text: The organization has implemented strong internal evaluation mechanisms and governance structures to ensure the integrity and maturity of its cybersecurity position. Risk management of third-party service providers, especially those handling sensitive data or enterprise applications, is carried out through documented access reviews and contractual safeguards, including SOC 2 reporting where applicable.

companyName: Alternus Clean Energy, Inc.

ticker: ALCE


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG

secItem: Item 1C


text: The risk assessment process helps identify assets requiring additional risk reduction strategies and involves regular internal and third-party security assessments.

companyName: First Financial Northwest, Inc.


text: Members of the Cybersecurity and Privacy Committee have broad ranges of expertise and experience in information technology and security. Our ISO, a co-chair of the committee, has over fifteen years of experience in the field of information security management, having previously led security operations and infrastructure and IT functions for a public university campus and a non-profit organization, and holds several licenses and certifications relating to information security, including a Certified Information Systems Security Manager from the Information Systems Audit and Control Association (ISACA), a Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium (ISC2) and several technical cybersecurity certifications from the Global Information Assurance Certification (GIAC). Our PSO, also a co-chair of the committee, has over twenty-five years of previous experience in cyber security architecture and cyber security management for a number of large Fortune 500 technology companies and holds several certifications including CISSP from the International Information Security System Security Certification Consortium, C-CISO from EC-Council, Numerous certifications from Microsoft, CISCO, Juniper, Checkpoint among others and has completed several advanced GIAC security classes from the SANS Institute.

companyName: DEXCOM INC

ticker: DXCM


text: 4. Risk Acceptance- The Company's risk assessment is evaluated from a Low (1) to a High (3) on the Impact the threat would have on the Company and its operations and the likelihood of occurrence. Threat ratings created from the Impact and probability calculations will result with a value from 1- 9.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO, is involved in assessing and managing our cybersecurity risks. Our CIO has 13 years of experience managing information technology in complex environments. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO, who then informs the Board based on the nature and severity of the incident. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.

companyName: Twist Bioscience Corp

ticker: TWST


text: Our Chief Information Officer provides quarterly briefings to the audit committee and board of directors regarding our Company's cybersecurity program, including risks and activities, reports of recent cybersecurity incidents and related responses (if any, and if not previously reported to the Board pursuant to the incident response plan), cybersecurity systems testing, the status of third party assessments, general updates in the cybersecurity space, relevant disclosures related to SEC reporting, and the like.

companyName: ESS Tech, Inc.

ticker: GWH


text: Vice President of Operations, who has over 30 years of experience in IT and marketing, works with our board of directors to manage our cybersecurity policies and processes, including those described in the "Risk Management and Strategy" section above. Together, they stay informed and manage how we identify, address, prevent and resolve cybersecurity issues and related matters. They also track how we prevent, identify, lessen, and address cybersecurity issues. This is done through regular checks of our systems, tests to identify security weaknesses, and maintaining an incident response plan. In addition to such regular system checks, our Vice President of Operations, together with the board, regularly discuss active, emerging and potential cybersecurity risks. They keep each other informed about significant changes affecting cybersecurity, and they periodically update management with these changes, as well as our cybersecurity risks, so that management can administer its oversight function as a part of its broader oversight and risk management.

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Our management team, including our Chief Information Security Officer (CISO)/Senior Vice President of Information Technology and Security (SVP), is responsible for assessing and managing, and mitigating cyber risk and security threats. The Security team has primary responsibility for our overall cybersecurity risk management program and supervises both internal cybersecurity personnel and external cybersecurity consultants and contractors. The Security team members have diverse experience in security strategy, architecture, and operations. Additionally, the CISO/SVP has more than 30 years' experience leading transformative security and technology. The CISO/SVP has earned the following certifications: Certified Information Systems Manager, Department of Homeland Security, Certified Incident Command, Certified Technical Emergency Response Training, Certified Incident Response, and the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification.

companyName: EverCommerce Inc.

ticker: EVCM


text: In developing and implementing measures to assess, identify and manage cybersecurity risk, our approach is to evaluate the possible operational and financial effects of those measures and take that information into consideration in conducting a risk-based analysis of the appropriate cybersecurity protections for the Company. We strive to protect the Company with cost-effective, efficient and non-disruptive measures, while robustly protecting the Company against cybersecurity threats.

companyName: Sylvamo Corp

ticker: SLVM


text: Our Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate. Our Cybersecurity consultant has extensive information technology and program management experience. We have implemented a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: MAIA Biotechnology, Inc.

ticker: MAIA


text: The audit committee of the board of directors receives quarterly updates on the status of Diamondback's cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur, to the extent relevant to our program. Board members receive presentations on cybersecurity topics from Diamondback's Senior Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, Diamondback's code of business conduct and ethics expects all employees to safeguard the electronic communications systems and related technologies of Diamondback and its subsidiaries, including us, from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to Diamondback's Chief Legal and Administrative Officer and Senior Vice President and Chief Information Officer. Diamondback's cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party service providers, suppliers and vendors. Diamondback's vendor management process may include reviewing the cybersecurity practices of such providers, contractually imposing obligations on the providers, conducting security assessments and conducting periodic reassessments during their engagement.

companyName: VNOM Sub, Inc.


text: The Cyber SteCo oversees activities related to the monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, and periodic assessments of third-party service providers to assess the cyber preparedness of key vendors. To enhance our threat preparedness, we perform monthly vulnerability scans, annual penetration testing with a third-party, and annual disaster recovery and cyber response drills, including third-party facilitated drills. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a third party operated security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our Cyber Steco also has implemented comprehensive incident response plans that define the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cyber SteCo escalates events, including to the Chief Executive Officer and Board of Directors, as deemed necessary.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: PROS Holdings, Inc.


text: We conduct a regular cybersecurity risk assessment process through our Chief Technology Officer and dedicated information security team which reports to our management-level information technology steering committee, which is a subset of our management-level enterprise risk committee. These committees meet at least quarterly to discuss and evaluate risks that could be material to our business, including cybersecurity threats. This management-level enterprise risk committee is comprised of key leadership across the Company, including our Chief Executive Officer or Interim Chief Executive Officer, Chief Financial Officer, Chief Underwriting Officer, President and Chief Fiduciary Officer, and General Counsel.

