text: HMC Capital's cybersecurity program includes physical, administrative and technical safeguards, as well as plans and procedures designed to help prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us or our Advisor. HMC Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us or our Advisor, is integrated into HMC Capital's risk management program. In addition, HMC Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing, and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: Accordingly, we have long devoted significant resources to assessing, identifying, and managing risks associated with cybersecurity threats, including: in-house team dedicated to information and cybersecurity, responsible for conducting regular evaluations of our information systems, existing controls, vulnerabilities, and potential enhancements; tools for continuous monitoring capable of detecting and aiding in the response to cybersecurity threats in real-time;

companyName: Princeton Bancorp, Inc.

ticker: BPRN

secItem: Item 1C


text: Our IT Governance Team is comprised of senior Aardvark leadership, including our Chief Financial Officer, Vice President, Head of Product Management and Strategy and Vice President, Quality, as well as third party advisors. Our IT Governance Team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The experience of our IT Governance Team encompasses leadership, development, and support of cybersecurity strategies, along with the implementation of policies and procedures.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.

companyName: Archer Aviation Inc.

ticker: ACHR


text: On occasion, we engage other external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to Aquestive. We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate. We rely on the expertise of our risk management, legal, information technology, and compliance personnel, as well as our MSSP, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: The full Board attends one of the Audit and Risk Committee meetings at which information technology and cyber risk are discussed. Additionally, at least annually, the full Board attends a cybersecurity training from external experts and reviews and discusses our technology strategy with the Chief Information Officer and approves our technology strategic plan.

companyName: MATERION Corp

ticker: MTRN


text: Our cybersecurity risk management program includes written policies, standards, and procedures for maintaining data privacy, product security and information security to mitigate cybersecurity risks, and to identify, evaluate and respond to cybersecurity threats, vulnerabilities and incidents. Our cybersecurity risk management program and strategy is implemented across several areas, which include, but are not limited to, the following: • Information Security. We maintain a written information security program, which provides for policies, standards, guidelines, and administrative, technical and physical safeguards that we believe are reasonably designed, in light of the nature, size and complexity of our operations, to protect the resiliency of our operations and the confidentiality, integrity, and availability of our information systems, data, and information assets. The organizational, administrative and technical measures we implement are based on recognized security frameworks established by the National Institute of Standards and Technology, security measures aligned with the ISO/IEC 27000 series of standards, and other generally recognized industry standards. The program is assessed regularly and in light of new and emerging cybersecurity risks. • Technical Safeguards and Product Security. We deploy and maintain a variety of technologies to prevent and detect cybersecurity threats across the network, endpoint and cloud. We also apply security-by-design principles in our software development lifecycle, track vulnerabilities of open-source software, and run internal and external network scans at least weekly and after any meaningful change in our network configuration. We conduct regular application security assessments, including our assessments for internet-facing applications that collect, transmit, or display end user data. We also employ tooling in certain areas to help prevent deviations from policy. • Incident Response and Reporting. We maintain incident response and recovery protocols to enable prompt, effective and orderly identification, evaluation, management, and disposition of actual and potential security threats and incidents, including for purposes of escalation and internal and external-notification steps. We maintain a cross-functional incident response team, including senior representatives from information security, information technology, product, legal, privacy, communications and accounting, that is involved in assessing cybersecurity threats and incidents, assigning severity levels, and evaluating the potential impact, including the potential impact on our business strategy, results of operations and financial condition. This allows for prompt direction of appropriate personnel and resources for incident management and response, and internal notification to appropriate members of management, which may include our chief executive officer, chief product officer, chief information security officer, general counsel, chief financial officer, and/or chief accounting officer, and the security committee of our board of directors (the "Security Committee"). The protocols also establish steps designed to publicly report and/or alert external stakeholders as and when required by applicable law or otherwise determined appropriate.

companyName: Palo Alto Networks Inc

ticker: PANW


text: The CTO and VP, IT Data Security meet regularly with the Cybersecurity Committee to review the Company's management of information security risks, and the Cybersecurity Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CTO. In addition to scheduled meetings, the CTO, Cybersecurity Committee, and CEO maintain a regular dialogue regarding emerging or potential cybersecurity risks, which may include input from our third party vendors and other external sources. Together, they receive updates on significant developments in the cybersecurity domain from the CTO, as needed and quarterly. These updates, as well as other cybersecurity matters, are provided to the Company's Board by the CTO to support the Board's proactive and responsive oversight of cybersecurity related risks. The Board and executive management meet regularly to review cybersecurity risks and developments as part of our enterprise risk management framework.

companyName: IBEX Ltd

ticker: IBEX


text: Cybersecurity Risk Management and Strategy Charles River places high importance on identifying and mitigating potential cybersecurity threats to its employees, customers, IT infrastructure, proprietary technologies and confidential information.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: In addition, OFS Advisor's employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.

companyName: OFS Capital Corp

ticker: OFS


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third -party service providers, we perform third -party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third -party service providers provide us information about their security policies and procedures.

companyName: STANDEX INTERNATIONAL CORP/DE/

ticker: SXI


text: EOG focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates EOG's expectations of employees and contractors with respect to cybersecurity matters via EOG's Codes of Business Conduct and Ethics.

companyName: EOG RESOURCES INC

ticker: EOG


text: The Senior Director for IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for potential cybersecurity incidents, approving technical cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: At the management level, our information security organization is led by our CISO, who is responsible for cybersecurity risk management, with oversight by our Board of Directors. Our CISO has more than 20 years of experience in information security and IT risk management. He has specific experience in the following information security areas: security governance and policy, information security strategy and planning, penetration testing, vulnerability management, cybersecurity threat intelligence, incident response, third party risk management, cloud security, application security, identity and access management, data loss prevention, and security awareness.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function. While delegated to the Audit Committee, the Board directly oversees management's implementation of our cybersecurity risk management program.

companyName: Viant Technology Inc.

ticker: DSP


text: Our third-party cyber partners are a key component of our cybersecurity capabilities, and we partner with leading cybersecurity companies, leveraging third party technology and expertise. Through these partnerships, we provide continuous monitoring of our global cybersecurity environment and coordinate the investigation and remediation of alerts. Additionally, annual incident response drills are in place to prepare support teams in the event of a significant incident.

companyName: SUPERIOR ENERGY SERVICES INC


text: Our cybersecurity policies and practices, which are based on the Center for Information Security (CIS) Critical Security Controls, are governed by our information and cybersecurity governance program. The CIS Critical Security Controls are a set of 18 cybersecurity-related controls which aid companies in designing an effective control environment and are viewed as best practices by organizations worldwide. A significant number of our cybersecurity policies and practices associated with our electric utility operations are also subject to regulation by multiple governmental and other agencies.

