text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DCSI. Our DCSI has over 20 years of experience as a security professional, has a CISSP certification, and has completed the Carnegie Melon Insider Risk Management Program.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: The board of directors oversees the Company's practice for assessing, identifying and managing material risks from cybersecurity threats. The Audit Committee, consisting of all of the board's independent directors with one member holding the CERT Certificate in Cybersecurity Oversight, reviews and discusses with management and the independent auditor on the Company's significant financial risk exposures for matters related to cybersecurity risk, including the steps management has taken to monitor and manage such exposures.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT

secItem: Item 1C


text: Cybersecurity is a formal component of our overall risk management program, and our management, including our Chief Information Officer, regularly update the Audit Committee of the Board of Directors on the status of our cybersecurity program. In the event that management identifies significant cybersecurity risk exposures, it will present such exposures to the Audit Committee, which oversees the actions, security, and risk mitigation efforts taken across our cybersecurity framework. With this input from management, the Audit Committee evaluates our cybersecurity risks and the responses implemented to prevent and/or mitigate any such risks.

companyName: Ryerson Holding Corp

ticker: RYZ


text: Our IT personnel, in coordination with our executive management team, works collaboratively across the company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. Through ongoing communications with our entire employee basis and appropriate third-party contractors, as well as the management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report threats and incidents to the Audit Committee, as needed.

companyName: Velo3D, Inc.

ticker: VELO


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Risks from cybersecurity threats are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Our management team, including the Head of Risk Management and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: Safehold Inc.

ticker: SAFE


text: We maintain a risk-based, defense-in-depth approach to cybersecurity and data protection. We assess industry best practices and standards and endeavor to leverage them in our efforts to manage cybersecurity risk. We dedicate resources and apply security controls where we believe they would be most effective to predict, prevent, detect and respond to potential security threats to our highest value information assets, which we consider to be point-of-sale systems, financial systems and confidential, personal and private customer and employee information. We use multiple safeguards to protect our internal networks and systems, including, among others, firewalls, email protection and web filtering, endpoint detection and response software, controlled access to our data and systems, segmenting our card data environment, vulnerability management and patching, and performing regular penetration testing. A risk assessment, based on the National Institute of Standards and Technology Framework, is conducted and maintained throughout the system development lifecycle and is reviewed at least annually.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Our Executive Vice President and Chief Digital Officer is our executive team member responsible for our cybersecurity program and our Chief Information Security Officer ("CISO") leads the program. Together they provide updates to the ERM Committee and present to our Audit Committee at least annually. In addition, we have established an incident response team comprised of a cross-functional group of team members who manage our response to any cybersecurity incident pursuant to our incident response plan.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: Our CIO and our CISO report to the Audit Committee and to the full Board about cybersecurity threat risks and other cybersecurity related matters. In addition, under our escalation policy, following the detection of a potentially significant cybersecurity incident, our CISO and our General Counsel escalate to the Executive Officers, core members of the Disclosure Committee, Chair of the Audit Committee and the Chair of the Board initially, and then to the entire Board, as appropriate.

companyName: Fortive Corp

ticker: FTV


text: The Centuri Cybersecurity Program operates under the auspices of our Board. Management oversight is delegated to our VP of Information Technology, who has over 25 years of industry experience and reports directly to our Chief Legal & Administrative Officer. Operational responsibility for daily cybersecurity activities is managed by our Cybersecurity Manager, who has 25 years of industry experience in information technology, with 15 years focusing on information technology ("IT") risk, security, and compliance. Our Cybersecurity Manager is accountable for the assessment, monitoring, reporting, and mitigation of our cybersecurity risks. Our Cybersecurity Manager is also responsible for identifying and documenting cybersecurity risks, identifying remediation options and activities, ensuring remediation implementation, and providing on-going monitoring for changes in the Company's overarching risk profile. On a quarterly basis, our VP of Information Technology provides a formal cybersecurity update to our Chief Legal & Administrative Officer, which highlights key metrics, events, efforts, risks, and risk mitigation activities. Our VP of Information Technology is also responsible for communicating with our Board regarding cybersecurity risks, providing our Board with regular cybersecurity briefings that facilitate the alignment and prioritization of efforts on the part of our cybersecurity team as instructed by executive leadership.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Wiley, including our business strategy, results of operations or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors."

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Index to Financial Statements Senior Vice President of Information Technology and our Senior Director of Information Security include updates on cybersecurity threats we face, the status of projects to strengthen our information security systems, assessments of the cybersecurity program, and the emerging threat landscape, as well as the results of any third-party assessments conducted. Our Senior Vice President of Information Technology holds an undergraduate degree in Technology Management (Manufacturing Systems), and has served in various roles in information technology for over 20 years and within Mueller for over five years. Our Senior Director of Information Security holds an undergraduate degree in Computer Engineering and has served in various roles in information security and engineering within Mueller for over 21 years.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: The information security function works to identify and assess risks from cybersecurity threats by monitoring and evaluating internal and external cybersecurity threats including, for example using automated and manual tools and controls in certain environments and systems, overseeing internal and external audits, conducting vulnerability assessments and penetration tests in certain environments and systems, and facilitating tabletop incident response exercises. Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program.

companyName: EVERBRIDGE, INC.


text: As discussed in more detail under the heading "Governance," the board of directors' oversight of cybersecurity risk management is supported by the Audit Committee of the board of directors, or the Audit Committee, our Chief Information Officer, or CIO, other members of management and relevant management committees as appropriate.

companyName: VERACYTE, INC.