companyName: Beneficient

ticker: BENF


text: GLDM does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of GLDM. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. GLDM also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing the Sponsor's cybersecurity review processes, any potential risks and any incidents which could impact GLDM. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: We engage outside consultants on a regular basis to help us design internal controls and processes that are intended to help address cybersecurity risks. We also leverage these outside consultants and other third parties, when appropriate, to implement appropriate processes, policies, and internal controls designed to help prevent, detect, and/or mitigate these cyberthreats.

companyName: XOMA Royalty Corp

ticker: XOMA


text: See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our data and information security systems.

companyName: GameStop Corp.

ticker: GME


text: The Bank has implemented an IRP that identifies roles and responsibilities for Bank employees, as well as general scenarios for management and containment of incidents. The Plan is reviewed and updated at least annually by senior management and reviewed by either the IT Committee or the Board of Directors prior to approval by the Board of Directors.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, the Federal Financial Institutions Examination Council ("FFIEC") guidelines. In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness. Our Information Security Officer and our Chief Technology Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The Information Security Program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions. We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: SMARTFINANCIAL INC.

ticker: SMBK


text: We have measures in place to protect the confidentiality, integrity and availability of franchise and customer information. Most personally identifiable information ("PII") handled by our restaurants is associated with payment cards, which are protected by an EMV chip reader that encrypts and tokenizes customer data, so it passes through our networks without retaining any personal information. We do not store any credit or debit card information from customers. All information is processed through a third-party firm. To maintain the safety and security of our customers' private payment information, we follow the Payment Card Industry Data Security Standard ("PCI DSS") to ensure our processes and systems are well equipped for proper data protection. Employees and third-party contractors with access to the Company's cardholder data environment ("CDE") or systems used to support the CDE, complete annual PCI awareness training. The Company's corporate restaurant employees also receive periodic security training on devices that capture payment card data.

companyName: JACK IN THE BOX INC

ticker: JACK


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and other external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, and make recommendations to improve processes. Our board of directors and members of management, as appropriate, are presented with any updates we make due to our risk assessment.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Response to cyber incidents is guided by the Bank's Incident Response Policy. The Bank's plan is based on the National Infrastructure Protection Center ("NIPC") guidelines, with the addition of specific reporting and notification requirements required by regulation. The Incident Response Policy prescribes points of escalation and mechanisms for collaboration should the need arise to engage outside partnerships such as external counsel, cybersecurity forensic examiners, cyber insurance vendors, government agencies and regulatory bodies.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: We have implemented a comprehensive cybersecurity program designed to identify, assess, and mitigate potential threats and vulnerabilities, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program includes regular risk assessments, network monitoring, penetration testing and incident response protocols. We also provide regular, mandatory training to our personnel regarding cybersecurity threats to educate employees with effective tools and knowledge to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. Our Senior Director of Operations/IT and his team work collaboratively across the Company and with our board of directors and management to maintain our cybersecurity program and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Our board of directors and management receive periodic cybersecurity updates from our Senior Director of Operations/IT, which may include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to our cybersecurity program. The Company's Senior Director of Operations/IT has served in various roles in information technology and information security at Gaia for over 18 years.

companyName: GAIA, INC

ticker: GAIA


text: We have adopted an IT Security Management Policy ("IT Policy") to establish the requirements for securing and managing our IT assets and data, as well as an Incident Response Policy designed to coordinate the activities for preparing for, identifying, responding to, and recovering from cybersecurity threats. Our Head of IT is primarily responsible for implementing and overseeing the IT Policy, which is applicable to all our employees and contractors, as well as any third parties with access to our IT assets and data. Our Head of IT is also primarily responsible for leading incident response services under the Incident Response Policy. Our Head of IT leverages over 20 years of experience in various cybersecurity functions. As part of our overall risk mitigation strategy, we maintain an Enterprise Risk Register to identify, prioritize and track system risks, including cybersecurity risks. Additionally, we maintain cybersecurity insurance; however, such insurance may not be sufficient in type or amount to cover the total losses or damages related to a cybersecurity incident.

companyName: Invivyd, Inc.

ticker: IVVD


text: Occidental's business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but Occidental cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on Occidental's cybersecurity related risks, see Item 1A "Risk Factors" of this Annual Report on Form 10-K.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Under the direction of Atleos' CISO, the Global Information Security organization is responsible for implementing and maintaining an information security program with the goal to protect information technology resources and protect the confidentiality and integrity of data gathered on our people, partners, customers, and business assets. Also, we employ various information technology and protection methods designed to promote data security including firewalls, intrusion prevention systems, denial of service detection, anomaly-based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, identity management technology, security analytics, multi-factor authentication and encryption. In addition to the Chief Risk Officer, our Chief Compliance Officer has a direct channel to the Board. Further, our Chief Compliance Officer oversees investigations pertaining to fraud, conflicts of interest, violations of laws, and other similar matters, and reports on those activities to one or more Committees of the Board. All of these channels to the Board are designed to: prevent risks and initiatives from being siloed into one channel and provide a clear and accurate picture of the Company's evolving risk landscape.

companyName: NCR Atleos Corp

ticker: NATL


text: To our knowledge cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: Risk Management and Strategy Peapack Private Bank & Trust's risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology, our expansion of Internet and mobile banking tools, an increased level of employees working remotely and the potential of cyber threats. Peapack Private's Information Security Officer is primarily responsible for cybersecurity and is a key member of the risk management organization, reporting directly to the Chief Risk Officer and as discussed below, periodically to the Information Technology Steering Committee and Peapack Private's board of directors.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our board of directors, which has overall responsibility for enterprise risk management, has delegated to our audit committee primary oversight of cybersecurity risks and the processes to manage them. The audit committee regularly reviews and discusses with our CISO, CRO, and other senior management our policies and processes designed to identify, monitor and address enterprise risks, including risks from cybersecurity threats and incidents. Material cybersecurity threat risks are also considered during board of directors and audit committee meeting discussions of matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters. In addition, at least annually, our board of directors discusses our programs and policies related to cybersecurity and considers them from a risk management perspective and as part of OneStream's business strategy.