companyName: Otter Tail Corp

ticker: OTTR


text: We have not experienced any cybersecurity incidents in the last two years, including as a result of the Cyber Incident, that have materially affected the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect our business strategy, results of operations or financial condition, see "Cyber-attacks or other information security incidents could have a material adverse effect on our business strategy, results of operations or financial condition and subject us to additional legal costs." in Item 1A. Risk Factors.

companyName: Distribution Solutions Group, Inc.

ticker: DSGR


text: The Audit Committee operates under a written charter adopted by the Company's board of directors. The Audit Committee oversees, among other things, a system of internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Audit Committee is also responsible for the adequacy and effectiveness of the Company's internal controls, including those internal controls that are designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Technical Safeguards. We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: PROS Holdings, Inc.


text: The Chemours Company The Audit Committee is central to the board of directors' oversight of cybersecurity and regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and the board of directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: Chemours Co

ticker: CC


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program, in conjunction with our CIO and Director of IT. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our information security team has substantial relevant experience in the areas of information security and cybersecurity risk management.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: Berkshire and its Business Groups rely on third-party service providers for a variety of products and services to run their information systems. This dependence exposes us, along with others who use these service providers, to the impact of a cyber-attack on their service providers. On occasion, a cyber-attack at a third party service provider could have a significant financial, operational or reputational impact to Berkshire. Berkshire and its Business Groups continuously monitor the risks associated with its service providers.

companyName: BERKSHIRE HATHAWAY INC

ticker: BRK-B


text: As discussed above, our Executive Director of IT reports to our CEO and informs the members of the Audit Committee and the full Board about cybersecurity threat risks, among other cybersecurity related matters. All executives attend cybersecurity training annually.

companyName: DURECT CORP


text: Our CSO has worked in the public and private sectors in information security since 1997 and has been a chief security officer since 2017. His technical and process certifications include CISSP, ITIL Foundation, Six Sigma Certified, CISCO CCNP, and CCNA. He oversees the implementation and compliance of our information security standards and mitigation of information security related risks.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: Our adherence to Defense Federal Acquisition Regulation Supplement (DFARS) and Cybersecurity Maturity Model Certification (CMMC) requirements ensures strict protection of Controlled Unclassified Information (CUI), mandated by the U.S. Department of Defense. These efforts underscore our commitment to maintaining the highest cybersecurity resilience standards and regulatory compliance.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: We regularly assess technological risks to our IT systems and information and monitor our IT systems for potential vulnerabilities and risks. We frequently conduct mandatory cybersecurity and IT systems awareness training for all employees with access to our systems. We also conduct regular reviews and tests of our IT cybersecurity processes, including reviews, assessments, and exercises.

companyName: UNITED STATES LIME & MINERALS INC

ticker: USLM


text: The Company has a Cyber Incident Response Team ("CIRT") of trained information technology professionals who are responsible for assessing, identifying, and managing our material risks from cybersecurity threats on an ongoing basis, all of whom have extensive background, experience, and education in information technology and computer science and are subject to training on industry-leading security platforms and tools as well as continuing education to maximize capabilities with the tools and technology of the Company. This team is overseen by the Vice President of Information Technology, who facilitates the regular cybersecurity updates to the Audit Committee. The Company also has a Cyber Security Materiality Assessment Committee ("CMAC") comprised of the Chief Financial Officer, General Counsel, and information technology and security representatives, which is responsible for assessment of material cybersecurity incidents and communicating such incidents to the Chief Executive Officer, Audit Committee, and the Board.

companyName: FOSTER L B CO

ticker: FSTR


text: The Board of Directors designated the Vice President Information Systems as the Information Security Office (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with the full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: The CISO and information technology security team conduct regular risk assessments to identify areas requiring additional investment and resources. These risk assessments extend to our supply chain, where cybersecurity health assessments are employed for our critical suppliers. The results are used to calculate a Cybersecurity Risk Score, a key component of our Supply Chain Scorecard used to proactively identify and manage potential risks. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, as appropriate. Risk assessments are also performed on new products and software and we periodically engage third-party services for penetration testing and security evaluations. We also periodically assess our technology infrastructure and business processes to identify and address potential security gaps and vulnerabilities. An ISO 27001 certification is maintained within our Energy Services business.

companyName: GENERAC HOLDINGS INC.

ticker: GNRC


text: Our risk management programs are developed, implemented, managed, and reviewed at the direction of Information Security and business segment leaders, with subsequent actions determined based on the results of these preventive and detective controls. We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Risk & Sustainability Committee is required. Depending on the assessed severity of the incident, the Risk & Sustainability Committee may be notified immediately or at its next regularly scheduled meeting.

companyName: CLARIVATE PLC

ticker: CLVT


text: Protecting our business information, intellectual property, customer and employee data, and technology systems is crucial for our business continuity, regulatory compliance, and stakeholder trust. We have implemented enterprise cybersecurity risk mitigation and governance processes, detailed in our Information Security Protection Program (Security Plan). Our strategy is guided by the Security Plan's principles, which involve monitoring threats and vulnerabilities, assessing and monitoring related controls, and supporting the Chief Information Security Officer (CISO). Our cybersecurity policies, standards, processes, and practices are integrated into our overall risk management system to enhance our ability to protect our operations and information. This includes annual cybersecurity reporting to the board of directors by senior leadership.

companyName: EGAIN Corp

ticker: EGAN


text: Following these risk assessments, we evaluate whether and how to re-design, implement, and maintain reasonable safeguards to minimize identified risks; evaluate how to reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Officer who reports to our Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: ESS Tech, Inc.

ticker: GWH


text: Reporting to the Chief Operating Officer, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills from over 16 years of relevant work experience at our company and elsewhere, leads our Information Technology team, which is responsible for developing and implementing our information security program across our business. The Information Technology team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator. It works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer leads the Cybersecurity Incident Management Team, a cross-functional team that comprises Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and receive reports of, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is also responsible for reporting on cybersecurity and information technology to the Audit Committee.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: During the years ended December 31, 2024 and December 31, 2023, the Company had no cybersecurity incidents that had a material adverse effects on its business, financial condition or results of operations. For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A. Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.

companyName: Carter Bankshares, Inc.

ticker: CARE


text: We use service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats. Such providers include but are not limited to legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed security service providers, and penetration testing firms.

companyName: Bolt Biotherapeutics, Inc.