ticker: VCYT


text: The audit committee receives an annual update from our cybersecurity function concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. In addition, they receive timely notifications of significant cybersecurity incidences based on our cybersecurity response plan. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. We have developed contracting processes and terms to gain commitments from certain vendors and third-party service providers to adhere to appropriate security practices and outline specific security requirements and expectations, including compliance with industry standards, applicable laws and regulations, and our internal security policies. We regularly evaluate and assess vendor risk levels based on a variety of factors, such as the nature of shared data, potential impact to business continuity, and vendors' security posture. Our processes extend beyond initial evaluations to include proactive monitoring and routine oversight.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Our use of third parties to conduct our business is significant. We use suppliers, CROs, CDMOs, and other service providers. A cybersecurity incident at third party could materially adversely impact us. In order to mitigate this risk, we assess third party cybersecurity controls prior to engaging third parties and include security and privacy addendums to our contracts where applicable. We also require that third party service providers or partners report cybersecurity incidents to us so that we can assess the impact of the incident on us.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: Another key element of our cybersecurity risk management program is our use of processes and technologies to create information security safeguards and controls, and target specific users or business needs. Our processes and technologies include firewalls, email security software and encryption, endpoint detection and response, access controls, backup and recovery procedures, system patches and updates, vulnerability scanning, penetration testing by third party vendors, incident response procedures, and internal and external audits of our information systems.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our CWG, at our regular meetings, at least once a year or as needed. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our key third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CWG.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: We also have response and recovery protocols in place to address potential cyberattacks, including a disaster recovery plan and an incident response plan that includes defined incident severities and response matrices. These plans are reviewed and updated at least annually and we maintain third-party cybersecurity insurance. We did not have any material cybersecurity incidents during the fiscal years covered by this report. For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.

companyName: Meritage Homes CORP

ticker: MTH


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and reviews detailed risk assessments.

companyName: Federal Home Loan Bank of Des Moines


text: Our business is highly dependent on the processing and storage of significant amounts of data, and we have invested and will continue to invest in measures to secure this data. We have implemented and maintain a comprehensive information security program consisting of policies, procedures, and technology designed to maintain the privacy, security and integrity of our data, intellectual property, confidential information, systems and networks. Our information security program is informed by externally established sets of standards, such as those of the National Institute of Standards and Technology and the Center for Internet Security. Among other things, the program includes controls designed to limit and monitor access to our systems, networks and data, prevent inappropriate or unauthorized access or modification, and monitor for threats or vulnerability. We maintain disaster recovery solutions and implement enhancements as necessary and also use technologies that assist in preventing theft and abuse of credentials and sensitive data. We also have third parties perform penetration tests as well as security assessments of mobile applications. Our information security program also includes third-party risk management processes that help us oversee and identify risks from our use of third-party service providers. Additionally, we focus our efforts on education and training for employees regarding cybersecurity and implementing security controls for contractors. We also engage consultants to conduct cybersecurity assessments and preparedness analysis. We primarily conduct our business in the United States and are expanding internationally in various other countries. Conducting expanded international operations subjects us to additional risks, including our exposure to cybersecurity incidents.

companyName: Alarm.com Holdings, Inc.

ticker: ALRM


text: As part of our risk management strategy, we maintain an insurance policy to cover cybersecurity incidents.

companyName: AMERICAN TOWER CORP /MA/

ticker: AMT


text: The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee then updates the Board of Trustees following management's update. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.

companyName: LXP Industrial Trust

ticker: LXP


text: Effective September 1, 2025, the Company transitioned cybersecurity responsibilities to a new CISO. The new CISO has over 20 years of experience leading large-scale security programs protecting critical infrastructure and sensitive data, modernizing digital identity systems, and driving cultural transformation within security teams in the federal, healthcare, and global manufacturing sectors.

companyName: JABIL INC

ticker: JBL


text: We implement and maintain various technical, physical, and organizational measures, processes, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include amongst others data encryption, risk assessments, network security and access controls, physical security, asset management, and systems monitoring. In addition, to oversee and identify any risks associated with our use of third-party service providers, we review Service Organization Controls reports of such third-party service providers when onboarding the provider and annually thereafter.

companyName: Loop Industries, Inc.

ticker: LOOP


text: Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. Third-Party Risk Management.

companyName: Apollo Infrastructure Co LLC


text: We have implemented cybersecurity policies and standards based on leading industry frameworks, including the ISO 27001 standard and the National Institute of Standards and Technology Cybersecurity Framework, and regularly assess our policies and practices, including tabletop exercises, aimed at mitigating cybersecurity risks. In the event of a cybersecurity incident, we follow our Enterprise Information Security Incident Response Plan (the "IRP"), which outlines steps from incident detection to assessment, response, mitigation, recovery and notification, including to key functional areas such as Global Risk Management, Corporate Law, Privacy and Compliance, senior leadership and the Board, as appropriate. The IRP includes quantitative and qualitative incident assessment guidance and promotes engagement with multidisciplinary teams across the enterprise to facilitate real-time information sharing during a cybersecurity incident.

companyName: ASSURANT, INC.

ticker: AIZ


text: Ongoing Mitigation Efforts The Company has implemented a number of security measures designed to protect its systems and data, including firewalls, antivirus and malware detection tools, patches, log monitors, routine back-ups, system audits, system hardening, penetration testing and privileged access session management. In addition, the Company has continued its efforts to migrate its platforms to cloud-based computing, which is designed to further strengthen its security posture. The Company has focused on its incident response procedures and retained a leading incident response provider. The Company has also recently strengthened its disaster recovery procedures. The Company's solutions incorporate cybersecurity features that are routinely analyzed. In addition, the Company maintains insurance that includes coverage for cyber-attacks, which coverage is discussed and reviewed with the Audit Committee annually.

companyName: OMNICELL, INC.