companyName: OneStream, Inc.

ticker: OS


text: CTO, James Liao, and senior vice president of the Operating Subsidiary, Ruobing Yu, constitute our cybersecurity incident management team and are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CTO has over 25 years in consumer electronics and telecommunication sectors and has a professional background in computer science and engineering, which enables him to oversee our IT systems efficiently.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: The Audit Committee assists our board of directors in addressing the Company's cybersecurity risk management as part of its general oversight function. The board of directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. The Audit Committee regularly reviews and discusses the Company's cybersecurity risks with management, including the Company's Chief Information Officer, General Counsel, Vice President of Human Resources and Vice President of Operations.

companyName: SunPower Inc.

ticker: SPWR


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Review of cybersecurity risks and internal audits regarding information security are conducted by the Audit Committee on a quarterly basis, or more frequently as determined to be necessary or advisable.

companyName: Performant Healthcare Inc

ticker: PHLT


text: We have established policies and processes for assessing, identifying and managing material cybersecurity risks, and have integrated these processes into our overall risk-management processes. We have also established policies and processes for managing and responding to material cybersecurity incidents.

companyName: IMPINJ INC

ticker: PI


text: We have established comprehensive incident response and recovery plans that guide our response in the event of a cybersecurity incident.

companyName: Vado Corp.


text: Our CIO conducts periodic meetings with the Audit Committee to review our information technology systems and address significant cybersecurity risks.

companyName: Rocket Lab Corp

ticker: RKLB


text: As part of the Company's overall enterprise risk management processes, the Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company. The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful. The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms. The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company's cybersecurity risk management practices, including an evaluation of the Company's cybersecurity program based on the NIST Cybersecurity Framework approximately every two years. The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.

companyName: NEWS CORP

ticker: NWSA


text: There have not been any breaches at the Sponsor or the Trust during the year ended September 30, 2024. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Stellar Lumens Trust (XLM)

ticker: GXLM


text: Our management cybersecurity committee, led by our CFO and Director of Information Technology, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and any retained external cybersecurity consultants. Our Director of Information Security has served in various roles in information technology and information security for over 20 years. Our managed service provider has over 20 years of experience managing multi-national IT operations, including strategy, applications, infrastructure, information security, support, and execution.

companyName: Plymouth Industrial REIT, Inc.


text: Board of Directors will receive regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts.

companyName: Idaho Copper Corp

ticker: COPR


text: The CISO team is supported by a Security Operations team reporting into the Information Technology ("IT") function. This IT team provides engineering and technical expertise. The team is further supported by a 24x7 Security Operations Center ("SOC"). Adtalem has a Cyber Incident Response Plan ("Incident Response Plan") that delineates the requirements of notification, classification, analysis, and communication of cybersecurity incidents based on the identified severity level. The Incident Response Plan includes initial steps to convene a response team, contain the incident, consider insurance notification requirements, determine the type of incident and escalation, consider the communications protocol and possible disclosure requirements, and consider involving law enforcement. The Incident Response Plan also provides for a lessons learned review to identify improvements that could be made. Adtalem's Legal and Compliance teams also provide incident response support to the CISO and manage cybersecurity-related legal and compliance issues. Processes are in place to escalate cybersecurity incidents promptly so that decisions regarding public disclosure and regulatory reporting can be made by management in a timely manner.

companyName: Covista Inc.

ticker: CVSA


text: To supplement our cybersecurity risk assessment, identification, management, and mitigation efforts, we engage third party cyber security experts. Cyber security assessments are performed at least annually, results are documented and reviewed, and mitigation plans are put in place to reduce any threats identified. The classification of data processed by any system is considered when implementing mitigations.

companyName: Mistras Group, Inc.

ticker: MG


text: As of the date hereof, we have not experienced any material cybersecurity incidents. However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition. The Company maintains cybersecurity insurance to mitigate the risks of a material cybersecurity incident; however, the costs may exceed our coverage and, therefore, may not be fully insured. See Part I, Item 1A - "Risk Factors" in this Annual Report on Form 10-K for a further discussion of various cybersecurity risks to the Company.

companyName: CARVANA CO.

ticker: CVNA


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Audit Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to our board of directors on a quarterly basis.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the company. We employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time: • monitoring emerging data protection laws and implementing responsive changes to our processes; • undertaking periodic reviews of our policies with customers, partners, and suppliers and statements related to cybersecurity; • conducting cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • conducting phishing email simulations for employees and contractors with access to corporate email systems; • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care; and • educating our teams on incident response, conducting tabletop exercises and using the findings to improve our processes and technologies.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. As AI technology advances, attackers are leveraging AI to automate and enhance cyberattacks, creating more sophisticated and evasive threats. Our cybersecurity program is designed to adapt to these evolving risks by integrating AI-powered security analytics and threat intelligence.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: EIS conducts annual security reviews of critical vendors. Vulnerabilities in third-party systems and software are monitored and managed through the Security Insights Program vulnerability management program. This program aggregates findings from the vulnerability detection and secure configuration management tools within a dashboard, which allows EIS personnel to focus on high priority matters.

companyName: ROBERT HALF INC.

ticker: RHI


text: We have Certified Information System Security Professional ("CISSP") and Information Systems Security Management Professional ("ISSMP") certifications among our internal security personnel.

companyName: UFP TECHNOLOGIES INC

ticker: UFPT


text: We use third-party providers for various aspects of our business, such as data-hosting companies. We have a third-party risk management program to manage cybersecurity risks associated with our use of these providers, which includes vendor risk assessments, questionnaires, review of the vendor's security program, and contractual obligations for vendors, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Standard provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our CIO, Chief Executive Officer, Chief Financial Officer, and outside legal counsel, would respond to such incident in accordance with our Cybersecurity Incident Response Standard. Any cybersecurity incident that is designated by the CIRT with a "High"

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: We also maintain a privacy and cybersecurity incident response program to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Further, we conduct periodic tabletop exercises to test and fortify the controls of our cybersecurity incident response program. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.

