text: We have experienced various types of cyber-attack incidents which, to date, have been contained and did not have a material impact on our business strategy, results of operations or financial condition. As a result of such incidents, we continue to implement new controls, governance, technical protections, and other procedures to mitigate and prevent future incidents. We have a cybersecurity committee that is composed of our Executive Vice President of Technology, our Director of Information Technology and our General Counsel. The committee meets quarterly to review any incidents and incident responses and reports its findings to the Chief Financial Officer. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or our vendors or suppliers fall victim to other successful cyber-attacks.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: In the event of a cybersecurity incident, the CISO is equipped with a well-defined cyber crisis response plan. This plan includes assigning of the roles and duties of the crisis management team, immediate actions to mitigate the impact of the incident, and long-term strategies for remediation and prevention of future incidents.

companyName: MediaAlpha, Inc.

ticker: MAX

secItem: Item 1C


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity report, featuring key metrics and threats. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help the Committee remain well-informed and proactive in their oversight of cybersecurity risks.

companyName: Rayonier, L.P.


text: We are increasingly dependent on information technology and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: The Audit Committee is responsible for reviewing periodically the effectiveness of the Company's information and technology security policies and the internal controls regarding information and technology security and cybersecurity. We also have several working groups responsible for collaborating on cybersecurity policies and standards. The Global Chief Information Officer and the Global Chief Information Security Officer report to the Audit Committee quarterly on the Company's cybersecurity program, and to the Board of Directors, as necessary. In the event of a cybersecurity incident, our Global Chief Information Officer and Global Chief Information Security Officer, and others serving in similar capacities, will assess the incident and activate an incident response plan. These officers will escalate review of the incident to business unit leaders and/or members of our executive leadership team, as appropriate. We have a cybersecurity program to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company. Our cybersecurity program has a formalized framework that is informed by domestic and international laws, regulations and industry best practices and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to safeguard the confidentiality, integrity and availability of our information and systems. Our Information Security Program serves as the foundation of our cybersecurity program and our Acceptable Use Policy and Information Security Program Policy also provides governance in this area. We partner with other companies, industries and law enforcement to communicate information about the latest cybersecurity threats and leverage threat modeling insights. We conduct cybersecurity assessments against industry cybersecurity frameworks to better enable us to prioritize actions and investments to enhance our cybersecurity capabilities. Our cybersecurity teams work diligently to safeguard Company and customer data by applying layered and defensive mechanisms to proactively provide the security needed to detect and defend against cyber-attacks and to withstand potential impacts. We periodically conduct tabletop exercises and penetration testing to test our defenses. In addition, we provide new hires and employees with cybersecurity training, which is monitored and tracked on an annual basis. We also issue routine phishing campaigns to educate employees on social engineering techniques and informal security awareness exercises are conducted throughout the year.

companyName: UGI CORP /PA/

ticker: UGI


text: Cyber Risk Oversight Committee. Additionally, the Company established CyROC to provide executive management and the audit committee with analyses, appraisals, recommendations, and pertinent information concerning cyber defense of the Company's electronic information, information technology and operation technology systems. The CyROC is responsible for guiding the Company's comprehensive cybersecurity policies. The CyROC is chaired by the Company's supervisor of cybersecurity and is comprised of members from financial and operations management, as well as technology leaders.

companyName: Knife River Corp

ticker: KNF


text: To identify potential risks, Ambac also assesses the security measures of vendors and third-party service providers that have access to the Company's information systems and sensitive data. Each review involves an initial risk assessment of the provider, and initial and periodic reviews of the provider's cybersecurity program to evaluate security standards, access controls and security measures. The Company generally requires vendors and third party service providers to report to the Company any cybersecurity incidents involving the providers' systems that could affect the Company, or to have cybersecurity incident notice requirements in their cybersecurity programs.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: Our Board considers cybersecurity risk as part of its risk oversight function and oversees our cybersecurity and other information technology risks and management's implementation of our cybersecurity risk management program.

companyName: Indaptus Therapeutics, Inc.

ticker: INDP


text: The responsibilities of the Chief Information Officer ("CIO") include overseeing cybersecurity measures with the global Chief Information Security Officer ("CISO "). The CIO's background includes nearly 19 years of IT leadership at a major medical technology company and experience in various industries such as financial services, manufacturing, oil and gas, and chemicals. He holds an undergraduate degree in Management Information Systems from Augsburg University and a Master of Business Administration from Carlson School of Management at the University of Minnesota.

companyName: APi Group Corp

ticker: APG


text: The Company's processes for identifying and managing first and third-party risks from cybersecurity threats include: • Continuous monitoring of the Company's systems and network for cybersecurity events; • Regular testing of the Company's Security Incident Response Plan, Business Continuity plans, and Disaster Recovery plans; • Required annual security training for team members with access to Company email, as well as tailored training for team members in more sensitive roles (and periodic testing to ensure the security training is effective).

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: To mitigate the risk and impact of any cybersecurity incidents on the security and availability of the networks on which the Company relies, the information technology systems are protected through physical and software safeguards and backup procedures the Company considers appropriate. SITE Centers contracts with independent cybersecurity providers for security event incident management, end-point detection and incident response monitoring, and security incident response services. Additionally, SITE Centers has deployed a layered approach to network intrusion detection and protection using technology provided by industry-leading companies. The SITE Centers' information technology department also performs timely system and security updates to maintain current software versions and apply appropriate security updates aimed at reducing risk.

companyName: Curbline Properties Corp.

ticker: CURB


text: Establishing an Information Technology Steering Committee that is responsible for security administration, including conducting regular assessments of our information systems, existing controls, vulnerabilities and potential improvements; Implementing layers of controls and not allowing excessive reliance on any single control; Employing a variety of preventative and detective tools designed to monitor, block and provide alerts regarding suspicious activity; Continuously evaluating tools that can detect and help respond to cybersecurity threats in real-time; Leveraging people, processes and technology to manage and maintain cybersecurity controls; Maintaining a third party risk management program designed to identify, assess and manage risks associated with external service providers; Performing due diligence with respect to our third -party service providers, including their cybersecurity practices;

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: Board of Directors The Board of Directors of StepStone Group Inc. ("STEP Board") oversees STEP's processes for assessing and managing risk. The STEP Board's Audit Committee is responsible for reviewing and discussing STEP's practices with respect to risk assessment and risk management, and risks related to matters, including information technology and cybersecurity.

