they adhere to applicable cybersecurity standards.

companyName: CORNING INC /NY

ticker: GLW


text: We conduct annual disaster recovery training exercises for each primary data center where failover procedures are tested against defined Recovery Time Objectives (RTOs).

companyName: BGC Group, Inc.

ticker: BGC


text: We have established and maintains comprehensive business continuity plans that address potential impacts should the information or technology systems become compromised, and such plans are tested and evaluated on a regular basis.

companyName: VINEBROOK HOMES TRUST, INC.


text: We have implemented incident response and breach management processes. In the event of an incident, the Cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm, with support from external technical, legal and law enforcement support, as appropriate.

companyName: Toughbuilt Industries, Inc


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA"), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our former Chief Executive Officer and now a member of the Board of Directors, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.

companyName: CITIZENS, INC.

ticker: CIA


text: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC. In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.

companyName: CRA INTERNATIONAL, INC.

ticker: CRAI


text: We maintain a detailed Incident Response Plan which outlines the steps we would implement in the event of an actual or potential cybersecurity event. The Incident Response Plan includes timely notification of an escalation to the appropriate levels of management and Board of Directors. The Incident Response Plan is reviewed and updated at least annually and mandates coordination and collaboration across all levels of management and all areas of the Bank.

companyName: CB Financial Services, Inc.

ticker: CBFV


text: During the fiscal year ended, and as of, December 31, 2024, there were no risks from cybersecurity threats (including as a result of previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company (including its business strategy, results of operations, or financial condition).

companyName: UNITIL CORP

ticker: UTL


text: Cybersecurity risk is the risk of adverse impacts to the confidentiality, integrity, and availability of data owned, stored, or processed by the Bank or the accompanying information systems. The number and sophistication of attempts to disrupt or penetrate our systems and those of our suppliers continues to grow. These attempts are often referred to as hacking, cybersecurity fraud, cyberattacks, or other similar names.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Our Security Incident Response Plan includes third-party cybersecurity incidents and threats, as we do rely on third-party information systems and other technologies. As part of our vendor risk management process, we undertake due diligence of third-party systems with whom we interact, including risk profiling and classification, in addition to requiring data protection covenants in our vendor agreements. Our vendor risk management program includes regular reviews and oversight of service providers, including performance and technology reviews, and escalation of any unsatisfactory reviews.

companyName: Federal Home Loan Bank of Des Moines


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. Like many other businesses, we have experienced, and are continually subject to, cyberattacks. While these past cyberattacks have not materially affected us or, in our belief, are not reasonably likely to materially affect us, future cybersecurity incidents and threats may materially affect our business strategy, results of operations, or financial condition. For more information regarding our cybersecurity related risks, refer to our risk factors included in Part I, Item 1A of this Form 10-K.

companyName: Coursera, Inc.

ticker: COUR


text: As part of the nation's critical infrastructure network, we are subject to certain mandatory reliability standards, which include cybersecurity requirements. We have a formal compliance program to establish, monitor and maintain compliance that includes comprehensive cybersecurity elements designed to protect and preserve our critical information and energy infrastructure systems. We reference industry and government frameworks and best practices to continuously improve our cybersecurity program and we participate in industry groups and information sharing exchanges to understand emerging cybersecurity trends and threats.

companyName: OGLETHORPE POWER CORP


text: Our management team Xinyu Jiang and Weixuan Zhang are responsible for overseeing the development, implementation, and ongoing management of the Fund's Cybersecurity Policies and Procedures including the monitoring of our systems for potential cybersecurity events and the implementation of preventive and mitigative measures.

companyName: Dynamic Shares Trust


text: The Company's enterprise cybersecurity program focuses on vulnerability management, access management, and user awareness training. Among other things, the Company implements scheduled patching and system updates and proactively scans for vulnerabilities. We regularly engage qualified third-party experts to assess the Company's information technology infrastructure and identify vulnerabilities and opportunities for continued focus and improvement. The Company utilizes industry-standard technologies, processes, and capabilities designed to protect our systems and data and to detect potential suspicious activity. We provide cybersecurity training and user education on a regular basis for users with access to the Company's information technology systems. We conduct monthly social engineering tests to promote phishing awareness and security awareness. The Company monitors servers and endpoint devices across the organization to detect signs of a cyberattack. We maintain and practice a response and recovery plan to restore systems and data. We also maintain cyber liability insurance against cyber-attacks as part of our comprehensive insurance portfolio. Because we are aware of the risks related to third-party service providers, we have implemented processes to oversee, identify, and manage risks from cybersecurity threats associated with our most significant third-party service providers.