companyName: Workday, Inc.

ticker: WDAY


text: Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our VP of InfoSec regularly reports directly to the Audit Committee on our cybersecurity program and efforts to prevent, detect, mitigate and remediate issues. In addition, we have an escalation process in place to inform senior management and the Board of material issues.

companyName: Groupon, Inc.

ticker: GRPN


text: At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats. Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 25 years of experience in government and industries including retail and manufacturing, and industry certifications including Certified Information Systems Security Professional ("CISSP") from ISC Squared and Global Information Assurance Certification ("GIAC") from SANS Institute. Our SVP-GIS also has experience in forensic investigations, strategic cyber risk management, and cybersecurity program development. Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity policies and practices across our business and reports directly to our EVP-CIO. Our SVP-GIS's direct reports include a number of experienced cybersecurity leaders responsible for various aspects of our cybersecurity program, each of whom is supported by a team of experienced cybersecurity professionals.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Management and Strategy relies heavily on information technology systems to operate our election registration, tabulation and online voting business. GES in administering elections manages proprietary and personal data list from its clients. Despite our ongoing investments in cybersecurity measures, we are subject to increasing risks associated with cyberattacks, ransomware, phishing, and other malicious activities.

companyName: Global Arena Holding, Inc.


text: The Board is actively engaged in the oversight and prudent management of risk, including those relating to cybersecurity and regulatory compliance. A comprehensive program update is delivered to the Board annually by the CISO. The Board annually reviews and approves the ISP and related Information Security policies to ensure alignment with the Company's risk appetite and strategic defense amidst the evolving cybersecurity risk landscape.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: We continually monitor our information system in order to Detect anomalous activity and verify the effectiveness of our protective measures. In connection with this phase, we do the following: • Run extended detection and response software on our network at all times, which is comprehensive company-wide personal computer device security monitoring and active threat remediation software that is fully supported by staff and backed by a prevention warranty; • Engage third-party specialists to periodically perform: (i) penetration testing, which is a simulated cyberattack against our computer system, in order to assess our ability to resist potential threats and attacks from external and internal sources; (ii) cyber dwelling, which determines if a threat actor has made its way or could make its way into our computer network and if confidential information was or could be compromised; and (iii) tabletop mock ransomware exercises to gauge our ability to react to an attack; • Evaluate the technical control structure and competency for all new third-party software vendors and review "cloud" third-party software vendor's Service Organization Control reports, or reasonable substitutes, which give comfort on the maturity of the vendor's security controls; and • Perform monthly mock phishing email exercises with our employees and provide additional training if needed.

companyName: FIRST INDUSTRIAL LP


text: Our cybersecurity program encompasses functions dedicated to both proactive and reactive management of cybersecurity threats. We implement our cybersecurity program internally through maintaining cybersecurity policies; deploying updated security technologies; and using third-party services and consultants to support and improve our cybersecurity program. Our proactive management of cybersecurity risks entails many actions, including actively monitoring our information technology systems; engaging service providers to monitor and, as appropriate, respond to cybersecurity threats; developing and updating incident response plans to address potential cybersecurity threats; and training our personnel on cybersecurity. We engage third-party auditors and consultants and leverage our internal information security, audit, and compliance functions to assess various facets of our cybersecurity program. We also maintain enterprise-wide processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers.

companyName: Super League Enterprise, Inc.

ticker: SLE


text: The Company's Board of Directors ("Board") has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CIO provides at least quarterly updates to the Audit Committee on the Cybersecurity program, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology ("NIST") framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization including with representation from the Audit Committee, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's Internal Audit function periodically audits elements of the security program and reports its observations to the CIO, CLO and the Audit Committee.

companyName: SpartanNash Co


text: Given the importance of cybersecurity to our business, we maintain a robust cybersecurity program as well as cybersecurity policies and processes to support our controls and our preparedness for treatment of identified information security risks. We also undergo annual evaluations of our cybersecurity program, conducted by our cybersecurity external advisory firm.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: Our cybersecurity program is overseen by a cross-functional committee of senior business leaders and is led by our Senior Vice President of Information Services and Chief Digital Officer (CDO). This management committee meets regularly and is charged with overseeing our cybersecurity strategy, seeking to ensure that cyber risks relating to the Company and its operations are managed, and that the program is aligned with the Company's business goals and objectives. The CDO has a formal education in information technology as well as extensive experience working in the Company's information and technology function; and receives periodic training and education on cybersecurity-related topics.

companyName: COLUMBUS MCKINNON CORP

ticker: CMCO


text: Our cybersecurity program is designed to assess, identify, and manage material risks from cybersecurity threats, and protect and preserve the confidentiality, integrity, and continued availability of all information owned by, or in the care of, the Company. Cybersecurity risks are incorporated into the Company's broader risk management process to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. As part of the cybersecurity program, we utilize a combination of internal technology, which we continue to analyze and update as necessary, and a third-party managed security service provider and their platform to monitor, evaluate and respond to cyber activity.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: The Company maintains cybersecurity policies and standards which align with the International Organization for Standardization (ISO) 27001 standard and the National Institute of Standards and Technology (NIST) Cybersecurity Framework. The Company's cybersecurity policies and standards have been developed in collaboration with groups across the enterprise, such as Legal, Compliance and each of its business segments. The Company's policies include, for example, Information and System Use policies for employee and non-employee system users. These policies reinforce the data privacy and protection sections of the Company's Code of Business Conduct and Ethics.

companyName: TRAVELERS COMPANIES, INC.

ticker: TRV


text: We plan to provide our Board of Directors with a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the President also will report to the Board of Directors on various metrics on threat management, incident response and recovery planning, along with industry benchmarks.

companyName: EACO CORP

ticker: EACO


text: Our Senior Director of IT is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our General Counsel is responsible for approving budgets and, along with our Senior Director of IT, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Janux Therapeutics, Inc.

ticker: JANX


text: During the normal course of business, the Company has experienced and expects to continue to experience cyber-based attacks and other attempts to compromise its information systems. Based on the information that the Company had as of the end of the fiscal year covered by this Annual Report on Form 10-K, the Company does not believe that it has experienced any cybersecurity incidents that have materially affected the Company. However, the sophistication of cyber threats continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cyber incidents and protect its systems and information may not successfully protect against all cyber incidents. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors."