companyName: Stepstone Private Credit Fund LLC


text: We do not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: Sage Therapeutics, Inc.


text: We have not encountered cybersecurity risks, threats or incidents that have materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition during the financial year ended December 31, 2023.

companyName: CHINA AUTOMOTIVE SYSTEMS INC/2


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and the Center for Internet Security (CIS) Critical Security Controls. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF and CIS Controls as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: GCM Grosvenor Inc.

ticker: GCMG


text: We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. Key elements of our cybersecurity risk management strategy include: • We require an annual Service Organization Control 2 Type 1 report from all third-party providers attesting to the presence of security processes. Additionally, we require that SaaS/PaaS providers perform risk assessments and manage the security risks associated with their services. • We have established and maintain a comprehensive incident response plan designed to address our response to a cybersecurity incident. We conduct regular training scenarios to test these plans and ensure personnel are familiar with their roles in a response scenario. • We provide regular, mandatory training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • We use a third party to conduct a periodic assessment of our cybersecurity risk posture and maturity against the NIST Cybersecurity Framework. The results are evaluated by management and the Audit Committee and are used to adjust our cybersecurity policies, standards, processes and practices as necessary. • The company studies and evaluates threats in cyber landscape and aims to regularly improve our risk posture by learning from those lessons.

companyName: Scilex Holding Co

ticker: SCLX


text: Our CISO has more than twenty-five years of experience in cybersecurity, risk management, and technology leadership across financial services and global enterprises. Before joining Urban One, he served as Chief Information Security Officer at Farm Credit Financial Partners, Inc., leading enterprise-wide security initiatives. He has also held key leadership roles at Rabobank International, where he progressed through various IT, security operations, and risk management positions. Additionally, he led cybersecurity and risk management programs at United Technologies Corporation, where he focused on analytics-driven security solutions to enhance organizational resilience. He holds dual master's degrees in Information Security & Assurance and IT Management and also has an Executive MBA from the University of Connecticut Urban One's executive leadership team remains engaged in cybersecurity initiatives and regularly reviews the effectiveness of security controls, policies, and incident response capabilities to ensure alignment with evolving threats and business needs.

companyName: URBAN ONE, INC.

ticker: UONE


text: We have processes in place to regularly assess, manage and identify potential risks from cybersecurity threats. Our cybersecurity policies and processes are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools and processes that are designed to help identify and investigate any security incidents in a timely manner. When any risk or threat is identified we have a designated group of individuals including representatives from our information security team, finance team, compliance teams and legal teams who are involved in the assessment of the risk based on probability and potential impact to key business systems and processes. Risks that are considered to have a high impact to our business are incorporated into our enterprise risk management program. The tracking of these risks and the processes we have in place to address cybersecurity threats are tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.

companyName: Adaptimmune Therapeutics PLC


text: The Director's Risk Committee also shares oversight responsibility for cybersecurity and receives regular reporting from the CRO and ISO on cybersecurity and information technology risks, controls and procedures, and network penetration testing, in addition to providing input on efforts to mitigate cybersecurity risks and potential breaches. The Board's Audit Committee also has oversight responsibility for audits related to information technology security and information technology governance.

companyName: TFS Financial CORP

ticker: TFSL


text: Our information security program incorporates a robust cybersecurity risk management strategy. This strategy prioritizes continuous improvement and ensures the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: Periodically, the Audit Committee discusses our approach to cybersecurity risk management with our CISO. Our Technology and Cybersecurity Committee will receive regular reports from our CISO as part of its assessment of our cybersecurity threat landscape, and the quality and effectiveness of our information security programs.

companyName: BLACKLINE, INC.

ticker: BL


text: Audit Committee receives periodic reports from management on potential cybersecurity risks and threats. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: Vestand Inc.

ticker: VSTD


text: Cybersecurity is an important part of our risk management processes and an area of focus for the Board and management. The Board is responsible for monitoring and assessing strategic risk exposure, and our cybersecurity program and strategy are overseen by our Chief Information Security Officer (CISO). Our CISO, who joined us in 2022, has over 25 years of prior work experience in various roles managing enterprise risk and information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs, as well as several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, and Certified Information Systems Security Professional. The CISO provides regular updates to the executive management team and provides the quarterly Board updates, as discussed below. The executive management team allocates resources to support the cybersecurity program through allocation of budget.

companyName: Bakkt, Inc.

ticker: BKKT


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a culture of cybersecurity risk management. This integration is designed to make cybersecurity considerations an integral part of our decision-making processes. Our risk management team works closely with our IT department and cybersecurity team to evaluate and address cybersecurity risks connected with our business objectives and operational needs.

companyName: CYTOKINETICS INC

ticker: CYTK


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have an annual assessment performed by a third-party specialist of our cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Scorpius Holdings, Inc.

ticker: SCPX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Chief Information Officer, our VP of Corporate Cybersecurity and our Chief Technology Officer of Software, each of whom have over 20 years of industry expertise, including past roles at other public companies and as consultants.

companyName: NETGEAR, INC.

ticker: NTGR


text: Our cybersecurity risk management program includes the following: • An ongoing process of identifying, evaluating, and addressing our cybersecurity threats; • A security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Regular cybersecurity awareness training for all employees to provide a better understanding of the issues and risks related to cybersecurity and data privacy. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Phishing and other exercises performed by our IT department periodically throughout the year to test our systems and reinforce the training provided to all personnel • A cybersecurity incident response plan managed by our VP of IT/CISO, which includes procedures for responding to cybersecurity incidents and is designed to protect and preserve the confidentiality, integrity and continued availability of information possessed by the Company • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.

companyName: Prestige Consumer Healthcare Inc.

ticker: PBH


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the Audit Committee and management on these and other activities. The Audit Committee receives periodic reports from management on our cybersecurity risks, including presentations from our Chief Information Officer, vCISO, internal security staff, and external experts. This includes updates to the Audit Committee, as appropriate, regarding any significant cybersecurity incidents, or multiple incidents that could be significant in the aggregate. These updates may occur in between regularly scheduled Audit Committee meetings.