ticker: OMCL


text: To further bolster the Board's understanding of cybersecurity issues, management facilitates ongoing educational opportunities. For instance, in December 2023, the Board engaged in a discussion with cybersecurity experts on building resilience to cyber risk. These educational initiatives empower Board members to make informed decisions and actively contribute to the oversight of cybersecurity governance.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: Our cybersecurity protections include physical, administrative and technical safeguards that cover both our information systems (also referred to herein as "information technology" or "IT" systems) and the people with access to our IT systems. We develop, maintain, test and periodically update detailed plans and procedures that are designed to help us prevent, and if necessary, timely and effectively respond to, cybersecurity incidents, which provide for the appropriate Company personnel and management to be involved depending on the type and severity of the incident.

companyName: Sylvamo Corp

ticker: SLVM


text: Third-Party Oversight We maintain processes in place to oversee, identify, and mitigate risks from cybersecurity threats related to third-party service providers, including conducting thorough security assessments of third-party service providers before onboarding. We also maintain ongoing compliance monitoring to oversee evolving cybersecurity risks. We generally include minimum information security requirements in our agreements with third-party service providers to address cybersecurity risks.

companyName: Hilton Grand Vacations Inc.

ticker: HGV


text: Management and Strategy have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: Applied UV, Inc.

ticker: AUVI


text: Oversee Third-party Risk. We monitor risks associated with our vendors, which include processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.

companyName: Knife River Corp

ticker: KNF


text: Company employs internal resources and third-party service providers to manage, operate and administer our day-to-day operations, business and affairs, subject to the direction and supervision of the Board. The Board recognizes the critical importance of maintaining the trust and confidence of our business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. The Company and its management are committed to protecting the confidentiality of all non-public information related to the Company's clients, shareholders and their personnel.

companyName: SHF Holdings, Inc.

ticker: SHFS


text: As of the fiscal year ending December 31, 2023, there have been no identified cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: INNODATA INC

ticker: INOD


text: As a Company selling some products and performing engineering services for defense applications, we may be the target of cyber-attacks from a variety of threat actors. Cybersecurity threats include attacks on, or other attempts to infiltrate, our information technology (IT) infrastructure and the IT infrastructure of our customers, suppliers, subcontractors and other third parties, attempting to gain unauthorized access to our confidential or other proprietary information, classified information, or information relating to our employees, customers, and other third parties, or to disrupt our systems or the systems of our customers, suppliers, subcontractors, and other third parties. Cybersecurity threats also include attempts to infiltrate our products or services, including attacks targeting the security, confidentiality, integrity and/or availability of the hardware, software and information installed, stored or transmitted in our products, including after the purchase of those products and when they are incorporated into third-party products, facilities, or infrastructure.

companyName: Vuzix Corp

ticker: VUZI


text: Our Chief Executive Officer, Chief Financial Officer and Chief Legal Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Additionally, they are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: ARS Pharmaceuticals, Inc.

ticker: SPRY


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President Finance. The Vice President Finance is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of the cybersecurity risk management and strategy processes described above, including our incident response plan. Together with the General Counsel, information technology staff and outside consultants that comprise our cybersecurity management team, we collectively possess significant experience in evaluating, managing, and mitigating security and other risks, including cybersecurity risks.

companyName: McEwen Inc.

ticker: MUX


text: This information security program is a key part of the Company's overall risk management system, which is administered by the Director of Information Security. The program includes administrative, technical and physical safeguards to help protect the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of the Company's businesses and geographic locations.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. For example, CALEA requires broadband providers to affirmatively secure their networks from unlawful access to or interceptions of communications. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.

companyName: Cable One, Inc.

ticker: CABO


text: We have not historically been materially impacted by risks from cybersecurity threats and, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, the breadth and scope of cybersecurity threats have grown over time and our systems and networks may be the target of increasingly sophisticated cyberattacks. For more information on our cybersecurity risks and their potential impact to our business, see Item 1A, " Risk Factors-Risks related to Our Business and Industry - We may experience security breaches and cyber threats " and Item 1A, " Risk Factors-Risks related to Our Business and Industry - Our business could be adversely affected if our data privacy and security practices are not adequate, or perceived as being inadequate, to prevent data breaches, or by the application of data privacy and security laws generally."

companyName: Super League Enterprise, Inc.

ticker: SLE


text: Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.

companyName: Enova International, Inc.

ticker: ENVA


text: Our process includes assessing, mitigating, and managing risk in three categories: cybersecurity or technical risk, vendor risk, and compliance and regulatory risk. To support those risk management categories, we partner with third parties in the implementation of tooling to help us decrease cyber risks and ensure compliance within Allegiant and with third parties. We verify third-party compliance, such as suppliers and business partners, by aligning with several standards. For example, we subject our IT suppliers to the Sarbanes-Oxley (SOX) and payment card industry (PCI) compliance standards where applicable.

companyName: Allegiant Travel CO

ticker: ALGT


text: Our Interim Chief Executive/Chief Financial Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: We engaged and used the advice of a third-party consultant to help us assess and identify risks from cybersecurity threats, including the threat of a cybersecurity incident, and manage our risk assessment program. Among other things, these providers have recommended periodic evaluations of the work stations.

companyName: SATIVUS TECH CORP.

ticker: SATT


text: Our CISO, in conjunction with other digital & technology leaders, implement and oversee processes for the regular monitoring of our information systems. This includes escalation protocols to identify, assess and escalate cyber incidents. We also deploy security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, our CISO is equipped with a defined incident response plan. Our CISO meets quarterly with our risk management team and provides quarterly reports to the Audit Committee.

companyName: CBRE GROUP, INC.

ticker: CBRE


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to confidential, proprietary, personal, or employee data, or to our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits or audits for System and Organization Controls (SOC) compliance.

companyName: Azenta, Inc.

ticker: AZTA


text: The protection of our clients' data, our brand, and our systems is of utmost importance. We are subject to governmental regulation and other legal obligations, particularly related to privacy, data protection and information security. We have developed comprehensive cybersecurity and data privacy programs across our employee groups and systems, building a culture of cybersecurity and data privacy awareness throughout the organization. In 2024, we achieved both SOC2 Type 1 and TX-Ramp certifications, reflecting our commitment to supporting our clients by aligning our controls and processes with the System and Organization Controls (SOC) compliance framework established by the American Institute of Certified Public Accountants (AICPA).