companyName: Vestis Corp

ticker: VSTS


text: Our approach to cybersecurity encompasses a wide range of strategies, practices, and technologies designed to safeguard our systems and data. This process involves continuous monitoring, risk assessment, implementation of advanced security measures, and regular updates to our protocols to address emerging threats.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: We continue to invest in strengthening our cybersecurity strategy and platform and, as specifically set forth below, have integrated cybersecurity risk management into our broader enterprise risk management process. This integration will promote cybersecurity considerations as an integral part of our decision-making processes and operational practices. Our information technology department works closely with our senior management team to consistently identify, evaluate, and manage cybersecurity risks in alignment with our business strategy and objectives and operational needs.

companyName: HURCO COMPANIES INC

ticker: HURC


text: As of the date of this report, we have not identified cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. We have a formalized incident response policy in place. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," of this Annual Report.

companyName: Acrivon Therapeutics, Inc.

ticker: ACRV


text: Protocols and Strategy Organizations in our industry are frequently confronted with a broad range of cybersecurity threats, ranging from uncoordinated, individual attempts to gain unauthorized access to an organization's information technology ("IT") environment to sophisticated and targeted cyberattacks sponsored by foreign governments and criminal enterprises. Although we employ comprehensive measures to prevent, detect, address, and mitigate these threats, a cybersecurity incident could potentially result in the misappropriation, destruction, corruption, or unavailability of critical data, personal identifiable information, and other confidential or proprietary data (our own or that of third parties) and the disruption of business operations. The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, regulatory fines, litigation with third parties, and diminution in the value of our investment in research and development, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of our Enterprise Risk Management ("ERM") program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: Janus International Group, Inc.

ticker: JBI


text: We rely on complex information technology systems and various software applications to operate our business. We have developed a comprehensive cybersecurity program designed to protect our systems and the confidentiality, integrity and availability of our data.

companyName: AbbVie Inc.

ticker: ABBV


text: Our cybersecurity strategy implements layered controls aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework to minimize both the likelihood and potential impact of cybersecurity events.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, our third-party IT service provider, cybersecurity consultants, outside legal counsel, software providers, and penetration testing firms.

companyName: Y-mAbs Therapeutics, Inc.


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2024 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Information Technology - A cyber security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts." under "Item 1A. Risk Factors."

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties in assisting in review our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: Quantum-Si Inc

ticker: QSI


text: Our Board of Directors provides oversight of our cybersecurity program through quarterly and annual risk reviews and cybersecurity reporting. On a quarterly basis, cybersecurity risk and mitigation strategies are reviewed as part of our business risk management group's reporting to the Board of Directors, which includes the reporting of significant business risks, including cybersecurity mitigation strategies employed to manage these risks and a review of any emerging risks. At least annually, our Vice President of IT provides an overview of our cybersecurity program to the Board of Directors, including a review of key strategies, emerging risks and a summary of key performance indicators. In addition, annually the Board of Directors reviews the results of our penetration and vulnerability testing.

companyName: Otter Tail Corp

ticker: OTTR


text: Data Security: The core objective of our cybersecurity program is securing the Company's sensitive data across all information assets while maintaining appropriate access for authorized personnel. To prevent any accidental data loss, we strictly follow the principle of "least privilege," and limit users' access rights to only what is required to do their jobs. Further, all the disks are encrypted, and daily backups of all computers are maintained outside the Company's network.

companyName: International Seaways, Inc.

ticker: INSW


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance; Management" below, our board of directors provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer and Senior Director of IT and Security.

companyName: NETLIST INC

ticker: NLST


text: We also have a process in place to manage cybersecurity risks associated with third-party service providers. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Hilton Worldwide Holdings Inc.

ticker: HLT


text: Our cybersecurity team evaluates the risk profile of new third-party service providers and maintains communication channels with key third-party service providers to evaluate and respond to possible effects of incidents within a service provider's organization. We rely on, and in certain cases require, our third parties to communicate such incidents timely.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Third-Party Risk Management Brighthouse Financial processes also address the cybersecurity risks associated with the use of third-party vendors, some of which have access to our customer and associate data. We conduct security assessments of all third-party vendors that have access to our systems, our data and/or the facilities that house such systems or data. As part of our third-party risk management program, the cybersecurity risk management and third-party risk management teams collaborate to monitor our third-party vendors' compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: BRIGHTHOUSE LIFE INSURANCE Co


text: Engagement of Third Parties We engage third-party cybersecurity consultants and experts to supplement staffing of our CSOC, as well as to help us assess, validate, and enhance our security practices, including conducting cybersecurity maturity assessments, vulnerability assessments and penetration tests.

companyName: CONOCOPHILLIPS

ticker: COP


text: Conducts cyber education and awareness training sessions to equip employees with the necessary knowledge and foster a strong security culture. Analyzes internal and external cybersecurity incidents and threat intelligence to assess relevance to its environment and industry. Performs recovery testing to ensure the resilience of critical systems and support business continuity.

companyName: Energy Services of America CORP

ticker: ESOA


text: We have dedicated to advance our cybersecurity risk management and integrated it into our overall risk management program, which program manages cybersecurity, financial, operational and compliance risks. To access, identify and manage cybersecurity threats, we implemented a cybersecurity risk management program with oversight by our Board of Directors ("Board"). Our management, led by an experienced information security team, continually monitors cybersecurity risk incidents.

companyName: SemiLEDs Corp

ticker: LEDS


text: We utilize third-party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: We recognize the importance of assessing, identifying and managing risks from cyber security threats, and our processes to manage risks from cybersecurity threats have been integrated into our overall risk management framework.

companyName: Shutterstock, Inc.

ticker: SSTK


text: Our information security program is designed based on the National Institute of Standards and Technology ("NIST") 800-53 framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST framework as a guide in designing and implementing our information security program.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Business Continuity, Incident Response and Disaster Recovery. The Company has established and maintains business continuity, incident response, and disaster recovery plans designed to address the Company's response to cybersecurity incidents and other potential disruptions. Our IT Security, Operations and Compliance teams routinely evaluate and update these plans to enhance our incident response preparedness. The Company also leverages third party incident response and threat detection services.