companyName: Bloom Energy Corp

ticker: BE


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Further, we have achieved certifications for internationally recognized information security and data privacy standards developed by the International Organization for Standardization ("ISO"), including ISO/IEC 27001:2013; ISO/IEC 27017:2015; ISO/IEC 27018:2019; and ISO/IEC 27701:2019. We also maintain certifications through a variety of other data security standards, including SOC2 and FedRAMP. These certifications demonstrate our commitment to industry-leading security and privacy best practices.

companyName: SMARTSHEET INC


text: Cybersecurity incidents that have been determined to meet established SEC reporting consideration thresholds are promptly communicated to the Disclosure Committee, which is responsible for evaluating the potential materiality of such incidents and ensuring the accuracy, timeliness and completeness of related disclosures under applicable reporting obligations, and other relevant communications or presentations. The Disclosure Committee's membership includes the following executives: the Corporate Secretary; the GC; the CFO; the Controller & Principal Accounting Officer; the Chief Risk Assurance Officer; and the Vice President, Investor Relations. In addition, the CISO serves as an advisor to the Disclosure Committee.

companyName: Philip Morris International Inc.

ticker: PM


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information technology team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; and • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: LENSAR, Inc.

ticker: LNSR


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect information from unauthorized access or attack, as well as secure our network and systems. Such processes include physical, procedural, and technical safeguards, response plans, regular tests on our systems, incident simulations, and routine review of our policies and procedures to identify risks and improve our practices. We engage certain external parties, including consultants, computer security firms and risk management, peer companies, industry groups, and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them to help protect us from any related vulnerabilities. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyber attacks, and other related breaches.

companyName: Inozyme Pharma, Inc.


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. We partner with a third-party information technology company to address and manage each of the critical aspects of cybersecurity risk mitigation. The user aspect is addressed by deploying endpoint detection and response software on all endpoints, as well as extensive phishing testing and training for every user. This is further reinforced with additional monitoring to identify any aberrant activity within our network or software as a service ("SaaS") tools. A 3-2-1 backup strategy is used, resulting in a copy of all backup data offsite in the unlikely event that the disaster recovery plan is required. Our backup system is regularly confirmed through routine data recoveries, test recoveries and monitoring that alert to any unexpected errors or failures with the system.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: Our Board of Directors, with the assistance of the Audit Committee, to whom the Board has delegated to the primary authority and responsibility to oversee cybersecurity risks, oversee the management of risks arising from cybersecurity incidents, and, as noted above, cybersecurity is one of the material risks tracked through our ERM process. The Audit Committee is briefed quarterly by our Senior Director on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance. Executive management and other senior leaders participate in the semi-annual updates to our ERM risk register and heat map, and those updates, which incorporate cybersecurity risk and strategy, also are presented to our Board for discussion and feedback annually. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee Chair.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risk rests with the Director of Infrastructure. With over 27 years of experience in the field of cybersecurity, the Director of Infrastructure brings a wealth of expertise to his role. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of Infrastructure oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: Via Renewables, Inc.

ticker: VIASP


text: Both management and the Board of Directors are actively involved in the oversight of risks from cybersecurity threats. Our information security program is designed to ensure that management and the Board of Directors are adequately informed about, and provided with the tools necessary to monitor, (i) material risks from cybersecurity threats and (ii) our efforts related to the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: Paycom Software, Inc.

ticker: PAYC


text: Among other things, the Audit Committee discusses with management the Company's major policies with respect to risk assessment and risk management, including cyber-security, as they relate to the integrity of the Company's accounting and financial reporting processes and the Company's compliance with legal and regulatory requirement. In addition to its other responsibilities, the IT Steering Committee oversees operational information technology risks, including cybersecurity, as they relate to the technical aspects of the Company's operations.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: Our Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management. This committee periodically reviews and assesses the risk exposure of our risks related to data privacy, technology and information security, including cyber-security, and back-up of information systems and makes recommendations to our Board of Director pertaining to monitoring and minimizing findings in such assessment. This committee periodically reports to the Board of Directors.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management program. While we have identified risks from cybersecurity threats, such risks have not materially affected us, including our business strategy, results of operations or financial condition, with the exception of the Cybersecurity Incident, as disclosed in a Current Report filed by the Company on Form 8-K on January 8, 2024, as amended on January 22, 2024 and February 27, 2024, which the Company believes will have a material impact on the Company's first quarter 2024 results. As previously disclosed, among other things, the Company expects to record in the first quarter of 2024 approximately $12 to $17 million of expenses related to the Cybersecurity Incident, net of expected insurance recovery. In addition, the Company has been named as a defendant in several lawsuits related to this Cybersecurity Incident, which are seeking various remedies, including monetary and injunctive relief. While we cannot presently quantify the full scope of expenses and other related impacts associated with this Cybersecurity Incident, including costs associated with any related current or future litigation or regulatory inquiries or investigations, the Company currently does not expect that the cybersecurity incident will have a material effect on its overall financial condition or on its ongoing results of operations. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Cyberattacks, information or security breaches and technology disruptions or failures, including failure of internal operational or security systems or infrastructure, or other cybersecurity incidents of ours or of our third-party vendors, could damage our business operations and increase our costs, which could adversely affect our business, financial condition and results of operations."

companyName: loanDepot, Inc.

ticker: LDI


text: Material Effects of Cybersecurity Incidents Previous cybersecurity incidents did not have, and are not reasonably likely to have, a material effect on the Company, including its business strategy, results of operations, or financial condition.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: During the incident response process, senior management, in collaboration with relevant personnel from information technology, information security, and, when necessary, external cybersecurity firms specializing in forensic investigations will assess the materiality of the breach alongside the severity scale. This evaluation aims to accurately identify risks and potential operational and business impacts. Materiality determination involves an objective analysis of both quantitative and qualitative factors, including an evaluation of immediate impact and reasonably likely future impacts.

companyName: NBT BANCORP INC

ticker: NBTB


text: We recognize the critical importance of m aintaining the safety and security of our information technology systems and data and maintain a cybersecurity risk management program as a part of our overall risk management strategy that is focused on identifying, assessing and managing cybersecurity risks. We engage an Managed Services Provider ("MSP"), with a highly experienced and responsive staff including a virtual Chief Information Officer ("vCIO"), to assist us with the identification, monitoring and management of risks from cybersecurity threats. They assist us with our technology, infrastructure and risk management through the deployment of a number of security controls and tools. We also take steps to limit third-party vendors' access to our systems, and we are in the process of developing additional vendor risk management procedures.