ticker: BOLT


text: GIS oversees our cybersecurity program and is responsible for identifying, assessing, monitoring, managing and communicating our cybersecurity risks. GIS is led by our Chief Information Security Officer ("CISO") and is comprised of information security professionals with a variety of cybersecurity certifications and accreditations. GIS is aided by the Executive Risk Management Committee, which is comprised of senior leaders and subject matter experts throughout our company, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), who serve on the committee to assess and mitigate specific business unit risks, promote an understanding of potential issues, and provide risk resolution and prevention support. GIS and the Executive Risk Management Committee are responsible for keeping the Audit Committee apprised of developments with respect to our cybersecurity strategy and risks.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: We have established a Cybersecurity Steering Committee comprised of key leaders across the Company whose responsibilities include oversight of cybersecurity incident materiality, security, governance, and reporting functions. The objective of the Cybersecurity Steering Committee is to set policies and standards for the Company in relation to information security and cyber events, including the Company's response protocols and disclosure requirements upon occurrence of any cyber event that is considered material to the Company.

companyName: JBT MAREL Corp

ticker: JBTM


text: In the last three fiscal years, OFG has not experienced any material cybersecurity incidents, and expenses incurred from any cybersecurity incidents were immaterial. For more information on the risks to the Company of future cybersecurity threats or incidents, see "Item 1A, Risk Factors — Operations and Business Risks."

companyName: OFG BANCORP

ticker: OFG


text: Kronos and CompX each have their own cybersecurity programs. Our corporate cybersecurity program is led by the chief information officer (CIO) of Contran who provides services to us under the ISA, and who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our corporate information systems are owned and operated by Contran and provided to us through the ISA. The Contran CIO, who also serves as the Kronos CIO, reports to the chief executive officer of Contran and Kronos, respectively. CompX's cybersecurity program is led by the director of information technology (IT). The director of IT reports to CompX's vice president in charge of coordinating operational activities within CompX's two operating business segments. Both the Contran CIO and the director of IT have extensive information technology and program management experience and lead teams that have many years of experience with each organization. Cybersecurity risks at each company are also reviewed and tested annually through third-party assessments and internal and external information technology audits. Our, Kronos' and CompX's information technology teams review enterprise risk management level cybersecurity risks annually.

companyName: NL INDUSTRIES INC

ticker: NL


text: The CDO provides the Board with ongoing security updates, which include notable changes to program plans, changes to the risk environment, information regarding material incidents that may have occurred, reports on recent assessments of our security controls, and details regarding forward-looking plans and strategies to mitigate cyber risk. The Company has been subject to cybersecurity threats in the past. As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: MARINEMAX INC

ticker: HZO


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company's business strategy, results of operations or financial condition. Please refer to "Risk Factors— Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our or our third-party service providers' information technology systems could compromise sensitive information related to our business or prevent us from accessing critical information and subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline." under Item 1A. of this Form 10-K for additional description of cybersecurity risks and potential related impacts on our Company.

companyName: Bausch Health Companies Inc.

ticker: BHC


text: In addition, CapForce will be maintaining policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. CapForce partners with industry recognized IT providers, leveraging third-party technology and expertise. These third-party service providers are a key part of CapForce's current cybersecurity risk management and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols and critical data backups. Our outsourced information technology consultants conduct proactive patching and monitoring of all of our existing systems and have implemented systems and procedures to mitigate cybersecurity risks that we believe are appropriate for a company of our size, stage of growth and financial condition. In addition, we carry insurance with coverage for cyber events that we believe is suitable for a company of our size, stage of growth and financial condition.

companyName: CapForce Inc.

ticker: OPGN


text: Our processes call for the evaluation of third parties for security and compliance risks before onboarding them for potential use within our own systems and services. For applicable vendors, we require audit reports and regular responses to our detailed security questionnaires particularly for vendors associated with critical assets. In addition, our procurement processes call for specific contractual obligations from relevant vendors regarding their maintenance of appropriate cybersecurity controls and relevant certifications. Our internal Software Development Lifecycle is designed to build our products in part relying upon industry-standard practices and third-party tools and services to test our code and bundled third-party libraries for known security misconfigurations and errors. Our people are a crucial pillar of our cybersecurity.

companyName: Informatica Inc.

ticker: INFA


text: We anticipate that our Board, in coordination with the Audit Committee, will oversee the Company's enterprise risks arising from cybersecurity threats and will periodically review the measures we have implemented to identify and mitigate data protection and cybersecurity risks.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Regular Evaluation of Initiatives, Results and Priorities. The IT Security Team, in consultation with the Council and other members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments, and further developments in the cybersecurity threat landscape. In addition, we periodically engage a third-party provider to conduct an external assessment of our security program. The results of this assessment, which are reported to the Audit and Finance Committee (and the Board, as appropriate), assist us in determining whether any further changes to our existing policies and practices are warranted.

companyName: EASTMAN KODAK CO

ticker: KODK


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity software providers and managed cybersecurity service providers.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: While the Company is working to adopt the National Institute of Standards and Technology ("NIST") cybersecurity framework, the Company's on-going investment in information systems and utilization of external 3rd parties represents the best means for extensively testing both the design and operational effectiveness of cybersecurity controls, and to ensure continuity and functionality of the Company's operating systems.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: We have had one cybersecurity incident in the last decade. A company-issued computer was reported stolen from an employee's residence. This incident represented a potential cybersecurity threat, as the device contained sensitive company information, including access credentials, confidential data, and proprietary software. The threat was quickly identified and isolated before significant damage could be done. This incident did not affect business operations and did not have a financial impact on our company. Our cybersecurity experts promptly locked the device, changed all relevant passwords and access credentials, initiated a remote wipe, and notified relevant teams and law enforcement, everything according to its info security plan. No proprietary information was lost.

companyName: USBC, Inc.

ticker: USBC


text: We identify and assess material risks from cybersecurity threats to our information systems and the information residing in our information systems by monitoring and evaluating our threat environment on an ongoing basis using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and conducting risk assessments.

companyName: Triller Group Inc.

ticker: ILLR


text: The Audit Committee of our Board of Directors is responsible for oversight of risks from cybersecurity threats. At a management level, our cybersecurity risk management program is led by our Chief Technology and Innovation Officer who has over 20 years of experience providing business and information technology, or IT, process consulting and regulatory compliance services, including founding a cyber-security consulting and regulatory compliance firm and serving as Sarbanes-Oxley subject matter specialist for an international public accounting firm, and whose certifications include Certified Public Accountant and Certified Information Systems Auditor. Partnering with our Chief Technology and Innovation Officer is our Vice President Cyber Security, who has over 30 years of IT technical and IT business process experience and has been an IT and cyber security leader for multiple financial services companies. Collectively, our cybersecurity team consists of 5 professionals with an average cybersecurity tenure of 15 years and various relevant certifications. Members of our cybersecurity team deliver regular updates to our Chief Technology and Innovation Officer and Chief Administrative Officer and General Counsel.

companyName: Mid-America Apartments, L.P.


text: We have incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. In addition, several separate putative class actions have been filed in U.S. federal and state court by current and/or former employees alleging violations of privacy and other rights in connection with the ransomware incident.