companyName: IBEX Ltd

ticker: IBEX


text: Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter's cybersecurity functions rests with its board of directors and Audit Committee.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: We maintain a risk-based approach to evaluating and overseeing cybersecurity risks presented by our third-party vendors. Third-party vendors that meet certain criteria, such as owning and operating any information technology networks and systems on which the Company relies, are evaluated to assess their performance across several domains, including data security and operations management. We seek to maintain effective communication with our third-party vendors to facilitate timely notification of cybersecurity incidents that might impact the Company. We also independently monitor reputable cybersecurity publications for notifications about vulnerabilities in widely used software libraries, APIs, and other generally available technologies upon which our third-party vendors' products might rely.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. These presentations may cover a range of topics, including: • the current cybersecurity landscape and emerging threats; • progress on cybersecurity projects; • incident reports; • lessons learned from past events; and • adherence to regulatory requirements and/or industry standards, as appropriate.

companyName: ALLEGRO MICROSYSTEMS, INC.

ticker: ALGM


text: The Audit Committee receives regular reports and briefings from management on our cybersecurity risks and cybersecurity risk management program updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Airbnb, Inc.

ticker: ABNB


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Repare Therapeutics Inc.


text: Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from our Chief Executive Officer and our Chief Compliance Officer, regarding the overall state of our cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents.

companyName: PhenixFIN Corp

ticker: PFX


text: Peabody Energy Corporation For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."

companyName: PEABODY ENERGY CORP

ticker: BTU


text: Maintaining a robust cybersecurity strategy to safeguard and protect the confidentiality, integrity and availability of our critical infrastructure assets as well as all other information systems and the information residing in them is critically important to our business. We face various cyber threats, including malware intrusion, computer viruses, unauthorized access attempts, ransomware attacks, social engineering attacks, hacktivism and potential insider threats. In addition to the cybersecurity threats faced by any business with a cyber presence, as an owner and operator of critical infrastructure assets, we are subject to cybersecurity threats from domestic and foreign threat actors who wish to disrupt our electricity delivery operations and/or the ERCOT bulk power grid. With an ever-increasing share of our operational and administrative activity being dependent on our information systems, we strive to create a company-wide culture of cyber safety that continually monitors risk.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: The Information Security Program is led by the Chief Information Security Officer ("CISO"), who reports to the Chief Risk Officer. The Chief Risk Officer has oversight of the Company's risk management framework, which includes the Information Security Program. The CISO provides program oversight and direction, including adjustments in response to changes in technology, threats, business processes, and regulatory or statutory requirements. The CISO works collaboratively with information technology staff, operational management, and functional stakeholders to implement a program designed to protect our information systems from cybersecurity threats and promptly respond to potential cybersecurity incidents. The CISO has over 24 years of experience in the fields of information technology and cybersecurity, most at a Fortune 500 global technology company, and maintains multiple professional cybersecurity certifications.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: The company's Vice President of Global Information Technology and Information Security is responsible for leading the assessment and management of cybersecurity risks. The current Vice President of Global Information Technology and Information Security has over 10 years of experience in information security and holds CISSP and GIAC credentials. The Vice President of Global Information Technology and Information Security reports to the Audit Committee and management on cybersecurity threats on a regular basis.

companyName: MIDDLEBY Corp

ticker: MIDD


text: At QVC, the VP of Cybersecurity is responsible for day-to-day management and oversight of cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The VP of Cybersecurity provides regular reporting to the ISSC and QVC executive management, including quarterly updates on security hot topics, threat intelligence, incidents (if any) and the status of the cybersecurity program to the Chief Executive Officer and the broader executive leadership team. In addition to real time notification to the ISSC of privacy and security incidents, the ISSC and QVC have a bi-monthly meeting to discuss incidents, incident trends, developments in laws and regulations, and other privacy and cybersecurity hot topics, as applicable.

companyName: QVC INC

ticker: QVCD


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, product security, operations and cybersecurity threat detection and response. The CISO has 32 years of experience serving in various information technology roles. The information security organization manages and continually enhances an enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system and product resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We also strive to maintain ISO certification and assurance reporting under AICPA SOC2 for several of our systems and products. We have adopted a risk-based management process to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our information security organization also have a role in our cybersecurity defenses and are required to receive periodic cybersecurity training, which we believe improves our overall cybersecurity posture.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: We use third-party service providers to assist us in identifying, assessing, and managing certain material risks from cybersecurity threats, including for example, data protection and privacy compliance professional service providers, external legal counsel, cybersecurity software providers, penetration testing firms, and managed cybersecurity service providers.

companyName: CHIMERIX INC


text: In addition, regular ongoing cybersecurity threat risk assessments are performed throughout the year and reported to our officers and Board of Directors by our CCO no less than quarterly. Cybersecurity risks are assessed in general as part of the overall enterprise risk management for us, but also specifically between the ISP and our Adviser and Administrator in monitoring and determining not only the risks but also in assessing corresponding processes and procedures to mitigate those risks appropriately. Additionally, third party business applications are also incorporated in these risk assessments.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: The Chief Information Officer ("CIO") is the management position with primary oversight responsibility for the team responsible for the development, operation, and maintenance of our information security program. Pursuant to the Company's written IRP, the CIO is a member of the executive incident response team and severity classifications in the IRP are used to escalate matters to the executive incident response team. The CIO has more than 20 years of comprehensive IT experience across a breadth of technologies. The CIO is also a member of the Company's executive leadership team and meets regularly with the CEO, CFO and other members of the executive leadership team. The CIO reports directly to the Board, at least twice a year, on cybersecurity risks and strategy and attends Board meetings to be available to discuss cybersecurity matters with the Board. Oversight of the information security program at the Board level sits with the Audit Committee. The CIO reports to the Audit Committee on risks and internal controls related to cybersecurity and information technology and systems at least annually and attends quarterly Committee meetings to be available to discuss such matters with the Audit Committee.