companyName: Vivani Medical, Inc.

ticker: VANI


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items. These action items include receiving updates on the status of remediation efforts for any non-compliance or risk items related to cybersecurity regularly throughout the year, including through periodic updates from management.

companyName: PETMED EXPRESS INC

ticker: PETS


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our Chief Technology Officer (CTO) evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Versus Systems Inc.

ticker: VS


text: As part of its cybersecurity risk management program, the Company leverages its cybersecurity organization, led by the Company's Managing Director of Information Security, to design and implement cybersecurity controls and to assess and report on cybersecurity risks. Members of the cybersecurity organization hold relevant degrees or industry-recognized certifications in cybersecurity, with relevant work experience in various roles involving managing information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. The members of the cybersecurity organization are expected to keep their knowledge, skills and training current by participating in industry events and continuing education programs as applicable.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Our Executive Vice President ("EVP") of Technology is responsible for addressing and managing cybersecurity risks, developing and implementing our information security program and reporting on cybersecurity matters to the Board. Our EVP of Technology has over twenty years of professional experience as a senior executive in technology-driven enterprises with expertise across cybersecurity, compliance, manufacturing process engineering, database architecture, interface programming and more. Under the direction of the EVP of Technology, the Company also engages and retains qualified third-party consultants to assist in the identification and management of material risks from cybersecurity threats.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of IT, General Counsel, CFO and/or Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.

companyName: GENTEX CORP

ticker: GNTX


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process. As part of this process, appropriate personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. As part of the above approach and processes, we regularly engage with assessors, consultants, auditors, and other third-parties to help identify areas for continued focus, improvement and/or compliance.

companyName: SYNOPSYS INC

ticker: SNPS


text: Risk Management and Strategy Overall Process The Company regards information and data as valuable assets. As a result, safeguards implemented protect corporate informational and data assets. Associated and established technology resources maintain the integrity, availability, and privacy of confidential information of the respective assets. Additionally, we maintain a similar risk-based approach to our third-party vendors including identifying and overseeing cybersecurity risks they present.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, we have not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024. We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: HYPERION DEFI, INC.

ticker: HYPD


text: SITE Centers has also implemented various safeguards designed to ensure the confidentiality, availability and the integrity of its network and data, including redundant telecommunication facilities, replicating critical data and backups to multiple off-site locations, a fire suppression system to protect SITE Centers' on-site data center, and electrical power protection and generation facilities. SITE Centers also has a catastrophic disaster recovery plan and alternate processing capability available for its critical data processes in case of a catastrophe that renders the primary data center unusable.

companyName: Curbline Properties Corp.

ticker: CURB


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, train or otherwise assist with aspects of our security controls; • security tools deployed in the IT environment for protection against and monitoring for suspicious activity; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • cybersecurity tabletop exercises for members of our cybersecurity incident response team and legal department; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: The Company may review System and Organization Controls 1 ("SOC1") or System and Organization Controls 2 ("SOC2") reports of certain third-party providers before engagement and has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company engaged a third-party consulting firm to evaluate and test the Company's risk management systems and to assess and prevent potential cybersecurity incidents as appropriate on an annual basis. The Company has engaged a third party to provide cybersecurity and awareness training to our employees to help mitigate the risk of threats posed by bad actors requesting information. The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, redundant data storage and retention methods, anti-malware functionality, security information event management, automated update/patch-management and access controls which are evaluated and improved through vulnerability and exposure assessments and cybersecurity threat intelligence. With the help of our third-party vendors, the Company has implemented several layers of physical security, digital security, and data backup.

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: Our cybersecurity incident response is designed to escalate certain cybersecurity incidents to members of management. In addition, our cybersecurity incident response and vulnerability management policies and procedures include reporting to the Audit Committee of the Board for certain cybersecurity incidents.

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: To facilitate a transparent and collaborative approach to managing cybersecurity risk, an executive management level committee has been established. Chaired by the Chief Risk Officer and administered by the Technology and Risk Management Director, the committee ensures continual awareness of the information and cybersecurity risk posture, emerging threats, known threat actors, and vulnerabilities. Its purpose is to foster a security culture within the Company through active participation in planning and managing threat and security risk activities.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Our cybersecurity threat risk management processes include the following, among others: • Our information security department identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example, manual methods and automated tools, conducting scans of the threat environment, conducting threat assessments, performing vulnerability assessments, use of external intelligence feeds, and through third-party-conducted red/blue team testing and tabletop incident response exercises. • Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: information security policies and standards governing access control, network and device security, encryption standards, incident response plans, disaster recovery plans, risk management, vulnerability detection and management and security awareness training requirements as well as security tools such as firewalls, malware protection tools, secure authentication tools, centralized logging and monitoring tools, threat intelligence tools, and data protection tools. • Our overall risk assessment and management processes address cybersecurity threats that may have a material impact on our business. Our information security department maintains a risk register of individual risks from cybersecurity threats. Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register. In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below). • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident. • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: We have established processes for identifying, assessing and managing material risks from cybersecurity threats associated with our key information technology systems. These processes have been integrated into our overall risk management strategies, as overseen by our Board of Directors, primarily through the board's Corporate Risk Committee and Audit Committee. These processes also include identifying and overseeing risks from cybersecurity threats associated with the use of third-party service providers. We conduct security assessments of certain third-party providers before engagement and have established monitoring procedures to mitigate risks related to data breaches or other security incidents originating from third parties. In addition, we conduct employee training on information security topics designed to address phishing and e-mail security, password security and data-handling security. We use e-mail security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing e-mails and avoid IT system interruptions. From time to time, we engage third-party consultants, legal advisors, and audit firms to evaluate and test our risk management systems and assess and remediate cybersecurity threats and incidents as appropriate. Additionally, our Enterprise Risk Management ("ERM") team analyzes cybersecurity risks, emerging industry trends and identification of mitigation, as part of a holistic analysis of risks across CHS.