companyName: YUM BRANDS INC

ticker: YUM


text: While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization. Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and Payment Card Industry Data Security Standard.

companyName: Murphy USA Inc.

ticker: MUSA


text: The Audit Committee of our Board provides direct oversight over cybersecurity risk and provides updates to the Board regarding such oversight on a periodic basis. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents. The Audit Committee also notifies the Board of any cybersecurity incidents (suspected or actual) and provides updates on the incidents as well as cybersecurity risk mitigation activities as appropriate.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: Our cybersecurity program is overseen by our Vice President of IT & Digitization, who has over 14 years of experience working in various information technology roles and has managed and evolved the cybersecurity function at CTS for the past three years. Our Vice President of IT & Digitization is supported by a team of enterprise information system and security risk professionals (collectively, the "IT Team"), who are responsible for identifying, assessing, monitoring, managing and communicating the Company's cybersecurity risks. The IT Team includes a cybersecurity leader with over 30 years of experience in IT infrastructure, IT operations and cybersecurity, and members who hold Certified Information Systems Security Professional (CISSP) and Certified Information System Auditor (CISA) certifications and have experience developing and implementing enterprise-wide cybersecurity strategies and initiatives, managing risks relating thereto, and evaluating industry standards and regulations.

companyName: CTS CORP

ticker: CTS


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program, in conjunction with our enterprise risk management assessment processes, address cybersecurity risks to the corporate information technology, or IT, environment including systems, hardware, software, data, people and processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our cybersecurity program leverages several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization Information Security Management Systems ("ISO 27001"), and the Center for Internet Security Critical Security Controls. Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls. It is a mutually supporting environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.

companyName: KORN FERRY

ticker: KFY


text: Allegion plc recognizes the significance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity, and availability of our data.

companyName: Allegion plc

ticker: ALLE


text: Role of our Board of Directors Our Board of Directors has primary responsibility for the oversight of our enterprise-wide risk management and exercises its oversight function in respect of cybersecurity risk through two of its committees. Specifically, our Board Audit and Compliance Committee has oversight responsibility for the Company's enterprise risk management process, including the Company's programs to identify, manage, respond to and mitigate the Company's IT risks, including risks related to cybersecurity, artificial intelligence, privacy, critical infrastructure assets and disaster recovery, as well as identifying the potential likelihood, frequency and severity of cyberattacks and breaches. Our Board Quality Committee has oversight responsibility for overall data and technology strategy. Each committee reports to the full Board on a regular basis.

companyName: CENTENE CORP

ticker: CNC


text: Our IT Infrastructure & Operations team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging managed security service providers and other third-party security software and technology services. In addition, we institute processes and technologies for the monitoring of security alerts from internal parties and external resources, including from information security research sources. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.

companyName: REPLIGEN CORP

ticker: RGEN


text: If indications are reported of an actual or threatened incident affecting our information systems or networks, or affecting a third party provider relevant to our security, we commence our incident response processes led by the Global Security Organization. This comprehensive incident response process is designed to address possible and confirmed cybersecurity incidents and enable escalations and notifications to appropriate management and members of the audit committee.

companyName: Informatica Inc.


text: Our board of directors, with delegation to the audit committee, as appropriate, retains oversight of the Company's cybersecurity risks. The senior leadership team provides periodic reports to our board of directors, as well as the Chief Executive Officer and audit committee as necessary. In addition, we have contracted with certified security experts that act as an extension of the internal information technology team for all security related items. These communications include potential risks facing the Company, assessments and evaluations of our cybersecurity environment, results of internal controls testing, and reports on our on-going initiatives to strengthen our cybersecurity framework.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: While the Board and the committees oversee our risk management, our CEO and other members of senior management (including the Risk Management Committee) are primarily responsible for day-to-day risk management analysis and mitigation and report to the full Board or the relevant committee regarding risk management. We believe this division of responsibility is the most effective approach for addressing our risk management.

companyName: Anywhere Real Estate Group LLC


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis and provide dashboards or reports, which summarize cybersecurity risks and action plans. The committees elevate matters to the Board as appropriate.

companyName: CUMMINS INC

ticker: CMI


text: Our internal information security team oversees and works collaboratively with various information security service providers. Our cybersecurity program and practices are supported through the use of third-party service providers to assist in the identification, assessment and management of risks specific to cybersecurity threats, including vendors providing threat intelligence, risk mitigation, dark web monitoring, external scanning and scoring, threat and reputation monitoring, forensics, cyber insurance, advisory services and legal counsel. We use a managed security service provider to augment our internal information security team and to provide additional monitoring capabilities.

companyName: LEAR CORP

ticker: LEA


text: Risks from Cybersecurity Threats Like other companies in our industry, we face several cybersecurity risks in connection with our business. Although such risks have not materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems, including denial of service and phishing attacks.

companyName: AppTech Payments Corp.

ticker: APCX


text: BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry standards, including the National Institute of Standards and Technology Cybersecurity Framework, and are enforced through the firm's preventive and detective controls.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, aimed at protecting personal and confidential information, are in effect across all businesses and geographic locations. Board-approved policies are in place to effectively mitigate risks linked to third-party service providers, encompassing factors such as availability, confidentiality, and governance and compliance. As part of this risk mitigation, the Company actively monitors vendors' cybersecurity practices through periodic assessments and contractual security requirements. This ensures that vendors adhere to our security standards and promptly address emerging threats or vulnerabilities.

companyName: Merchants Bancorp

ticker: MBIN


text: We maintain Information Systems Incident Management Standards applicable to all our businesses that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our disclosure controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.

companyName: TEXTRON INC

ticker: TXT


text: In addition, we have established a Cyber Risk Executive Steering Committee, a multi-disciplinary management-level team chaired by our CISO which is responsible for assessing and overseeing our information security and cybersecurity risk management policies, practices and priorities and for assessing and monitoring key cybersecurity risks with respect to reporting such risks within the organization.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents, is managed by our Director, IT, who has worked in information technology and communications services for over 25 years. Our cybersecurity program incorporates an incident response plan to engage cross-functionally across the Company and report cybersecurity incidents to appropriate levels of management, including senior management and the Audit Committee or Board of Directors, based on potential impact. Because of the relatively small size of our information technology workforce, we have limited internal cybersecurity expertise and monitoring capabilities; accordingly, we seek to augment our internal capabilities by engaging larger, well-known third-party service providers with significantly greater cybersecurity capabilities than we possess to monitor cybersecurity events and provide rapid responses to any critical events, including with respect to Managed Detection and Response (MDR) and Endpoint Detection & Response (EDR). Because we rely on their more significant expertise, our ability to identify and remediate weaknesses or vulnerabilities is limited to their services. We have engaged with third parties to assess our cybersecurity defenses biweekly and audit our cybersecurity program. We also conduct annual penetration tests of our information systems via independent third-party cybersecurity experts to evaluate our systems and provide remediation and recommendations to improve our cybersecurity program. We also conduct annual cybersecurity awareness training. We aim to incorporate industry best practices throughout our cybersecurity processes, and our cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework. We are compliant with DFARS 252.204-7012 and DFARS 252.204-7020 and have a compliant NIST SP 800-171 self-assessment status.