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: Cybersecurity risks and activities are reported quarterly to the Information Technology Steering Committee and the Enterprise Risk Management Committee. The Bank's chief risk officer and interim chief information officer are part of the Information Technology Steering and Enterprise Risk Management Committees. The Bank's chief risk officer has over 15 years of experience managing the supervision of Information Security risks for financial institutions. The Bank's interim chief information officer has over 30 years of experience managing technology.

companyName: Sterling Bancorp, Inc.


text: Our risk assessment and mitigation program is centered on three key components: • Identification of risks, which involves input from different groups across the Company; • Evaluation of the likelihood of the risks manifesting, the severity of the potential consequences and prioritization of different risk items based on, among other things, importance to the business and cost/benefit analysis to fully address; and • Execution – establishment of a program to address.

companyName: ORRSTOWN FINANCIAL SERVICES INC

ticker: ORRF


text: Our management team supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Singular Genomics Systems, Inc.


text: Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity threats when they occur.

companyName: LEXICON PHARMACEUTICALS, INC.

ticker: LXRX


text: At a management level, our Program is led by our CISO, who reports to the Company's Chief Digital and Technology Officer. Our CISO has expertise in cybersecurity risk management through, among other things, his past service in information security roles at the Company, prior IT and security leadership positions at other public companies, and certain technology and information security matters certifications. Additionally, we have a formal data privacy management committee made up of privacy professionals, operational experts and specialist legal counsel which is overseen by our Chief Legal Officer.

companyName: YUM BRANDS INC

ticker: YUM


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K under the heading "A breach of information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: Reviewing the IRP at least annually, or whenever there is a material change in The Company's business practices that may reasonably affect its cyber incident response procedures.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: Ibotta, Inc.

ticker: IBTA


text: As part of our cybersecurity risk management system, our incident management process tracks and logs privacy and cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K) across Weave, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions. Our management apprises Weave's independent public accounting firm of matters and any relevant developments and also provides regular updates on cybersecurity to our Audit Committee and Board of Directors.

companyName: Weave Communications, Inc.

ticker: WEAV


text: As part of our overall risk management system, we assess our safeguards in collaboration with various functional teams, including Information Security, Engineering, Risk and Legal, and train our employees on these safeguards. Security is a shared responsibility, and personnel at all levels and teams are required to receive periodic security awareness training to ensure that they understand our cybersecurity policies and their roles in protecting our information systems or any information residing therein.

companyName: Upstart Holdings, Inc.

ticker: UPST


text: Our teams also rely on third-party diagnostic tools and periodic audits to ensure that our program is performing as designed and in-line with applicable standards. Our Chief Information Officer oversees a security committee made up of professionals on our corporate security, and other information technology teams to review the results of these audits and recommend improvements. Prior to engaging a third party to provide services, our information technology team performs a risk assessment to determine the level of review of the vendor needed based on the nature of the services to be provided and type of information that may be shared. The resulting vendor review may include requiring the vendor to provide the results of external audits. We continue to monitor our vendors throughout their engagements with us to ensure they have complied with their contractual obligations, including service level agreements and other contractual standards.

companyName: National CineMedia, Inc.

ticker: NCMI


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings " We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results," "If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected," and "If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities " in our "Risk Factors" included in Part I, Item 1A of this report, which disclosures are incorporated by reference herein.

companyName: Workday, Inc.

ticker: WDAY


text: Under our cybersecurity governance framework, our Board and Risk Committee are primarily responsible for overseeing and governing the development, implementation and maintenance of our TRIS program, with our Board designating our Risk Committee to provide oversight and governance of technology and cybersecurity risks. Our Board receives an update on cybersecurity at least once a year from our CISO or their designee. Our Risk Committee receives reports on cybersecurity at least twice a year, including in at least one joint meeting with our Audit and Compliance Committee, and our Board and these committees all receive ad hoc updates as needed. In addition, our Risk Committee annually approves our TRIS program.

companyName: AMERICAN EXPRESS CO

ticker: AXP


text: Our management team, including the Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture, are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes knowledge related to information technology, cybersecurity and incidence response, risk management, control analysis, and corporate governance. Our Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture have extensive experience in the management of cybersecurity risk management programs, having each served in various leadership roles in information technology and information security for over 10 years. We also have experienced data security, risk, and compliance professionals reporting to our Executive Vice President of Technology and Vice President of IT Infrastructure and Architecture. In addition to our in-house cybersecurity capabilities, we also engage with external assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Traeger, Inc.

ticker: COOK


text: Governance and Oversight of Cybersecurity Risks We have developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by our Cyber Risk Operating Committee (the "C-ROC"), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management. The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of management, our Audit Committee or our Board. The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior management and the Audit Committee or full Board, as appropriate. This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Our board of directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, business partners, stockholders, and employees. Our audit committee is involved in direct oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Redfin Corp


text: The Chief Security Officer ("CSO") is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the CFO. The CSO also makes recommendations to the Company's executive management regarding the Company's cybersecurity risk mitigation priorities. The Company's current CSO has served in that role for Zebra since 2018. He is a recognized leader in the field of cybersecurity with over 15 years of global executive cybersecurity experience.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Risk management and strategy We, through our third-party provider that manages our information technology systems and networks, maintain policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Chief Financial Officer, who manages the Company's overall risk assessment and mitigation process. In addition to monitoring cybersecurity threats to the Company's information systems, the Company's risk management practices are intended to help monitor, mitigate and prevent cybersecurity risks from external sources. We operate as a virtual company and maintain vital information, including financial and payroll information, on servers owned and maintained by our vendors. As such, we rely on the internal controls of our third party vendors to protect our vital information. We obtain and review reports on the internal controls of our vendors on an annual basis to ensure that we believe their cybersecurity procedures are adequate and to confirm that there have been no data breaches affecting our information.