companyName: CHS INC

ticker: CHSCP


text: Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us. Our Chief Information Security Officer and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity. This team partners with leaders from all our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and ultimately mitigate cybersecurity risk at C.H. Robinson.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: The management team – including our Senior Director, Global Information Security – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company. Such reports are typically provided at an Audit Committee meeting and enable Audit Committee members to ask questions of management and engage in additional discussions in an open forum. The Audit Committee also periodically evaluates our overall cybersecurity strategy.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office ("CIO") and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third parties.

companyName: TENNANT CO

ticker: TNC


text: The Board, in coordination with the Audit Committee, oversees the effectiveness of management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.

companyName: Axogen, Inc.

ticker: AXGN


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee. Our Board and Audit Committee regularly review the measures implemented to identify and mitigate data protection and cybersecurity risks. As part of such reviews, our Board and Audit Committee receive reports and presentations from team members responsible for overseeing our cybersecurity risk management, including our Chief Information Officer (CIO), which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. We have implemented protocols by which certain cybersecurity incidents are escalated internally and, where appropriate, reported timely to our Board and Audit Committee.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: The Company's governance and oversight of cybersecurity risks are facilitated through our Information Security Program, which establishes administrative, technical, and physical safeguards designed to protect sensitive information in accordance with FDIC and FFIEC regulations. The program is tailored to align with the Company's size, complexity and operational scope.

companyName: BANNER CORP

ticker: BANR


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training of our employees, including incident response personnel, and senior management;

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: Notwithstanding our efforts described above, the Company cannot guarantee that it will be successful in identifying and preventing all cybersecurity risks. For a discussion of how the occurrence of such risks may impact Altus' business, see the section entitled "Risk Factors" above.

companyName: Altus Power, Inc.


text: Board Oversight of Cybersecurity Risks Our Board provides strategic oversight on cybersecurity matters, including material risks associated with cybersecurity threats. Our Board receives periodic updates from our Chief Compliance Officer and Chief Operating Officer, and more frequently as needed, regarding the overall state of our cybersecurity program, information on the current threat landscape, and material risks from cybersecurity threats and cybersecurity incidents.

companyName: Trinity Capital Inc.

ticker: TRIN


text: Individuals in our Cybersecurity and Global Risk & Integrity departments regularly monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the CISO promptly and discussed in regular team meetings generally held several times per week. Risks are escalated to the CRO and other members of management in accordance with our incident response and reporting policy.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see "Risk Factors – Risks Related to Data Protection Privacy, Cybersecurity, Intellectual Property and Technology" which is incorporated by reference into this Item 1C.

companyName: Evolent Health, Inc.

ticker: EVH


text: Incident Response Planning: The Company has established, maintains and regularly tests incident response plans that address the Company's overall preparedness and response to a cybersecurity incident. The plans include, among other steps, assessment processes to determine the magnitude and materiality of an incident, an analysis of the need and method to communicate to various constituencies (customers, employees, authorities, etc.), and the requirements for public and regulatory disclosure. In addition to this response planning framework, among other mitigating actions the Company maintains an insurance policy for cybersecurity liability that provides not only coverage for breaches, but also loss prevention services and claims advisors.

companyName: BADGER METER INC

ticker: BMI


text: We have strategically integrated cybersecurity risk management into our broader Enterprise Risk Management Plan to promote a company-wide culture of cybersecurity risk management. An analysis of the potential threat facing the organization tempered with the level of vulnerability to that threat is used to determine the likelihood of risk.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Assessment, Identification, and Management of Cybersecurity Risks The Company has processes in place to assess, identify and manage material risks from cybersecurity threats. We rely on the cybersecurity strategy implemented by the Adviser and the Antares Parties, the providers of our technology services. The Adviser manages the Company's day-to-day operations and has implemented, together with the Antares Parties, a firm-wide cybersecurity program that applies to the Company and its operations. References in this Item 1C to (i) any programs or processes of the Adviser shall be deemed to refer to any firm-wide programs and/or processes that have been implemented by the Antares Parties, and (ii) any actions of the Adviser shall be deemed to refer to actions of the Antares Parties and/or the Adviser, as the context may require.

companyName: Antares Strategic Credit Fund


text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Chief Financial Officer, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the Chief Financial Officer as well as to other executive management, including our General Counsel, on cyber matters, as appropriate.

companyName: PepGen Inc.

ticker: PEPG


text: Our DPP includes an incident response process that includes reporting thresholds and follows standardized identification and authentication practices. If an incident is identified, it is documented by our Senior Director, Information Technology, who is required to report the incident to management.

companyName: Protalix BioTherapeutics, Inc.

ticker: PLX


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.

companyName: CONTINENTAL RESOURCES, INC


text: • Risk Identification and Mitigation. The Company aims to identify and mitigate information security risks by using the National Institute of Standards and Technology Cybersecurity Framework (the "NIST Framework") as a guide to help us identify and mitigate information security risks relevant to our business. The Company seeks to identify potential risks through various software programs which perform asset and patch management; monitor desktops, laptops and servers; map networks and inventories; and audit file servers. The Company aims to protect itself from potential risks through the implementation of software programs which provide protective measures such as single sign-on, multi-factor identification, content filtering, disk encryption, regular patches and inside threat protection. The Company has implemented a suite of software programs to detect information security events, plans to respond to information security events in accordance with the IRP and BCP, and aims to take proactive steps to recover from information security events through its Disaster Recovery Plan ("DRP"). The DRP prioritizes the swift recovery of information technology systems, data, and infrastructure and the efficient restoration of servers and applications to their normal operational state in the event of a significant disaster. • Insurance. We maintain a breach response insurance policy. • Enterprise Risk Assessment. The Company completes an annual enterprise risk assessment that includes cybersecurity risks and mitigants. The results of the enterprise risk assessment are shared with the Board of Directors on an annual basis. • Implemented Programs for a Hybrid Work Environment. We have implemented initiatives relating to mobile device management, cloud storage services, endpoint protection, and identity and access management. For example, we have implemented a service that focuses on mobile device management and mobile application management, as well as data classification and file server data loss protection measures. We have further implemented endpoint protection and endpoint detection and response which provides visibility that is designed to identify unauthorized systems and applications. • Ongoing Monitoring. Our information security procedures are designed to evolve as information security risks and considerations change over time.

companyName: ADAMAS TRUST, INC.