companyName: EMCORE CORP


text: In such sessions, our audit committee generally receives materials that include a cybersecurity dashboard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CIO. Our CIO works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors for certain cybersecurity incidents.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: Surmodics has adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework as the basis for our approach to assessing, identifying, and managing material risks from cybersecurity threats. Using a nationally recognized vendor partner, we conduct yearly cybersecurity assessments (including policy and procedures) and penetration testing based on the NIST Cybersecurity Framework and principles. From the assessment results, we create a roadmap and prioritize it to address any noted deficiencies with our identification, protection, detection, response and recovery functions. This roadmap is used as a basis for our yearly cybersecurity planning initiatives to continually improve our systems, tools, architecture, training campaigns, monitoring and policies.

companyName: SURMODICS INC

ticker: SRDX


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports on cybersecurity risks to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.

companyName: C4 Therapeutics, Inc.

ticker: CCCC


text: We collaborate with third parties to assess the effectiveness of our cybersecurity incident prevention and response systems and processes as our SOT deems necessary or appropriate. These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity threats and risks, as well as to support associated mitigation plans when necessary. Our SOC Type 2 audit, completed in September 2023, attests to the effectiveness of our security and risk management controls. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities critical to our ongoing business operations, including those that perform cybersecurity services.

companyName: QXO, Inc.

ticker: QXO


text: Cybersecurity risk management is integrated into the Company's broader enterprise risk management ("ERM") program. The ERM program, led by the Company's Internal Audit and Legal teams, consolidates the collective input of executive management to prioritize enterprise-level risks, develop risk mitigation initiatives and establish monitoring functions. The cybersecurity program includes the development of a structured control framework and risk taxonomy that aligns with anticipated business risk. The Internal Audit and Legal teams perform an enterprise risk assessment annually and present the results to the Audit Committee of the Board of Directors. Further, our Chief Technology Officer ("CTO") actively participates in the ERM program, including through diligence conducted as part of the broader ERM program.

companyName: GoHealth, Inc.

ticker: GOCO


text: We strive to align with the National Institute of Standards and Technology (NIST) cybersecurity maturity framework and leverage a range of tools, including artificial intelligence, software programs, logs, and data analyses, to detect anomalous activity and identify risks across our systems. Threat simulations, such as penetration testing, are conducted periodically to assess vulnerabilities, analyze results, and implement remediations. Additionally, we employ third-party services for monitoring risks posed by cyber-attackers, employees, and third-party vendors accessing or contributing to our systems. Our oversight of such vendors includes requiring them to undergo cybersecurity analyses through risk assessments, scorecards, and audits.

companyName: WERNER ENTERPRISES INC

ticker: WERN


text: The Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. Our cybersecurity program is led by the company's senior vice president, chief information officer, along with our vice president, chief information security officer (CISO). Management provides an operational update to the Audit Committee each quarter. In addition, the Audit Committee and our full Board of Directors receive an annual overview of the cybersecurity program, cybersecurity threat landscape, investments, and opportunities to enhance the company's systems and security of products and operations.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: Board Oversight of Cybersecurity Risk Management and Governance Our Board is responsible for general oversight of our risk environment and associated management policies and practices and has delegated to its Audit Committee the responsibility for oversight of our certain major risk categories and exposures, including with respect to cybersecurity and management's processes to monitor and control them. The Audit Committee meets regularly throughout the year and, on no less than a quarterly basis, receives and reviews a report from management, including the Company's General Counsel, regarding the Company's IT, cybersecurity, data security, and physical security risk, including any suspected material or immaterial cybersecurity incidents during the preceding quarter, if any, and discusses such matters with appropriate management and other personnel. In addition, on a semi-annual basis, the Audit Committee receives a report from the Company's primary third-party information technology and cybersecurity regarding the Company's IT environment, overall cybersecurity risk management program and strategy and education regarding emerging trends and threats.

companyName: CervoMed Inc.

ticker: CRVO


text: The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee"). These committees meet quarterly, and their activities are reported to the full Board of Directors.

companyName: RENASANT CORP

ticker: RNST


text: Alcoa's CISO has thirty years of experience in information technology, including over fifteen years in cybersecurity, and prior to joining Alcoa, was the CISO of the U.S. business of a large global insurance and asset company and was responsible for the security of data, systems, and processes supporting customer assets. Alcoa's CISO maintains professional certifications in information security, participates in intelligence sharing organizations, and has extensive cybersecurity risk management experience in manufacturing organizations and reports to the CIO. Alcoa's CIO has almost thirty years of information technology experience, including a diverse knowledge in manufacturing and process control solutions, corporate applications, infrastructure, and service delivery operations. The CISO closely collaborates with the CIO and Chief Financial Officer (CFO) in managing material risks from cybersecurity threats. Alcoa also maintains an information security steering committee (ISSC), which oversees current and emerging cybersecurity risks and investments in the cybersecurity risk protections for the Company. The steering committee is comprised of a cross-functional team of leaders from across Alcoa's business groups, including the CISO (the ISSC Chair) and CIO.

companyName: Alcoa Corp

ticker: AA


text: a team comprised of IT personnel responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents;

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: Although the Company has put in place the cybersecurity policies, procedures and processes described above, the Company remains exposed to cybersecurity attacks and incidents and misuse or manipulation of any of its IT systems, which could have a material adverse effect on its business strategy, results of operations or financial condition. As of the filing of this Form 10-K, we are not aware of any attacks, incidents, misuse or manipulation that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations or financial condition. For risks associated with cybersecurity threats, see the risk factor "Interruption of, damage to or compromise of the Company's information technology (IT) systems, failure to maintain the integrity of customer, colleague or Company data or illegal or fraudulent activities committed against the Company could harm the Company's reputation and have an adverse effect on the Company's business, financial position, results of operations and cash flows." included in "Part I—Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: STEPAN CO

ticker: SCL


text: Union's ISO is responsible for implementing and maintaining the cybersecurity program with support from Union's Information Security team. The Information Security team consists of Union's ISO, members of the risk and compliance department, security staff, and information technology members, all of whom collaboratively work together to manage cybersecurity risks. The ISO reports directly to Union's Senior Risk Officer.