companyName: UNIFI INC

ticker: UFI


text: Cybersecurity is a crucial component of our enterprise risk management program. Like many companies, both we and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. We have invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Cybersecurity Risk Management and Strategy operations are managed by Blackstone Infrastructure Strategies Associates L.P. (the "General Partner") subject to certain oversight rights held by the Board of Directors. The General Partner has delegated BXINFRA's portfolio management function to Blackstone Infrastructure Advisors L.L.C. (the "Investment Manager"). The General Partner and the Investment Manager are individually and collectively referred to as the "Sponsor." Our executive officers are senior Blackstone professionals and our General Partner and Investment Manager are both subsidiaries of Blackstone. As such, we are reliant on Blackstone for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Blackstone has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Blackstone Infrastructure Strategies L.P.


text: As of and for the year ended December 31, 2023, there have been no cybersecurity incidents that have materially affected the Company's business strategy, results of operations, or financial condition.

companyName: US ENERGY CORP

ticker: USEG


text: We are adopting various tools and methodologies to manage cybersecurity risk that will be tested on a regular cadence. We are also in the process of monitoring and evaluating our cybersecurity posture and performance on an ongoing basis through scheduled vulnerability scans, penetration tests and threat intelligence feeds. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: NeuroMetrix, Inc.


text: In 2024, we did not identify any privacy or cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10 -K.

companyName: AvePoint, Inc.

ticker: AVPT


text: We maintain a cybersecurity program that is aligned with our business and focused on managing risks to our Company. As described below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into our overall risk management program and governance structure.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: Our cybersecurity risk management program, a critical component of our overall enterprise risk management program, is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, Center for Internet Security Controls, regulatory guidance, and other industry standards. These frameworks provide a risk-based model for organizations to identify and manage cyber risks inherent to their business model.

companyName: SIERRA BANCORP

ticker: BSRR


text: Through strategic oversight, advanced threat detection, and frequent improvement, we maintain a high level of protection for our systems and data.

companyName: Health In Tech, Inc.

ticker: HIT


text: The Executive Director of Security has 25 years of information technology and security experience. To enhance governance, the Executive Director of Security reports to the Senior Vice President and Chief Customer Officer, who has extensive experience overseeing cybersecurity and has had executive oversight of the security function for nine years at CMS Energy and Consumers. Prior to joining CMS Energy, this officer served as Vice President of Business Technology at Pacific Gas & Electric Company, a non-affiliated company. The Executive Director of Security is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the Executive Director's team. Cyber incidents are managed using the companies' standard process for critical events. In the event of such incidents, the Executive Director of Security communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: We have a dedicated team of information security professionals who leads our enterprise-wide cyber security strategy, risk management, cyber defense, software security, security monitoring and other related functions. This team is overseen by our Chief Information Security Officer ("CISO"), who reports to our Chief Technology Officer ("CTO"). The CISO has extensive background in that role at an enterprise level and has over 20 years of experience in the field of cybersecurity. Additionally, the processes overseen by our global information security team are integrated with our enterprise risk management program, including routine reporting on cyber risk through the different levels of the enterprise risk management governance structure and alignment on risk management frameworks and processes.

companyName: CDW Corp

ticker: CDW


text: The Company leverages the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework ("the NIST Framework") as the foundation of its global information security program. The NIST Framework provides standards, guidelines, and practices for organizations to better manage and reduce cybersecurity risk and is designed to foster risk and cybersecurity management communications amongst both internal and external organizational stakeholders. The Company's ISO works with independent, third-party consultants to assess the maturity of the Company's cybersecurity program within the NIST Framework and to develop strategic areas of focus for the Company's program commensurate with the Company's business objectives.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We use an internal management committee to run our information and technology team and our information and technology team includes our cybersecurity team lead who has served in various roles in information technology and information security for over 25 years, including at other public companies. Through ongoing communications with this management committee, senior management is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real-time and reports such threats and incidents to the Audit Committee, when appropriate. Management updates the Audit Committee quarterly with an overview of our cybersecurity threat risk management and strategy processes. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related topics and discuss any updates to our cybersecurity risk management and strategy programs. The Audit Committee is notified between such updates regarding significant new cybersecurity threats or incidents that meet pre-established reporting thresholds and any ongoing updates regarding any risk, as needed.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Farmer Mac's board of directors is actively involved in overseeing the company's cybersecurity risk management. At least once a year, the full board of directors meets with Farmer Mac's Chief Information Security Officer ("CISO") to discuss Farmer Mac's programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Farmer Mac's business strategy.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: One of the key responsibilities of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee, which provides oversight of our cybersecurity program as part of its periodic review of overall risk management program.