ticker: ADAM


text: The Company's third-party risk management framework and processes have been aligned with regulatory requirements and with industry best practices to oversee and identify risks from cybersecurity threats associated with use of third-party service providers. We take a risk-based approach in performing cybersecurity assessments of third-party service providers at the time of onboarding, as part of regular ongoing monitoring, at the time of contract renewal, and upon detection of any increase in risk profile. Our information security division collaborates with our third-party risk management unit to evaluate the information technology and security programs of significant third party service providers. As applicable, these reviews evaluate the design and operational effectiveness of information technology and security related controls employed by service providers. In addition, the third party's information technology and security policies and procedures are evaluated to form an overall opinion of the third-party service provider's technology and information security posture.

companyName: BankUnited, Inc.

ticker: BKU


text: Management's Role Managing Risk The Chief Information Security Officer ("CISO") plays a pivotal role in informing the Board and the Audit Committee on cybersecurity risks and provides comprehensive briefings on a regular basis, with a minimum frequency of three times per year to the Audit Committee and once per year to the full Board. During committee reports, the Audit Committee would apprise the full Board of any significant cybersecurity updates. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and knowledge gleaned from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the CISO and Chief Executive Officer ("CEO") inform and consult as appropriate with the Board regarding any significant developments in the cybersecurity domain.

companyName: WORKIVA INC

ticker: WK


text: Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee ("ITC").

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: We have implemented security control principles that follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework with the main goal of our cybersecurity risk management process being to protect the confidentiality, integrity, and availability of our information assets. Our external auditors annually review our information security management system, which has an ISO/IEC 27001 certification.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of the Company. The Board closely reviews these reports of the Bank's cybersecurity posture and the effectiveness of its risk management strategies prior to approval. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: Kentucky First Federal Bancorp

ticker: KFFB


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within our IT and risk management systems and addresses both the corporate and the operational IT environment.

companyName: W&T OFFSHORE INC

ticker: WTI


text: Third-Party Assessments: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and, if warranted, the Board of Directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with White Digital Solutions who reports to our CEO, to manage the risk assessment engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: AI Unlimited Group, Inc.


text: Our business strategy, results of operations, and financial condition have not been materially affected by cybersecurity risks, threats, or incidents in the past, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. We continue to invest in the cybersecurity and resiliency of systems and products and continue to enhance our internal controls and processes, which are designed to help protect our systems, products, and the information they contain. Nevertheless, we cannot guarantee that we will not be materially affected in the future by such risks or experience future material incidents.

companyName: Luminar Technologies, Inc./DE

ticker: LAZRQ


text: As part of the second line of defense, the Company maintains a Technology, Risk and Compliance ("TRC") function and a Company-wide Enterprise Risk Management ("ERM") program for which the WBA Chief Ethics and Compliance Officer provides oversight. The TRC function is responsible for reviewing and updating the Company's Information Security policy and manages compliance with critical security related regulatory requirements, including those related to HIPAA and the Payment Card Industry - Data Security Standard. The ERM program systematically identifies and reports enterprise-wide risks and the related risk mitigation recommendations, including the consideration of cybersecurity risk relative to other top risks, to executive management. The TRC and ERM teams work collaboratively with the Information Security team to support the Company's risk mitigation efforts.

companyName: Walgreens Boots Alliance, Inc.


text: Overseeing our cybersecurity initiatives is our CIO and Director of Global Cybersecurity, who provide invaluable expertise in managing cybersecurity risks and leading our cybersecurity operations. Both the CIO and Director of Global Cybersecurity possess extensive expertise in information technology and program management, with a wealth of experience, including over 19 combined years of dedicated service within our corporate information security organization. Furthermore, the executive leadership team is active in security operations, overseeing implementation of policies, procedures, and policies related to cybersecurity, technology, and vendors. Both the Audit Committee of the Board as well as executive leadership team will be notified and updated in the event of an incident, with incident updates, mitigation efforts, and impact, as deemed appropriate.

companyName: EnerSys

ticker: ENS


text: Cyber risk management has become a vital part of our broader ERM efforts. To manage and mitigate cyber risks, we have a dedicated information security team that has been charged with monitoring and managing cyber threats to our information systems, and the data that is stored on those systems, using our cyber risk management methodology. Our information security team is led by our SDIS and overseen by our CITO. Our cybersecurity risk management framework encompasses, among other things, ongoing systematic processes to identify, analyze, prioritize, manage, and monitor potential cyber risks to the information systems that we own or use and the cybersecurity threats to which we are exposed as a result of our reliance on third-party service providers and third-party software. Our cyber risk management methodology is comprised of the following core tasks: • Risk identification. Our internal information security team works with a MSSP and other external security partners to identify existing and new threats to our information systems. Our information security team, working in partnership with our MSSP, monitors our information systems to identify malicious and anomalous activity, uncover potential cybersecurity threats, and assess risks to information systems. • Risk analysis. Our information security team, working in partnership with relevant cybersecurity and technology experts, analyzes identified threats to determine the likelihood of the actualization of a threat and the potential business impacts, including evaluating the potential for data loss, data corruption, disruption to business operations, and financial impact. • Risk evaluation. Identified risks are evaluated to determine whether gaps in our controls or risk mitigation strategies exist that could result in material risk to the Company. If it is determined that our existing processes, strategies, or technology may be insufficient to effectively mitigate or manage an identified risk, it is escalated to our CITO and SDIS to assess and implement potential responsive or corrective actions in our processes, strategies, or technology to address the risk. • Risk mitigation. Our senior executive team, which includes our CITO, using input from our information security team and our broader information technology (or IT) department, develop and approve budgets, strategies, technology roadmaps and programs which are designed to effectively manage our cyber risks, safeguard our information resources, and reduce the likelihood or impact of cybersecurity incidents.

companyName: Schneider National, Inc.

ticker: SNDR


text: The Company has also implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers. The Company's control over and ability to monitor the security posture of third parties with whom it does business remains limited and there can be no assurance that the Company can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including the Company's right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on its business from any such compromise or failure.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: As of the date of this Annual Report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For more information on our cybersecurity related risks, see "Risk Factors - Risks Related to Our Business and Our Industry" included elsewhere in this Annual Report on Form 10-K.

companyName: Citius Pharmaceuticals, Inc.