companyName: Xenetic Biosciences, Inc.

ticker: XBIO


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and administering our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity governance administration, third-party risk management, and business resilience to ensure confidentiality, availability, and integrity of technological assets, as well as maintenance of policies, procedures, and standards. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Chief Information Security Officer and Chief Risk Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. Our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: PROVIDENT FINANCIAL SERVICES INC

ticker: PFS


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures or cyber incidents could harm the Company's business" in this Annual Report. As of the date of this Annual Report, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to have a material adverse effect on us, our business strategy, results of operations, or financial condition.

companyName: CAVCO INDUSTRIES, INC.

ticker: CVCO


text: Information security and cybersecurity incidents undergo thorough review and assessment by the Information Security Subdirector, in collaboration with cybersecurity specialists and experts. Those incidents classified as material are reported to the Technology and Information Security Director, relevant Business Directors, and the Board's Audit Committee, with additional review by AMC's Productivity and Risk Committees.. Simultaneously, these processes allow cybersecurity incidents classified as "material" to be promptly disclosed to the SEC in a Form 8-K report within 4 business days of the Company's determination that such incident is in fact a "material" incident.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: At Kinetik, we believe that the recognition and reporting of cybersecurity threats by every employee and contractor plays a key role in protecting and securing our network. We have mandatory annual training for our employees and contractors on security awareness annually, using a library of cybersecurity training modules. We deploy quarterly simulated phishing emails to all system users in an effort to gauge their cybersecurity awareness.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: As part of our cybersecurity risk management program, we also implement risk-based processes to oversee and evaluate third-party vendors. Pursuant to these processes, as appropriate, we conduct security assessments of third-party vendors prior to onboarding, as well as ongoing monitoring of critical third-party vendors.

companyName: IROBOT CORP

ticker: IRBTQ


text: Cyber threats are considered one of the most significant risks facing financial institutions. Since our company is externally managed, we rely upon the operational and investment risk oversight functions of our Adviser and its affiliates. To mitigate risk from cyber threats, our Adviser has a designated Global Chief Security Officer ("GCSO") who leads its global security department, which is responsible for identifying, assessing and managing cybersecurity threats. The GCSO has experience in the public and private sectors, specializing in security, investigations and incident response. The global security department oversees, among other things, the following groups across Invesco: Information Security, Strategic Intelligence, Corporate Security, Business Continuity, Crisis Management, Global Privacy Office, Business Security, Projects and Strategy This structure supports a more comprehensive, holistic approach to keeping our and Invesco clients, employees and critical assets safe, upholding privacy rights, and enabling a secure and resilient business.

companyName: Invesco Real Estate Income Trust Inc.


text: Incident Management Plan Our cybersecurity incident management plan comprises the following six-step process: • The Service Center's Chief Information Officer and Director of Information Security lead its Information Security Office (ISO) team in the development, documentation, review and testing of security procedures and incident management procedures. Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis. • The Service Center's Chief Information Officer and Director of Information Security work with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact. • The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately. • The IRT, in consultation with outside experts if needed, is responsible for the following: • Initial containment by making tactical changes to the computing environment to mitigate active threats based on currently known information. • Analysis to establish the root cause of incidents, identification and evidence collection from all affected machines and log sources, threat intelligence and other information sources. Once all appropriate information has been collected, we perform a careful analysis using forensically-sound tools and methods to prevent any contamination of evidence. • Incident containment by further analyzing additional information and further identifying any additional compromised machines or resources not previously identified. • Incident eradication by re-assessing the root cause of incidents where solutions are then implemented to solve underlying problems and prevent re-occurrence. • Recovery and restoring normal business functionality, which includes the reversal of any damage caused by the incident and responding as necessary. • Review after closure of each incident and conducting a lessons learned analysis to improve prevention and help to make incident response processes more efficient and effective. Also, the IRT evaluates competency and any additional training requirements needed. A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: Our Head of Cybersecurity is regularly informed about developments in cybersecurity, including potential threats and innovative risk management techniques in the interest of effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Head of Cybersecurity oversees the processes for monitoring our information systems, including periodic system audits to identify potential vulnerabilities and third-party audits and evaluations. In the event of a cybersecurity incident, the Head of Cybersecurity implements an incident response plan. This plan includes immediate actions to mitigate the impact of incidents and strategies for remediation of future incidents. The Head of Cybersecurity is responsible for reporting information about cybersecurity risks and incidents to our Chief Financial Officer and other members of executive management.

companyName: Alector, Inc.

ticker: ALEC


text: audit and overseeing NIST (National Institute of Standards and Technology) internal audits. This expertise ensures our organization aligns with strict industry standards and maintains robust compliance measures.

companyName: CPI AEROSTRUCTURES INC

ticker: CVU


text: In the event of a cybersecurity incident, the Director of Infrastructure is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Our cybersecurity program focuses on the following key areas: • Governance: Our Chief Information Officer ("CIO") leads our cybersecurity risk management program, with oversight from our board of directors. Our CIO closely collaborates with Information Security and Legal/Privacy leaders with the support of other members of management and teams comprised of personnel with a broad range of experience in the technology industry. • Collaboration: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention, data leak prevention and detection systems, anti-malware functionality and access controls. • Incident Response and Recovery Planning: We have established and maintain comprehensive cybersecurity incident response and recovery plans, including legal obligations to report incidents, which we test and evaluate from time to time. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors and customers, that could adversely impact our business in the event of a cybersecurity incident affecting third-party systems. • Education: We provide regular, mandatory training for staff regarding cybersecurity and privacy awareness.