companyName: Moleculin Biotech, Inc.

ticker: MBRX


text: Like many companies, the Company relies on third-party vendor solutions to support its operations. Many of these vendors have access to sensitive and proprietary information. Third-party vendors continue to be a notable source of operational and informational risk. Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Company data.

companyName: BV Financial, Inc.

ticker: BVFL


text: Within this program, we integrate an analysis of the risks facing the organization to guide our preparedness against cybersecurity threats to ensure a holistic approach that encompasses cross-functional and geographical visibility under the oversight of executive leadership through regular risk management meetings.

companyName: Flux Power Holdings, Inc.

ticker: FLUX


text: As of the date of this report, we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on the Company, refer to Item 1A. Risk Factors - "We are exposed to cyber security attacks and data breaches and the risks and costs associated with protecting our systems and maintaining data integrity and security."

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: Our cybersecurity program leverages the NIST Cybersecurity Framework to help protect the Company's operations, information, production systems and networks from threats through cybersecurity practices, programs and tools that establish defenses in depth. The cybersecurity program includes, among other items, vulnerability and patch management, network and data segmentation, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations. The program has dedicated business resilience, insider threat and governance, risk and compliance (GRC) functions. Incident management is governed by our Incident Response Plan that assigns incident command and control parameters and escalation protocols to management and the Board of Directors. Our cybersecurity program also focuses on risks from the use of third-party services. Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.

companyName: VERISIGN INC/CA

ticker: VRSN


text: We believe our Information Technology Manager and Chief Operating Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program. The Information Technology Manager has 17 years of information technology experience across multiple industries before joining Nutex Health.

companyName: Nutex Health Inc.

ticker: NUTX


text: Our Product Security Team is responsible for the development of product security policies and standards for the Company, including supporting product security threat identification, supporting product security risk assessment, building and maintaining security policies, standards and guidelines, performing internal audits against the product security policies and standards, performing product security architecture analysis and reviews, raising product security awareness across the Company, monitoring product security through the product development lifecycle, and managing vulnerabilities (pre- and post-production). The Head of Product Security, who reports to our Head of Software, is accountable for the release or deployment approval of a product based upon the review of internal and external validation (functionality, performance, security) reports. Our Head of Software has more than 20 years of experience leading software teams, including over a decade in the cybersecurity industry. We assess our product security programs against the Open Worldwide Application Security Project (OWASP) Application Security Verification Standard (ASVS) and the Software Assurance Maturity Model (SAMM).

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have vendor management processes to manage cybersecurity risks associated with our use of certain providers. These processes may include reviewing vendors' written security programs and security assessments, conducting security assessment calls with vendor personnel, and imposing contractual obligations related to information security on certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Wayne Bank has adopted an Incident Response Policy (the "IR Policy") for responding to cybersecurity incidents. This IR Policy applies to both potential and actual incidents. The IR Policy should be invoked in any context where the Bank believes that an incident may have occurred. The IR Policy applies to all employees, contractors, and third parties. The objectives of the IR Policy are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.

companyName: NORWOOD FINANCIAL CORP

ticker: NWFL


text: Any changes or additions to our cybersecurity risk assessment program and related practices and procedures described above in response to cybersecurity needs are reviewed by our executive management, Board of Directors and Audit Committee.

companyName: Trane Technologies plc

ticker: TT


text: Our Chief Executive Officer and other members of our senior management, as appropriate, provide oversight and monitoring of these third parties, who provide regular reports to management. Management provides periodic reports to our Board as a whole, who are ultimately responsible for the oversight of risks from cybersecurity threats, which include updates on the Company's cyber risks, the status of projects to strengthen our information security systems, assessments of the information security program, the emerging threat landscape, and any recommendations for additional internal controls, systems, or insurance coverage for board approval.