companyName: UNION BANKSHARES INC

ticker: UNB


text: The board of directors of the Company ("Board") provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the Chief Compliance Officer ("CCO") of the Company, who also serves as Chief Compliance Officer of the Investment Adviser, regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and briefing on material risks from cybersecurity threats and material cybersecurity incidents impacting the Company.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: While exact practices vary depending on each operating subsidiary's particular business and risk, risk assessments performed at the enterprise and subsidiary levels generally incorporate threat and vulnerability analyses and consider mitigations provided by in-place security controls. These procedures are intended to identify and assess internal and external cybersecurity risks that may threaten the security or integrity of nonpublic information stored on the Company's information systems by use of defensive infrastructure and the implementation of policies and procedures to protect the Company's information systems from unauthorized access, use or other malicious acts.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: We have established comprehensive processes to assess, identify, and manage material risks from cybersecurity threats. These processes include continuous evaluation of potential threats, regular security assessments of third-party service providers, and stringent monitoring procedures to mitigate risks related to data breaches and other security incidents. We periodically engage third-party consultants, legal advisors, and audit firms to evaluate and assess our risk management systems and to assist in the remediation of potential cybersecurity incidents, as necessary.

companyName: Outdoor Holding Co

ticker: POWW


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, the Franklin Templeton incident response team is responsible for deciding on a containment strategy to respond to the cybersecurity incident consistent with the procedures in the incident response plan.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Shake Shack Inc.

ticker: SHAK


text: Our Cybersecurity Steering Committee, which includes the CISO and several members of management, is responsible for the daily operational oversight of our cybersecurity program. The CISO has over 20 years of experience in cybersecurity. Members of this committee include our General Counsel, Chief Financial Officer and the Senior Director of Internal Audit and Risk Management, all of whom have significant experience in managing enterprise risk, including risk from cybersecurity threats. The Cybersecurity Steering Committee meets routinely to discuss the status of the cybersecurity program, the status of responses to cybersecurity incidents or threats, any updates on certification programs and any emerging cybersecurity threats. Information received by management through the Cybersecurity Steering Committee is regularly included in the quarterly updates to the Audit Committee.

companyName: ANSYS INC


text: Our Board oversees the Company's risk management process, including on cybersecurity risks, directly and through committees to which the Board has delegated authority. In connection with Brookfield Reinsurance's acquisition of the Company, the Company's Audit Committee was dissolved and all authority previously granted to the Company's Audit Committee was delegated to the Audit Committee of Brookfield Reinsurance. The Brookfield Reinsurance Audit Committee is responsible for overseeing our internal controls, including cybersecurity and data protection programs, and reviews the effectiveness of our financial reporting processes and internal controls, including data privacy, information technology security and control. Meetings of the Brookfield Reinsurance Audit Committee often include discussions of specific risk areas, including, among others, those relating to cybersecurity. The Brookfield Reinsurance Audit Committee also frequently discusses, in accordance with its duties and responsibilities as enumerated in its committee charter, the policies, guidelines and process by which management assesses and manages risks related to data protection and cybersecurity, including assessments of the overall threat landscape, steps management has taken to monitor or mitigate its risk exposure and related strategies and investments. Our Chief Security Officer regularly reports on data protection and information technology security matters to the Brookfield Reinsurance Audit Committee and to Argo senior management via Security Governance Council meetings.

companyName: Argo Group International Holdings, Inc.


text: Incident Response Protocols: We maintain a formal cybersecurity incident response plan that ensures a structured and comprehensive response to security incidents. This plan involves senior executives, external legal and forensic incident response retainer with our third-party Security Operations Center (SOC).

companyName: Korth Direct Mortgage Inc.


text: We rely on third-party service providers for a variety of services to run our information systems. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. A cyber-attack at a third-party service provider could have a significant impact on our business, and we continuously monitor the risks associated with our service providers.

companyName: CXJ GROUP CO., Ltd

ticker: ECXJ


text: We recognize the critical importance of maintaining the trust and confidence of customers, suppliers, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board of Directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. Our customers' requirements for their suppliers to have certain cybersecurity policies, standards and processes in place also drives and guides some of our policies and practices. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Cybersecurity risk management is integrated into our broader Enterprise Risk Management ("ERM") framework. FactSet's ERM program is designed to identify, prioritize, and assess the most significant risks that could impact our ability to achieve our strategic business objectives. ERM activities include conducting enterprise risk assessments to better understand risk exposures, emerging risks, and steps that management has taken to monitor and control such exposures. Our information security leadership team, in concert with our ERM team, reviews our oversight of cybersecurity risks at least annually through our enterprise risk assessment process.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: TIAA, on behalf of the Account, has a program and formal processes in place to assess, identify, and manage material risks from cybersecurity threats. The Account's business is dependent on the communications and information technology ("IT") systems of TIAA and other third-party IT service providers to TIAA. TIAA, with support from certain of its subsidiaries, manages the Account's day-to-day operations and has implemented a cybersecurity program that applies to the Account.

companyName: TIAA REAL ESTATE ACCOUNT


text: Our Chief Compliance Officer and Information Security Team are responsible for the development and implementation of policies and technical measures to reasonably prevent security incidents. At times we may also engage assessors, consultants, auditors or other third parties to assist with assessing, identifying and managing cybersecurity risk. As part of our risk management process, we conduct assessment and penetration testing, including regular trainings completed by employees of Stellus Capital Management who provide services to us pursuant to the Administration Agreement.

companyName: Stellus Capital Investment Corp

ticker: SCM


text: Commvault maintains a variety of third-party certifications and undergoes annual assessments for SOC 2 Type 2, ISO 27001, HIPAA, CJIS, and PCI DSS. In support of these certifications and assessments, our products also undergo security testing. Annually, internal auditors complete a risk assessment of specific business operations, such as privacy and sanctions compliance and travel and expense policy compliance, identify areas of heightened risk, and conduct dedicated audit engagements. The findings, observations, and recommendations from these engagements are shared with Management, including the CEO, CFO, Chief Trust Officer, CSO, Chief Information Officer ("CIO"), and Senior Vice President of Engineering and the Audit Committee, as appropriate.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: • Physical Security—We also maintain physical security measures to protect our OT systems, consistent with a defense in-depth and risk-tiered approach. Physical security measures may include access control systems, video surveillance, around-the-clock command center monitoring, and physical barriers (such as fencing, walls, and bollards). Additional features of PSEG's physical security program include threat intelligence, insider threat mitigation, background checks, a threat level advisory system, a business interruption management model, and active coordination with federal, state, and local law enforcement officials. See Item 1. Business. Regulatory Issues—Federal Regulation for a discussion of Critical Infrastructure Protection standards that the NERC promulgated that mitigate risk associated with both cybersecurity and physical security of PSEG's critical facilities.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: With respect to cybersecurity, the Company and the Adviser rely on the systems of Lord Abbett, its third-party service providers, and the Company's service providers.