ticker: CTXR


text: Management and Strategy have established policies and processes for assessing, identifying, and managing risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: The Vice President, IT has overall responsibility for our information security program, with support from our management team and specialized partners in cybersecurity incident response and privacy. The process includes managing our incident response strategy. If a cybersecurity incident meets certain criteria, however, our CEO, CFO and General Counsel will become involved with the response strategy, including decisions about public disclosure and reporting.

companyName: Celcuity Inc.

ticker: CELC


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by management and IT consultants. The IT consultants have relevant expertise, experience, education and training as well as knowledge of our company's critical systems and information technology policies.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: The Risk Committee is appointed by the Board and is authorized to perform its functions in assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T's enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T's Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, Chief Information and Technology Officer and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee.

companyName: S&T BANCORP INC

ticker: STBA


text: We use specialized IT tools and services, including with the support of third-party service providers, to understand, manage, mitigate and continually remediate identified threats. The Company logs identified cybersecurity threats and tracks corresponding risk management activities. Identified cybersecurity threats are discussed with management for resolution planning and escalation.

companyName: INTERNATIONAL TOWER HILL MINES LTD

ticker: THM


text: While we have a cybersecurity program designed to protect and preserve the integrity of our information systems, there is no guarantee that our cybersecurity program will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. We have experienced cybersecurity incidents in the past that were not material, but future incidents could have a material impact on our business strategy, results of operations, financial condition, cash flows and reputation. See "We are subject to information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information, breaches in the technology used to manage operations and other business processes, and the increasing use of artificial intelligence" in Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Sylvamo Corp

ticker: SLVM


text: We rely on third party providers and outsourced IT services to monitor and address cybersecurity related risks, including installing software for threat protection and malware. Such third party providers are tasked with notifying management of any material risks or cybersecurity concerns that they identify, which management then assesses and may bring to our board of directors to discuss if deemed necessary or appropriate. Based on the results of our risk assessments, if deemed necessary or appropriate, we take steps to re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.

companyName: Lifeloc Technologies, Inc

ticker: LCTC


text: The Company employs a combination of patch management, network security, malicious code prevention, and user awareness and training to assist with preventing cybersecurity incidents. Users are made aware of policies and procedures regarding appropriate use of networks, systems, and applications. Additionally, employees are trained in handling sensitive data and made aware of specific requirements when handling client data. Periodic review and assessment of network infrastructure is completed. The Company, in certain instances, may rely on vendors, third-party support, or other outsourcing opportunities. Before introducing a new product or service, the internal controls and competence of a vendor, maintenance and upkeep of a third-party provider's systems, and financial condition of the third-party vendor are evaluated. Internal and external auditors and independent external partners are engaged and periodically review the Company's processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: CITY HOLDING CO

ticker: CHCO


text: Board's Roles and Responsibilities Oversight for risk management and the overall enterprise risk management strategy of the Company, including cybersecurity, is the responsibility of the Board of Directors. Risks identified are monitored by the Board as a whole or the Board may delegate oversight to a specific subcommittee. Our Technology Committee, comprised of four board members possessing relevant background and experience, assists the Board of Directors in its oversight role with respect to strategy and risk management for our information systems, IT, and cybersecurity.

companyName: MAXIMUS, INC.

ticker: MMS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President ("SVP") Enterprise Technology and Security, as part of the Board's continuing education on topics that impact public companies. Regular briefings ensure the Board remains informed about evolving threats and the organization's security posture.

companyName: Beachbody Company, Inc.

ticker: BODI


text: Carpenter Technology maintains a Cybersecurity Incident Response Plan ("CIRP") which provides specific guidance and documentation for proper incident handling and communication. The CIRP applies to all locations and situations where Carpenter Technology business is conducted. All cybersecurity incidents, regardless of severity, are to be promptly handled according to this plan. The CIRP will invoke Carpenter Technology's business continuity and crisis management processes for the most severe incidents.

companyName: CARPENTER TECHNOLOGY CORP

ticker: CRS


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; regular testing of our critical systems to identify and address potential vulnerabilities; cybersecurity awareness training of our employees, incident response personnel, and senior management;

companyName: Camping World Holdings, Inc.

ticker: CWH


text: The Company has a Governance, Risk, and Compliance (GRC) function to address enterprise risks, and cybersecurity is a risk category addressed by that function.

companyName: Star Equity Holdings, Inc.

ticker: STRR


text: Cybersecurity threats, and their evolving nature, pose a risk to us and our strategy, results of operations, and financial condition in the future. Our risk factors include further detail about the cybersecurity risks we face. To date, cybersecurity threats or incidents have not materially affected us or our operations. Our focus on risk management, governance, compliance, and incident response is intended to mitigate the potential harm posed by evolving cyber threats and challenges.

companyName: Bright Mountain Media, Inc.

ticker: BMTM


text: The Bank's cyber incident response plan includes third-party cybersecurity incidents and threats. The Bank undertakes due diligence of third-party systems with which the Bank will interact, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of these service providers, including performance and technological reviews and escalation of any unsatisfactory reviews.

companyName: Federal Home Loan Bank of New York


text: The members of senior management involved in managing our material risks from cybersecurity threats, including our Chief Technology Officer, Chief Information Security Officer, Cybersecurity Operations Director, Chief Financial Officer and General Counsel and Corporate Secretary are experienced in data security matters and financial reporting matters. Our Chief Information Security Officer has more than 20 years of experience in information technology and has served in multiple technology executive roles, including security-compliance-related roles and holds a degree in Computer Information Systems from Harding University. Our Chief Technology Officer holds a computer science degree and Master of Engineering in Computer Science from Massachusetts Institute of Technology and has held engineering roles in multiple financial technology companies. Our Cybersecurity Operations Director holds a Master of Science degree in computer engineering as well as a Master of Science degree in information assurance, both from Iowa State University. He has led the security operations centers for large, global data management software company, as well as a large payment processing company. Additionally, he has led audits and penetration tests as the senior manager of a consulting company. Prior to entering into the private sector, he served as a police officer where he was a detective, specializing in computer crimes and forensics. Our Chief Financial Officer has over 10 years of experience in financial statement reporting and auditing. Our General Counsel has significant experience advising on cybersecurity matters and data protection matters and building out cybersecurity and data privacy compliance program across retail-facing business lines in the financial services industry.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: Our board of directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity and privacy events, data privacy policies and procedures, and compliance with regulatory requirements and industry standards.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Our Chief Information Security Officer has over 25 years of relevant experience and formal training in the areas of cybersecurity, risk management, and data privacy in the financial services industry. The Chief Information Security Officer holds a Master of Science in Computer Information Systems and appropriate professional certifications. Our Chief Information Officer has over 20 years of executive level technology leadership experience in the financial services industry.