companyName: ON24 INC.

ticker: ONTF


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. "Risk Factors" in this Annual Report on Form 10-K, including under the heading "If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants upon which we rely, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Keros Therapeutics, Inc.

ticker: KROS


text: We recognize that third-parties that provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third-party risk from our vendors that hold financial or customer data, we maintain a vendor code of conduct, which is designed to require our third-party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.

companyName: Playa Hotels & Resorts N.V.


text: We use a defense-in-depth strategy across our business applications and systems, including database encryption, encryption for laptops/desktops, endpoint-security solutions including network filtering, anti-virus, endpoint firewalls, endpoint detection/response, patch and security configuration management and monitoring through our use of a Security Information and Event Management ("SIEM") system. The SIEM is monitored by our Security Operations Center ("SOC"). Our network and applications require multi-factor authentication, and logins are monitored for unusual activity by our SOC function. The enterprise network is protected by stateful firewalls, which are also monitored via our SOC. Our dedicated cybersecurity team engages third parties to conduct periodic infrastructure, application, compliance, and security operations testing, and threats/findings are managed through our risk-register and governance processes.

companyName: Endeavor Group Holdings, Inc.


text: During the reporting period, the Company has not identified any impact from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: Lord Abbett Private Credit Fund


text: As part of the WTW cybersecurity program, cross-functional teams throughout WTW, including enterprise risk management, operational resilience, legal, compliance and information security, coordinate to monitor, consider, and, when appropriate, address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications among these teams, the CISO, the Global Head of Technology, and other members of senior management, as appropriate, are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents and escalate such threats and incidents as appropriate through the processes described in more detail below.

companyName: WILLIS TOWERS WATSON PLC

ticker: WTW


text: Disaster Recovery Our processes address disaster recovery concerns. We operate most of our technology from U.S. and U.K. primary data centers. Either site alone is typically capable of running all of our essential systems. Replicated instances of this technology are maintained in our redundant data centers. Our data centers are generally built and equipped to best-practice standards of physical security with appropriate environmental monitoring and safeguards.

companyName: BGC Group, Inc.

ticker: BGC


text: The Company's Board, together with management, is engaged in our cybersecurity monitoring managed by our third-party provider and it is constantly changing. Any issues are appropriately addressed timely.

companyName: INSPIRE VETERINARY PARTNERS, INC.

ticker: IVPR


text: We have policies and procedures to oversee and manage the cybersecurity risks associated with both internal or external threats including the regular review of security reports, relevant cyber attestations, and other independent cyber ratings. These practices include technical controls and processes, as well as contractual mechanisms to mitigate risk. Additionally, we leverage cyber ratings, developed by reputable independent agencies, to assess our capabilities and compare to our peers. We have also implemented certain third-party risk management processes to assess, select, and monitor suppliers.

companyName: ONE Gas, Inc.

ticker: OGS


text: We are a SPAC with no business operations and with a purpose of completing an initial Business Combination with the identified target company. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Trailblazer Merger Corp I

ticker: TBMC


text: Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats, including, for example, periodic cybersecurity testing and cybersecurity awareness training for employees.

companyName: PMGC Holdings Inc.

ticker: ELAB


text: The Company has an Enterprise Risk Management function that oversees the identification prioritization and mitigation of the Company's enterprise risks, and cybersecurity is a risk category addressed by that function. The Company also has a Cybersecurity and Privacy Risk Council, which is composed of representatives of the Company's senior management and operates to deliver management-level oversight of cybersecurity matters. The Company uses governance, risk and compliance tools to assess, identify and manage its cybersecurity risks.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: We use third-party service providers to assist management to identify, assess, and manage material risks from cybersecurity threats, including for example, a managed security provider and professional services firms, including outside legal counsel.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer and Chief Financial Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. In addition, we regularly review cybersecurity trends and, partially as a result of our prior cybersecurity exposure, have moved some of our internal servers to off-site locations.

companyName: MBC FUNDING II CORP.


text: Responsibilities of Management Our corporate security team consists of the Chief Information Security Officer, the Manager of Security Engineering, a Senior Security Engineer, a Senior SRE, and a Security Engineering Contractor. The corporate security team is primarily responsible for assessing and managing material risks from cyber security threats, defining and overseeing our corporate security program, reviewing technical designs and vendors for security risks, and managing our security tools and infrastructure. Our corporate security team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology systems environment, including those described in "Risk Management and Strategy." The corporate security team reports to the Senior Manager of Information Technology, who reports to the Senior Director of Engineering Operations which maintains responsibility for our cyber security program.

companyName: Life360, Inc.

ticker: LIF


text: The Chief Technology Officer ("CTO") of our Manager, who holds 20 years of experience in information technology develops and advances the firm's cybersecurity and technology strategy. The CTO reviews our cybersecurity framework.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: We are committed to preserving the trust and confidence of our stakeholders by taking appropriate technical and organizational measures for maintaining information security and data privacy. Our cybersecurity program allows us to assess, identify and manage information security and cybersecurity threats through robust risk assessment and prevention measures to facilitate communication, training, awareness and incident response procedures. We have established policies and procedures to ensure timely and appropriate notifications to relevant parties and regulators as required for cybersecurity threats and data breaches.

companyName: AtriCure, Inc.