companyName: Lord Abbett Private Credit Fund


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Danaher, including our business strategy, results of operations or financial condition.

companyName: DANAHER CORP /DE/

ticker: DHR


text: Our processes also address oversight and identification of cybersecurity risks from our use of third-party service providers. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.

companyName: GREEN DOT CORP

ticker: GDOT


text: Our cybersecurity function, which comprises, in part, our Interim Chief Financial Officer and third-party service providers (including our managed security services provider, or MSSP), helps identify, assess and manage our cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting threat assessments for internal and external threats (including third party threat assessments), using external intelligence feeds, coordinating with law enforcement regarding certain threats, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures and processes designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, network security controls, systems monitoring, and asset management, tracking, and disposal.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Senior management, including our Bitcoin Depot's Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel are responsible for implementing these security measures, as well as being involved in all aspects of cybersecurity incident response and data breach management processes. Bitcoin Depot's incident management plan provides a roadmap for responding to and categorizing incidents. Bitcoin Depot's IT and cybersecurity teams collaborate with other company stakeholders to develop strategies for mitigating and responding to identified cybersecurity events.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: Cybersecurity and the continued enhancement of Arrow's controls and processes to protect its systems, data and networks from cybersecurity incidents remain a priority to Arrow.

companyName: ARROW FINANCIAL CORP

ticker: AROW


text: Our CISO and other members of senior management responsible for our information security program have extensive experience assessing and managing risks from cybersecurity threats, including decades of experience in information technology and information security positions; serving in information technology leadership positions at other large public companies; and having other significant experience in the areas of risk management, information technology, and information security. Our CISO has more than 26 years of experience in information technology and/or information security, including more than 12 years in such positions in the hospitality industry.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: We engage external assessors, auditors and other third parties to independently evaluate our cybersecurity risk management process and related controls, including the relevance to PMI of identified cybersecurity scenarios and the results of cybersecurity maturity assessments. The outcome of such evaluations, audits or reviews are reported to the Corporate Risk Governance Committee and to the Audit & Risk Committee, and our cybersecurity policies, standards and processes are adjusted, as necessary.

companyName: Philip Morris International Inc.

ticker: PM


text: Our Board is actively involved in the assessment, oversight and management of the material risks that could affect the Company. The Board has delegated to the Audit Committee the responsibility to oversee the integrity of the Company's information technology and cybersecurity risks and to assess the risks and incidents relating to cybersecurity threats. While our Board and Audit Committee oversee cybersecurity risk, management, through the AIMC, is responsible for the implementation and management of cybersecurity risk management systems and processes and for the communication of incidents to senior management and the Audit Committee.

companyName: Annovis Bio, Inc.

ticker: ANVS


text: We proactively address cybersecurity risk through a comprehensive cybersecurity program to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. We use a multi-faceted approach including, but not limited to, third-party assessments, internal cybersecurity audits, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things, require mandatory third-party cybersecurity training and testing for all employees, perform periodic user access reviews across the organization, perform penetration testing using external third-party tools and techniques to test security controls, employ multifactor authentication and biometrics login tools, take steps to verify whether vendors have appropriate cybersecurity programs, and conduct frequent security assessments to identify and remedy vulnerabilities.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges.

companyName: Altair Engineering Inc.


text: The Company has adopted a risk-based strategy designed to achieve a targeted and cost-effective approach to managing cybersecurity risks that strengthens our abilities to prevent, detect, and respond to cyber-attacks, breaches, or threats. The Company has configured its IT environment, where possible, to restrict access using a least privileged methodology. We use various technologies and monitoring capabilities to detect anomalies and track information and assets. We have implemented a cybersecurity awareness program consisting of frequent training, phishing exercises, and bulletins regarding pertinent cybersecurity developments. We maintain and regularly update incident response, disaster recovery and business continuity plans and procedures. Our IT specialists subscribe to threat intelligence feeds and are members of cybersecurity-related associations such as the Information Systems Audit and Control Association, the Computing Technology Industry Association and the Cloud Security Alliance. We also retain independent experts to assess our cybersecurity programs and the potential vulnerabilities of our IT systems to unauthorized access and other intrusions. We also maintain insurance coverage for cyber and data security risks of an amount and subject to conditions and exceptions that we believe are customary for companies like ours, but there can be no assurance that our levels of coverage are adequate or that we will be able to continue to maintain our existing insurance or obtain comparable insurance at a reasonable cost.

companyName: Sotera Health Co

ticker: SHC


text: Management's Role in Cybersecurity Risk Management Given the important role of technology in the Company's operations and customer service, the Company has established an Information Technology Steering Committee, which consists of our IT Manager, President and Chief Risk Officer, Chief Operations Officer, Chief Financial Officer, Mortgage Systems Administrator and Enterprise Risk Manager. The Information Technology Steering Committee reviews, monitors, aligns, and prioritizes all significant strategic information technology initiatives and security risks. The Information Technology Steering Committee reports to the Audit Committee and minutes of the committee's meetings are subsequently reported by the Audit Committee to the Company's Board of Directors. Our IT Manager, in collaboration with our Enterprise Risk Manager make monthly/quarterly reports to the Information Technology Steering Committee. Such reports include updates related to key metrics, key risk indicators, key performance indicators, penetration test results, risk assessment results, project updates, incident reports, compliance matters, and operational issues.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: We operate through our subsidiaries and receive services through our intercorporate services agreement (ISA) with Contran (see Note 17 to our Consolidated Financial Statements). We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility and availability of company data stored, processed or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: VALHI INC /DE/

ticker: VHI


text: Our Information Security Program is also designed to help oversee, identify, and mitigate cybersecurity risks associated with our use of third-party service providers. Following an initial assessment of the level of enterprise risk potentially posed by use of the third party, the service provider is then subject to further risk-based assessments on its operational resilience and cybersecurity practices, including disaster recovery and business continuity plans that specify the time frame to resume activities and recover data. In its agreements with third-party service providers, Truist requires service providers to adhere to Truist's relevant cybersecurity and operational resilience standards, subject to certain exceptions that are managed on a case-by-case basis.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: Our Board of Directors is actively involved in overseeing cybersecurity risk management. At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Dropbox's business strategy. Additionally, our audit committee oversees programs and policies related to cybersecurity risks and initiatives. Our audit committee is comprised entirely of independent directors who evaluate these issues at least quarterly.

companyName: DROPBOX, INC.

ticker: DBX


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, we have (1) cybersecurity risk addressed as a component of the Company's enterprise risk management program and identified in the Company's risk register; (2) the security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our information security committee evaluates material risks from cybersecurity threats against our overall business objectives and our CISO reports to the Nominating and Governance committee the board of directors, which evaluates our overall enterprise risk.