companyName: LA-Z-BOY INC

ticker: LZB


text: The Company maintains a central Risk Register as part of its cybersecurity risk management framework. This Risk Register identifies risks and their potential impacts, mitigation strategies, and ongoing monitoring efforts.

companyName: DAILY JOURNAL CORP

ticker: DJCO


text: The CTO and CEO are required to engage the cybersecurity incident review if a cyber incident has materially affected, or is reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. The CTO and CEO are responsible for performing a materiality assessment, and overseeing the public disclosure of material cybersecurity matters, as appropriate.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: Impact of Cybersecurity Risks As of the date of this filing, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Part I, Item 1A, Risk Factors, Risks Related to Our Organizational Structure" for more information regarding cybersecurity risks.

companyName: IPC Alternative Real Estate Income Trust, Inc.


text: Role of our Management Team Our Chief Information and Compliance Officer is responsible for the day-to-day management of our cybersecurity risks and for recommending the strategies and technologies used by the organization to collect, integrate and analyze business information to support the organization's strategic decisions. He is supported by a cross-disciplinary team from the Company's accounting, legal and risk oversight functions and our internal audit group. This incident response team meets quarterly and as needed to review the Company's cybersecurity risk management initiatives and progress and cybersecurity metrics. On an annual basis, the incident response team coordinates a cybersecurity risk assessment. In the event of a suspected cybersecurity incident, the team will coordinate the Company's evaluation, subsequent response and any updates to the cybersecurity risk management program with executive management and the cyber subcommittee.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Through established governance structures, including our problem and incident management process and cyber incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our board-level Technology and Information Security Subcommittee reporting to our board-level Risk and Compliance Committee, or to the full Board, as appropriate.

companyName: AMERICAN NATIONAL BANKSHARES INC.


text: We impose security requirements upon our suppliers, including maintaining an effective security management program, abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident.

companyName: ROGERS CORP

ticker: ROG


text: Cybersecurity tabletop exercises and event simulations are conducted with management, incorporating external resources and advisors, to test our ability and preparedness to respond to cyber threats and identify any areas of weakness. The program, standard operating procedures and supporting tools for determining thresholds for materiality are incorporated as a key component to the incident response program and related activities.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our Board of Directors has overall oversight responsibility for our risk management and has delegated oversight of cybersecurity risks to our Audit Committee, including overseeing the actions management has taken to identify, monitor, and control such exposure. Our Audit Committee reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks on a quarterly basis. As part of our continued investment in developing our overall enterprise risk management program, our Audit Committee receives reports and presentations from management which address a range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and technological trends. Our Audit Committee reports to our Board of Directors at least annually on cybersecurity matters.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: Members of our audit committee and board of directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters.

companyName: Profound Medical Corp.

ticker: PROF


text: Reporting to the Board of Directors The CISO and Chief Information Officer ("CIO") regularly update the Board's Risk Management Committee on cybersecurity risks that the Company faces and the risk mitigation strategies that the Company employs to respond to those risks, with meetings generally occurring quarterly.

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: The Adviser takes a risk-based approach to cybersecurity and has implemented cybersecurity policies and procedures throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the Adviser deploys specialized security technologies and operational controls including, but not limited to, firewalls, anti-virus systems, passwords, restricted access, and electronic surveillance/monitoring. The Adviser also conducts regular internal penetration testing to assess information technology vulnerabilities, utilizes third-party technology solutions for real-time vulnerability management and engages a third-party consultant to conduct a cybersecurity assessment and preparedness analysis annually. In addition, the ISWG meets quarterly and on an as-needed basis.

companyName: Silver Point Specialty Lending Fund


text: To ensure that members of Registrant's Board are informed of material cyber-attacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyber-attack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: The Company's Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board. Our CISO has over fifteen years of IT and cybersecurity leadership experience and has various industry related degrees and certifications, including a master's in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications. The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program. That program is utilized in making decisions with respect to Company priorities, resource allocations and oversight structures. The Board is assisted by the Audit Committee, which regularly reviews our cybersecurity program with the CISO and other members of management and reports back to the Board. The Audit Committee receives reports from the CISO on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.

companyName: CINTAS CORP

ticker: CTAS


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: Our business operations rely on the secure collection, storage, transmission, and other processing of confidential and sensitive data through our information systems. In addition, as a financial services company, we are subject to extensive regulatory compliance requirements concerning the treatment of such data. To ensure the security, confidentiality, integrity, and availability of our information systems, we have implemented a comprehensive cybersecurity risk management program (the "Information Security Program"). The program is designed to identify, assess, manage, and mitigate risks and secure Company and customer information against threats. This is achieved through monitoring, threat management strategies, policies and procedures, security awareness, oversight, and governance.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: We have implemented mechanisms to monitor and manage cybersecurity threats and incidents, including utilization of tools for continuous monitoring of our IT environment to detect and mitigate threats, a fundamental plan for responding to cyber incidents and training for employees to recognize and report potential cybersecurity incidents and to foster a culture of cybersecurity awareness and vigilance. Our Chief Administrative Officer, along with a third-party service provider, are responsible for operational oversight of our cybersecurity strategy and policies. Any identified cybersecurity incident is reported to our Chief Administrative Officer who evaluates the severity of the incident. Based on this assessment, further steps are taken involving other members of management and, depending on the severity, the audit committee and the Board of Directors. We believe this structured approach allows us to effectively manage and mitigate cybersecurity risks, safeguarding our systems and data against various digital threats. Additionally, our proactive stance is supported by cybersecurity insurance, which further reinforces our preparedness against potential cyber threats.

companyName: Processa Pharmaceuticals, Inc.