ticker: ATRC


text: Engaging in security-incident preparedness simulations and completing disaster recovery and resilience tests designed to test and strengthen any vulnerabilities in our cybersecurity infrastructure;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: Team and Strategy — The cybersecurity team, led by the CSO, is responsible for managing the day-to-day cybersecurity strategy of the organization, including oversight of our cybersecurity tools and controls to protect company assets. We have implemented an iterative and multi-layered cybersecurity strategy that incorporates both proactive review of the evolving cybersecurity threat landscape and reactive management of cybersecurity threats. Our proactive management of cybersecurity risks includes access limitations, data loss prevention programs, correction of potential cybersecurity risks, and programs for employee education regarding cybersecurity risks. Our reactive management of cybersecurity risks includes continuous logging and alerting, utilization of enterprise cybersecurity technology, and personnel dedicated to incident response.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Our cybersecurity program is led by our Senior Vice President - Strategic Services and Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"). Our CIO also serves as the Chair of our Cybersecurity Executive Oversight Committee ("CEOC"), comprised of our CISO and other senior executives representing various teams and functions of the Company including legal, finance, accounting, investor relations, and operations. The CEOC supports efforts to evaluate the materiality of any incidents, determines whether notice to third parties such as residents or vendors is required, and determines whether any disclosures to stakeholders are required. The CEOC is also responsible for ensuring the Company's management and Board of Trust Managers ("Board") are fully aware of key activities and events associated with our cybersecurity program on an ongoing basis.

companyName: CAMDEN PROPERTY TRUST

ticker: CPT


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not successfully eliminate all risks from cybersecurity threats and can provide no assurance that undetected cybersecurity incidents have not occurred.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: Security event monitoring and detection Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: We have processes for assessing, identifying and managing material risks from cybersecurity threats. These processes are integrated into our overall risk management systems, as overseen by our Board of Directors. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures in our effort to mitigate risks related to data breaches or other security incidents originating from third parties. We have a third-party consultant who, from time to time, evaluates any potential cybersecurity risks on our behalf.

companyName: Quest Water Global, Inc.

ticker: QWTR


text: Additionally, we have an Information Security Steering Committee (the "ISS Committee"), which plays a pivotal role in the governance of our cybersecurity posture. Members of the ISS Committee are selected for their domain-specific expertise and strategic vision, with representation from our IT, security, finance, legal, operations, and compliance sectors. The ISS Committee is an assembly of cross-functional senior leaders from various groups within our company. Led by the Director of SNM, the ISS Committee's function extends to the formulation of cybersecurity policies, setting risk management priorities and driving the adoption of security best practices across our company. By leveraging the collective expertise of the ISS Committee, we believe we ensure cybersecurity considerations are integrated into our company's organizational strategy and decision-making processes.

companyName: Powerfleet, Inc.

ticker: AIOT


text: The Partnership has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2024, 2023 and 2022. The Partnership continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.

companyName: Delek Logistics Partners, LP

ticker: DKL


text: Entergy and the Registrant Subsidiaries maintain a security-risk-management system with defined roles, duties, governance, and accountability. Under this physical- and cyber-risk model, Entergy and the Registrant Subsidiaries streamline security into a centralized program. The Chief Security Officer (CSO) is responsible for establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Information Officer (CIO) is responsible for ensuring that Entergy's information technology infrastructure is secure and reliable. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: Our Director of Cyber Security reports to our Chief Information Security Officer as well as our Chief Information Officer and is responsible for the operation of our cybersecurity program. Our Director of Cyber Security has 30 years of combined information technology experience with ten of those years working in the cybersecurity field as both an engineer and a director.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: We have not experienced a material security breach in our systems, or, to our knowledge, in our third-parties' systems, nor incurred any significant expenses or penalties to resolve or settle any security breach in the past three years.

companyName: Fabrinet

ticker: FN


text: Our cybersecurity strategy focuses on implementing controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks. We have processes in place designed to assess, identify, manage, and address material cybersecurity threats and incidents, including: annual security awareness training for employees, mechanisms designed to detect and monitor unusual network activity, and containment and incident response tools. Our ISMS is designed to help us identify and manage material risks from cybersecurity threats, and as part of our ISMS, we engage a range of third-party service providers, including assessors, consultants, and auditors, to assist us in these processes. Our risk assessment framework involves an information security risk assessment procedure that helps us identify potential cybersecurity threats and vulnerabilities (including relating to the use of third-party service providers) and then determine strategies to mitigate or counter the threats. As part of this process, we conduct annual penetration testing utilizing a third-party service provider. We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate. Our Information Technology Director also works with third-party service providers to assess potential cybersecurity threats and determines risk scores based on the likelihood of threats and the potential impacts of the threats, prioritizes risk and determines and recommends to our management controls aimed to counter such threats. We assess third-party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addenda to our contracts where applicable.

companyName: ProPetro Holding Corp.

ticker: PUMP


text: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations. As part of our cyber incident response process, we also engage third-party experts as needed, such as external legal advisors and cybersecurity forensic firms.

companyName: DNOW Inc.

ticker: DNOW


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our information systems and the data residing therein.

companyName: Liberty Energy Inc.

ticker: LBRT


text: The IS Program is monitored each year through various internal and external audits, as well as OCC regulatory exams. Vulnerability and penetration testing are also conducted at least annually by an independent third party to supplement the vulnerability and patching program routinely performed by internal staff. Third-party vendors supplement the Company's internal patching program as necessary. The Company also utilizes a third -party "SOC as a Service" to monitor extended detection and response logs and network traffic.

companyName: Investar Holding Corp

ticker: ISTR


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, are reasonably likely to have a material effect on us, our business strategy, results of operations, cash flows or financial condition.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.

companyName: COASTAL FINANCIAL CORP

ticker: CCB


text: The Company's Board of Directors (Board) has appointed the Audit Committee to assist the Board in fulfilling its responsibilities with respect to the oversight of cybersecurity, data security, privacy programs, and the Company's response to security breaches. Two Company Directors serving on the Audit Committee completed the National Association of Corporate Directors/Carnegie Mellon CERT cyber-risk oversight program along with required examinations and earned the CERT designation. The CISO provides quarterly updates to the Audit Committee, which include a current evaluation of the Company's maturity within the National Institute of Standards and Technology (NIST) framework, including assessments against key performance indicators, updates on internal phishing campaigns, tabletop exercises conducted at various levels of the organization, and management training. The Audit Committee also reviews reports and recommendations from third parties periodically engaged by the Company to assess the cybersecurity control environment. In addition, the Company's internal audit function periodically audits elements of the security program and reports its observations to the CISO and the Audit Committee.