companyName: NORTHPOINTE BANCSHARES INC

ticker: NPB


text: We have never experienced a cybersecurity incident that was determined to be material, although, like many technology-dependent companies operating in the current environment, we have experienced cybersecurity incidents in the past. For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, please see the section titled " Risk Factors. "

companyName: FOCUS UNIVERSAL INC.

ticker: FCUV


text: Cybersecurity risk management is an important part of our overall risk management efforts. We conduct mandatory cybersecurity awareness training for all employees, regardless of level or title, each year and provide additional training for designated roles, such as incident response personnel and senior management, on a case-by-case basis. We perform enterprise and site tabletop exercises annually to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness. Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall risk management program.

companyName: Seagate Technology Holdings plc

ticker: STX


text: The Cigna Group's Board has ultimate oversight over the Company's privacy and cybersecurity programs and strategy and is responsible for ensuring that the Company has risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity expertise, including certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of the Company's cybersecurity and privacy programs. Annually, the full Board reviews the Company's cybersecurity program, including the threat landscape and related controls and periodically conducts cybersecurity tabletop exercises.

companyName: Cigna Group

ticker: CI


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams.

companyName: Informatica Inc.

ticker: INFA


text: Our Board considers cybersecurity risk as part of its risk oversight function and considers cybersecurity and IT risks as key strategic risks of Quanta. The Board oversees management's implementation of our cybersecurity risk management program, receiving regular reports from management (including our Vice President of IT) on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents, and reviewing cybersecurity topics impacting companies with management and external experts.

companyName: QUANTA SERVICES, INC.

ticker: PWR


text: We have an information technology team, led by our director of information technology, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with our senior management team. We seek to address cyber risks through a cross-functional approach, including relevant training for applicable employees and regular reviews and tests of our cybersecurity program that leverage work done by internal audit.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: Information Technology & Information Security Audits. The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC). Pursuant to their respective Charters, the Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank's internal controls, including those controls related to information security, based on independent external audit and internal audit reports. The Chief Audit Officer, who is also a Certified Information Systems Auditor, coordinates the external and internal audit plan and reporting functions for the Bank.

companyName: BankFinancial CORP


text: Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We firmly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving regular exercises, cyber-event simulations, training programs and an annual attestation to our Technology Acceptable Use Policy.

companyName: Ameresco, Inc.

ticker: AMRC


text: Innospec's CEO and CFO are involved with and approve the Company's strategy for managing the prevention, detection, mitigation and remediation of cyber security incidents as part of its "IT Security Management System" which includes defined escalation and internal communications processes and responsibilities.

companyName: INNOSPEC INC.

ticker: IOSP


text: We maintain a data security plan designed to provide a documented and formalized information security policy to detect, identify, classify and mitigate internal and external cybersecurity and other data security threats. This cybersecurity program is based in-part on, and its effectiveness is measured using applicable industry standards, and is integrated into our overall enterprise risk management program. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes.

companyName: Shimmick Corp

ticker: SHIM


text: This disclosure provides stakeholders with a comprehensive overview of the organization's cyber risk management, strategy and governance practices, demonstrating a commitment towards proactive cybersecurity measures and compliance.

companyName: DNOW Inc.

ticker: DNOW


text: Our Senior Vice President, Chief Information Security Officer ("CISO") and Senior Vice President, Internal Audit and Risk, who oversees our enterprise risk management ("ERM") framework, partner on definition and treatment of cyber risks. Cybersecurity is a component of our ERM framework and processes. We utilize a wide range of capabilities to help us identify and assess potential cyber threats and vulnerabilities, which feed into our development and regular updating of a risk treatment plan to help us manage our cybersecurity risk posture. We evaluate risks on an ongoing basis across several categories in terms of probability of the likelihood and magnitude of potential impact, using evaluation results to inform our areas of focus and prioritization.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: We manage data security and privacy at the highest levels. Our Chief Executive Officer (CEO) is actively engaged in oversight of cybersecurity and IT infrastructure and works with outsourced vendors to manage all network operations. Our vendors keep our CEO informed on cybersecurity and privacy matters throughout the year. We have strengthened our data protection capabilities through investments in our infrastructure hardware and software. During the fiscal year ended May 31, 2025, the Company did no t experience any material cybersecurity incidents.

companyName: Transglobal Management Group, Inc.

ticker: TMGI


text: a. Low (1 – 2.99) = Risk level acceptable and no further action deemed necessary b. Medium (2 – 5.99) and High (6 - 9) – implement risk management to reduce the risk to an acceptable level 5. Risk Communications- Results of the risk assessment are communicated to appropriate level of management. Report includes the identified risk and vulnerability summaries. Updates will include treatment plans and status updates.

companyName: AVITA Medical, Inc.

ticker: RCEL


text: The Board and its committees actively oversee the Company's risk management program. Cybersecurity threats and related risks are an important component of the Company's overall approach to enterprise risk management ("ERM"). We annually examine our cybersecurity program with third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology (NIST), as guidelines. Cybersecurity risk management is a Company-wide initiative. In general, the Company seeks to address cybersecurity risks through a comprehensive, multi-disciplinary approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: The Chief Technology Officer (CTO) is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The Company's CTO, Doug Fay, has served as the Chief Technology Officer & Sr. Vice President for Cinemark since August 2006. Mr. Fay has a background in software engineering and application architecture and has worked in the information technology field since the early 1990s. The CTO routinely reviews risks and security measures and meets monthly with the general counsel, CFO, and Global Controller to review security measures and risks. Oversight of the information security program at the Board level sits with Audit Committee. Presentations regarding security measures and risks to the Audit Committee occur semi-annually. The Company's incident response plan defines the process for escalating incidents based on level of severity to the management team and Audit Committee.

companyName: Cinemark Holdings, Inc.

ticker: CNK