companyName: Enovix Corp

ticker: ENVX


text: Wynn Resorts' information security program is designed to preserve the accuracy and integrity of all forms of information processed by us and to protect such information, including our employees' and guests' personally identifiable information and information related to our operations, from misuse, loss, or theft. Our information security program is founded on principles and standards of the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity issued by the U.S. government.

companyName: WYNN RESORTS LTD

ticker: WYNN


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: Although the Company dedicates significant resources and efforts to protect against cybersecurity risks, the Company has experienced, and expects to continue to be subject to, cybersecurity threats. To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. However, the Company continues to face cybersecurity risks such as those described in "Item 1A. Risk Factors" in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future. While the Company maintains cyber risk insurance, such insurance may not be sufficient to cover all losses from cybersecurity incidents.

companyName: NEWS CORP

ticker: NWSA


text: To address cybersecurity risk, we maintain a cybersecurity risk management program that is overseen by the Chief Information Security Officer (CISO). The CISO is responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations and third-party risk assessments; identifying and keeping abreast of developing security threats; as well as overseeing and implementing regular security awareness training of all employees on cybersecurity. In leading the cybersecurity risk management program, the CISO regularly works with other divisions of the company, including legal, compliance, IT, audit, and others to address potential risk from external threats, internal actions, and relationships with third-party service providers.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: The KKR information security team undertakes a variety of measures to monitor and manage the cybersecurity risks of KKR's asset management business. For example, the KKR information security team monitors our technology infrastructure with tools designed to detect suspicious behavior. Our technology platforms and applications are designed to enable us to monitor user and network behavior at KKR's asset management business, identify threats using certain analytics, and mitigate attacks across various layers of the enterprise. The KKR information security team conducts regular internal and external audits with third-party cybersecurity experts to identify and evaluate potential weaknesses in our cybersecurity systems. Some of these third-party monitoring functions continue throughout the year while other third-party security experts are periodically retained to audit specific areas of the cybersecurity program. In addition, the KKR information security team conducts periodic phishing simulations, and they also conduct periodic employee training on KKR's security policies and controls and provide other security trainings as part of new employee onboarding.

companyName: KKR & Co. Inc.

ticker: KKR


text: Cyber Risk Management and Strategy The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: The Hartford has implemented an information protection program with established governance routines for assessing and managing risks. The Hartford employs a 'defense-in-depth' strategy that uses multiple security measures to protect the integrity of the Company's information assets. This 'defense-in-depth' strategy aligns to the National Institute of Standards and Technology Cybersecurity Framework, where controls are implemented throughout our environments to achieve the six categorical objectives of governance, identification, protection, detection, response and recovery.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We utilize industry standard software packages such as RSA and Cisco Firepower to secure our networks. We conduct regular risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls, and other safeguards in place to manage such risks. As part of our risk management process, we may engage third party experts to help identify and assess risks from cybersecurity threats. For example, we perform penetration tests, data recovery testing, security audits and risk assessments throughout the year. We hold online cybersecurity training for our employees. Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers. Following these risk assessments, we design, implement, and maintain safeguards intended to minimize the identified risks; address any identified gaps in existing safeguards; update existing safeguards as necessary; and monitor the effectiveness of our safeguards.

companyName: Pangaea Logistics Solutions Ltd.

ticker: PANL


text: Federated Hermes' board of directors has ultimate oversight responsibility for cybersecurity risks and threats. Federated Hermes' Audit Committee assists its board of directors in monitoring cybersecurity risks and threats. Federated Hermes' board of directors and Audit Committee receive reports on cybersecurity matters on a periodic (generally quarterly) basis (and more frequently when circumstances warrant) as part of risk management oversight responsibilities. For instance, in 2023, Federated Hermes' Chief Information Officer (CIO) reported to Federated Hermes' board of directors one time and its Audit Committee three times regarding cybersecurity risks and threats. The Audit Committee also receives reports from Federated Hermes' internal auditors, legal counsel and other responsible officers regarding cybersecurity topics and trends. The Federated Hermes Chief Risk Officer (CRO) also reports directly to the Compliance Committee of Federated Hermes' board of directors on a quarterly basis and Federated Hermes' full board of directors as appropriate on significant enterprise risks, including cybersecurity risks.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Monroe Capital's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser, or our administrator, is disclosed into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.

companyName: Monroe Capital Income Plus Corp


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on applicable banking regulations, including the Interagency Guidelines Establishing Information Security Standards ("Interagency Guidelines"), and a Cybersecurity Assessment Framework. Our cybersecurity program in particular focuses on the following key areas: Process

companyName: CVB FINANCIAL CORP

ticker: CVBF


text: Periodically reporting risks, previous and current incidents, and ways to mitigate risks to the Chief Executive Officer, the Audit Committee of the Board of Directors, and other members of senior management.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: Cybersecurity incidents are escalated to the cybersecurity incident response team ("CIRT") who is responsible for overseeing our incident response strategy, including remediation. Significant cybersecurity incidents are escalated to the Company's Incident Response Materiality Assessment Committee ("IRMAC") that assesses and evaluates whether the incident is material using criteria based on our enterprise risks. This committee is comprised of a cross-functional team that consists, in part, of employees at the management level and members of the executive team. As noted above, if a significant cybersecurity incident occurs, it will be reported promptly to the Board on an ad hoc and as-needed basis. Otherwise, management reports cybersecurity risks and developments to the Board quarterly.

companyName: MEDIFAST INC

ticker: MED


text: Allstate performs control effectiveness tests, vulnerability scans and penetration tests to assess controls and proactively identify vulnerabilities for prioritization and remediation. Findings are managed and tracked in accordance with Allstate's governance, risk and compliance standards.

companyName: ALLSTATE CORP

ticker: ALL


text: A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors.

companyName: FIRST NORTHERN COMMUNITY BANCORP

ticker: FNRN


text: The Board receives regular updates from the Audit Committee, as well as from the Cybersecurity team, including a summary of key risk indicators, test results and related remediation, and recent threats and how the Company is managing those threats.

companyName: HASBRO, INC.

ticker: HAS


text: In addition, the Company uses several internal training methods, through annual mandatory courses on security and privacy for all employees, as well as multiple simulated phishing attacks and regularly providing information security awareness materials throughout the year. The Company also maintains cybersecurity insurance. To date, the Company has not experienced cybersecurity incidents that have materially affected its business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, please refer to Item 1, Business – Supervision and Regulation – Privacy and Cybersecurity and Item 1A, Risk Factors – Risks Related to Our Operations.

companyName: EAST WEST BANCORP INC

ticker: EWBC