companyName: SpartanNash Co


text: We have engaged consultants and other third parties to assist in our assessment of risks from cybersecurity threats and to evaluate our cybersecurity prevention and response systems and processes. At times, we may engage third parties to assist in the management and mitigation of a particular threat.

companyName: IO Biotech, Inc.

ticker: IOBT


text: The Company's Audit Committee holds oversight responsibility over the Company's cybersecurity strategy and risk management. The Audit Committee engages in regular discussions with management and, if and when deemed appropriate by management or the Audit Committee, third party service providers, regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from material cybersecurity threats.

companyName: CLEARONE INC

ticker: CLRO


text: Our program is based on frameworks provided by the Center for Internet Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Douglas Emmett Inc

ticker: DEI


text: Both management and the Board are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected.

companyName: Balance Labs, Inc.

ticker: BLNC


text: We also identify our cybersecurity threat risks by comparing our processes to standards established by HITRUST and SOC2 frameworks and any findings resulting from penetration testing and threat modeling conducted by third party service providers. To provide for the confidentiality, integrity, and availability of critical data and information systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following internal security measures: • maintain a cybersecurity program through formally-defined documented policies, standards, processes, and procedures to ensure internal security measures are implemented to protect against cybersecurity threats, to assess emerging cybersecurity and data privacy laws, and to implement changes to our processes that are designed to comply with laws applicable to our organization; • implement policies and procedures to identity organizational assets, data and critical IT systems, assess (and periodically re-assess) those assets, data, and systems for cybersecurity risks, and to develop management plans for identifying and remediating identified risks; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to handle confidential data and systems in a legally compliant and acceptable manner; • employ technical security tools that are designed to protect our critical data and information systems from cybersecurity threats, including network firewalls and access controls, vulnerability scanners, intrusion prevention and detection systems, anti-malware/endpoint protection systems, and identity and access management systems which are evaluated for effectiveness and improved through vulnerability assessments and cybersecurity threat intelligence; • provide quarterly, mandatory training for our employees regarding cybersecurity threats to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • implement administrative processes and procedures to define acceptable security parameters and baselines of IT assets and information systems, and utilize access controls to prevent unauthorized alterations to system parameters and to maintain oversight over configuration changes and modifications to those systems; • conduct third party security reviews of critical and high-risk third-party suppliers and vendors; • conduct quarterly phishing email simulations for all employees with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run annual tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • implement a formal Incident Response Plan, based upon NIST, HITRUST, and SOC2 frameworks, to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident, which Incident Response Plan includes processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation; and • carry information security risk insurance to insure against potential losses arising from a cybersecurity incident.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Our third-party vendors and service providers are integral to our operations but pose unique cybersecurity challenges due to their access to data and our reliance on them for critical operations, including supply chain management. To address these risks, we maintain a third-party vendor risk management program that includes pre-onboarding due diligence, regular audits, and ongoing compliance evaluations. Additionally, we assess critical vendors' supply chain security practices to reduce risks from subcontractors.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM


text: Although we are no t currently aware of any risks from cybersecurity threats that have materially affected us, we face risks from cybersecurity threats that could have a material adverse effect on us, including our business strategy, results of operations, or financial condition.

companyName: Stardust Power Inc.

ticker: SDST


text: Accordingly, we have devoted significant resources to assessing, identifying and managing risks associated with cybersecurity threats, including: an internal cybersecurity team that is responsible for establishing security standards and conducting regular assessments of our information systems, controls, vulnerabilities and potential improvements; continuous monitoring tools to detect and respond to cybersecurity threats in real-time;

companyName: QCR HOLDINGS INC

ticker: QCRH


text: Board Oversight of Cyber Risk Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee, which provides advice and guidance on the adequacy of the Company's initiatives on, among other things, cybersecurity risk management. The Chief Information Officer presents regular updates to the Audit Committee and the full Board of Directors, on, among other things, the Company's cyber risks and threats, and the status of projects in the Company's multi-year roadmap to strengthen the Company's information security systems to address the emerging threat landscape. The Company also engages third parties to periodically evaluate and audit aspects of the Company's information security programs, including by conducting vulnerability assessments and penetration testing, and the results of those findings are reported to the Audit Committee and used to help identify potentially material risks and prioritize certain security initiatives.

companyName: BlueLinx Holdings Inc.

ticker: BXC


text: From time to time, we use third-party providers to assist us with identifying, assessing, and managing material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, penetration testing firms, and forensic investigators.

companyName: PROCORE TECHNOLOGIES, INC.

ticker: PCOR


text: traffic monitoring and filtering of Sentinelone to protect against phishing attacks hardening hardening barriers to hardware access of on prem hardware firewall in order to keep less secure hardware such as printers and scanners on their own VLAN to minimize attack vectors Board

companyName: Dalrada Technology Group, Inc.

ticker: DHTI


text: We maintain a risk-based approach to identifying and managing cybersecurity threats presented by third-party systems that support our operations, as well as third-party users of our data and systems, including vendors, service providers, and subcontractors. Further, we require third-party users with such access to our data and systems to adhere to industry policies and standards that are comparable to or exceed our policies and standards. For third-party users that do not have access to our data and systems, we require those users to maintain cybersecurity practices that align with industry standards and applicable laws.

companyName: Hillenbrand, Inc.

ticker: HI


text: Impact of Cybersecurity Risks In 2024, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "ITEM 1A. Risk Factors - Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."

companyName: Blue Owl Capital Corp II