ticker: PCSA


text: Our VP of Information Technology and Information Security ("VP of IT/IS"), who reports to our Chief Executive Officer, manages our cybersecurity and information security risk assessment and mitigation process. We have established an internal IT security committee that includes our VP of IT/IS and other members of our information security, information technology, internal audit/compliance, and finance teams, to instill a thoughtful security culture across Fabrinet. Our employees are made aware of our cybersecurity policies through mandatory trainings during onboarding and on an annual basis. We also engage and consult with third parties in connection with our risk assessment processes, including advisors, consultants and auditors. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Fabrinet

ticker: FN


text: Role of the Helios Board of Directors The ESG Committee addresses risks related to the global enterprise, including material risks facing the businesses, risks the Company may face in the future, measures that management has employed to address those risks and other information relating to how risk analysis is incorporated into the Company's corporate strategy and day-to-day business operations. As part of this oversight function, the ESG Committee is responsible for overseeing cybersecurity-related risks. The ESG Committee includes cybersecurity topics in its quarterly updates to the full Board of Directors, which provides further oversight over our cybersecurity-related risks and the Company's strategies to address such risks. Reports to the Board of Directors and ESG Committee include comprehensive updates on the current cybersecurity risk landscape, the status of ongoing mitigation efforts, and emerging incident trends. Additionally, these reports cover updates on third-party risk assessments, progress on cybersecurity initiatives such as technology upgrades, regulatory compliance measures, and employee training programs.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our cybersecurity program includes robust tools and processes designed to detect breaches and other cybersecurity incidents as well as unauthorized access and unusual network activity. We utilize a security operations program with 24/7 monitoring by both internal and third parties that includes a variety of detection tools. We also utilize backstop detection and preventative measures, like malware detection.

companyName: Anywhere Real Estate Group LLC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Chief Information Officer, who reports to the CFO. Our Chief Information Officer has nearly 25 years of industry experience and has been with us since 2008. Our Global Head of Cybersecurity has over 25 years of cybersecurity and privacy experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: Our cybersecurity risk management strategy is a key component and has been integrated into our overall enterprise risk management program and has been designed based on established industry frameworks and standards, including those developed by the National Institute of Standards and Technology and the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program. Although this does not mean that we currently meet all of any particular technical standards, specifications, or requirements, we use these frameworks, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: Rocket Lab Corp

ticker: RKLB


text: For the evaluation of our security controls, ISG engages third-parties services to conduct penetration testing, independent audits or provide consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of our security controls. We also share and receive threat intelligence which we utilize to bolster defenses against active threats. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across our security domain.

companyName: Information Services Group Inc.

ticker: III


text: The Company established a governance committee to provide governance and oversight of security and compliance related activities for security and IT in support of their effective and efficient management of risks, strategies, and operational imperatives for the Company. The committee is chaired by our Chief Information Officer and the membership includes a cross-functional team of executives from IT/cybersecurity, operations, customer service, commercial, risk and insurance, finance, and the legal department. The committee is structured to cultivate collaboration across the enterprise and to align and prioritize resources with our strategic plan.

companyName: ONE Gas, Inc.

ticker: OGS


text: The cybersecurity risk management program and related operations and processes are directed by WisdomTree Inc.'s CIO. Currently, the CIO role is held by an individual who has been in the role for over nine years, has over 22 years of cybersecurity, information technology and systems engineering experience, and has advanced training in the field of technology.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management program which includes cybersecurity and data privacy training and policies and procedures designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.

companyName: TETRA TECH INC

ticker: TTEK


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Our cybersecurity program is aligned with notable control frameworks such as the NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) 27001.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Adviser and Administrator, on our behalf, and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: STAAR utilizes internal personnel and external service providers to support the Company's cybersecurity efforts. Our Chief Information Officer (CIO) leads a team of IS professionals who have primary responsibility for our overall cybersecurity risk management program and supervises both our internal personnel and our retained external cybersecurity consultants. Our CIO has over two decades of experience, including experience building IT and IS functions and teams, as well as cybersecurity programs. Our CIO holds an M.B.A. in management, has an audit and accounting background, and serves on the SoCalCIO Board, a Southern California organization developing and supporting local CIOs. The CIO and IS team collaborate closely with STAAR's legal, privacy, and internal audit functions to address cybersecurity and data privacy risks. The Company's internal IS and data privacy specialists have certifications from various organizations, including ISC2 (Certified Information Security Systems Professional or CISSP), Global Information Assurance (GIAC), the Computing Technology Industry Association (CompTIA) and International Association of Privacy Professionals (IAPP).

companyName: STAAR SURGICAL CO

ticker: STAA


text: Our business continuity management program is designed to ensure that necessary resources are in place to protect us from potential loss during a disruption, which includes the unavailability of IT assets due to unintentional events like fire, power loss, and other technical incidents, such as hardware failures.

companyName: Federal Home Loan Bank of Des Moines


text: We, like any technology company operating in the current environment, have experienced cybersecurity incidents in the past. However, as of the date of filing this Annual Report on Form 10-K, we have not previously experienced any cybersecurity incidents that were determined to be material. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Yext, Inc.

ticker: YEXT


text: We continually seek to update our cybersecurity posture, encompassing end-user awareness training, layered defenses, critical asset identification and protection, enhanced monitoring and alerting. We engage with third-party experts to evaluate the efficacy of our security measures which includes network penetration testing. We also regularly evaluate cybersecurity risks associated with our use of third-party service providers, conducting an annual review of hosted applications and assessing their cybersecurity readiness. In addition, we annually obtain Service Organization Control ("SOC") reports on the suitability and operating effectiveness of the service providers' controls, known as a SOC 1 Type 2 Report. The report is prepared by an independent service auditor. We review such reports to confirm the existence of effective security controls over unauthorized access at third party service providers.

companyName: Bowhead Specialty Holdings Inc.

ticker: BOW


text: Our board of directors considers cybersecurity risk as part of its enterprise risk management oversight function. Our management team is responsible for assessing and managing risks from cybersecurity threats. Because of the small size of our company, we do not have personnel dedicated to information technology and cybersecurity matters.

companyName: Strategic Environmental & Energy Resources, Inc.

ticker: SENR


text: Our cybersecurity risk management program primarily leverages the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). We routinely assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our risk management program also assesses third party risks to attempt to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. As part of our cybersecurity risk management program, we also gather Threat Intelligence through our multiple security partners and tools. This intelligence (including tactics, techniques and procedures used by cyber criminals) provides insights into potential threats and vulnerabilities, which helps us to defend against cyber-attacks.

companyName: APi Group Corp

ticker: APG