companyName: Laird Superfood, Inc.

ticker: LSF


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • an information security incident response plan that includes procedures for responding to cybersecurity incidents; • an incident response team (the "Response Team") principally responsible for managing our response to cybersecurity incidents; and • a third-party risk management process for key IT vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: We have established an Incident Response Plan and a Security Operations Center to manage any cyber incident. We have retained a third-party incident response firm to support incident detection, management, and mitigation. We also maintain appropriate levels of cyber insurance. We implement processes to oversee and manage the risks associated with third-party service providers. We conduct security assessments of critical third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes ongoing assessments by our Information Security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Silk Road Medical Inc


text: As a shell company with no current business or operations, we do not have an established processes to oversee and identify material risks from cybersecurity threats nor any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats.

companyName: THEGLOBE COM INC

ticker: TGLO


text: Our board of directors, in coordination with our audit committee, oversees our enterprise risk management program, including cybersecurity risk management. On a regular basis, our audit committee discusses our cybersecurity risk management program with our Head of IT and other senior leaders. Our audit committee receives regular reports from our Head of IT on cybersecurity and information technology, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technology trends and information security considerations arising with respect to our peers and third parties. Our full board of directors receives reports from our audit committee on its cybersecurity risk management activities and updates from our management team on our cybersecurity risk management.

companyName: Maze Therapeutics, Inc.

ticker: MAZE


text: The Fund relies on the Investment Adviser's compliance and risk management program and processes, which include periodic review of the Investment Adviser's cybersecurity program.

companyName: John Hancock Comvest Private Income Fund


text: When a cybersecurity threat or incident is identified, the Cybersecurity and Risk Management Team will perform a technical investigation which typically consists of the following phases: i. Detection, which includes identifying the threat or incident, gathering all available facts surrounding the matter and performing an initial analysis to determine its level of severity. If the incident is classified as "Severity 1," the Materiality Committee, as defined below, is notified to further assess the matter.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: Our cybersecurity incident response and vulnerability management procedures are designed to escalate certain cybersecurity incidents to members of management depending on the impact of the incident, including the CFO, Data Privacy Officer, Company Legal department, and Executive Committee, who work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified.

companyName: DBV Technologies S.A.

ticker: DBVT


text: The Audit Committee oversees our cybersecurity risk and mitigation strategies. This committee is regularly briefed by management on the status and effectiveness of our cybersecurity initiatives, including policies and actions taken to monitor, identify, evaluate, mitigate, and report significant risks. The Audit Committee has specific training in overseeing cybersecurity risks, including a member who has earned Carnegie Mellon's CERT (Certificate in Cyber-Risk Oversight) and another with a certificate earned over cybersecurity risk. In addition, the Audit Committee receives periodic briefings from external experts in the area and regularly reports its oversight activities to the full board.

companyName: WD 40 CO

ticker: WDFC


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have undertaken, to conduct an annual assessment of our cyber risk management program and controls to identify, quantify, and categorize material cyber risks. In addition, we have developed a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO"), IT Risk Management team leader ("Head of IT Risk") or other members of the IT Risk Management function.

companyName: Enova International, Inc.

ticker: ENVA


text: Periodic review of SOC1 and SOC2 audit reports submitted by our strategic third-party technology suppliers, as prepared by their external auditors;

companyName: TopBuild Corp

ticker: BLD


text: Therefore, we will experience risk to potential vulnerabilities now and in the future but have built a program to recognize and respond to these vulnerabilities for the purposes of identification and remediation of those vulnerabilities and the impact they can have on our business. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks; reasonably address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards. We believe we have allocated adequate resources related to our cybersecurity risk management processes and have designated our Chief Executive Officer responsible with the responsibility of managing the cybersecurity risk assessment and mitigation process.

companyName: Enertopia Corp.

ticker: ENRT


text: We maintain policies over areas such as information security, incident management, business continuity, IT change and configuration management, acceptable use and access on/offboarding to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. We engage with these partners to monitor and maintain the performance and effectiveness of IT assets, data, and services that are deployed in our IT environment.

companyName: Banzai International, Inc.

ticker: BNZI