text: As one of the critical elements of AGM's overall ERM approach, AGM's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," AGM's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of AGM's risks, including its cybersecurity risks. AGM's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of AGM, with support from the broader AGM Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Investment Adviser and its affiliates. • Collaborative Approach. AGM utilizes a cross-functional approach involving stakeholders across multiple departments, including AGM Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board of Directors, as applicable, in a timely manner. • Technical Safeguards. AGM deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. AGM has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. AGM maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. AGM provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: The Board and its committees provide oversight of our ERM program, including our cybersecurity risk management program and the protection and resilience of BD products, manufacturing and distribution OT, enterprise IT and BD data. In addition, our management periodically conducts cybersecurity crisis simulations with the full Board to raise awareness of cybersecurity risks and enhance our incident preparedness. We also provide Board members the opportunity to take a cybersecurity training course through an external service provider. The Board delegates oversight of our cybersecurity risk management program to the Audit Committee and the Quality and Regulatory Committee (QRC). The Audit Committee regularly reviews our cybersecurity risk management program with respect to manufacturing and distribution OT and enterprise IT, and the QRC reviews our product cybersecurity program.

companyName: BECTON DICKINSON & CO

ticker: BDX

secItem: Item 1C


text: The Company's Audit Committee oversees management's process for identifying and mitigating cybersecurity risks. Periodically, the CISO presents cyber incidents and risks to the audit committee as part of the board of directors' oversight of risks from cybersecurity threats. The Audit Committee's oversight includes understanding existing and new cybersecurity risks and status on management's response and mitigation plans.

companyName: PUGET ENERGY INC /WA


text: As part of its oversight responsibilities, the Ford Credit Board receives annual cybersecurity updates from Ford's Chief Information Security Officer. The annual review includes oversight of cybersecurity practices, cyber risks, and risk management processes, such as updates to Ford Credit's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition, Ford Credit's Compliance Committee reviews at least annually Ford Credit's cybersecurity programs, and the Ford Credit Audit Committee receives updates on Ford Credit's cybersecurity initiatives and information technology internal controls. In addition to these regular updates, as part of Ford Credit's incident response processes, Ford Credit's Chief Technology Officer, in collaboration with Ford Credit's Qualified Individual and Chief Compliance Officer, provides updates on certain cybersecurity incidents to Ford Credit's Compliance Committee and, in some cases, the Ford Credit Board of Directors. In the event Ford Credit determines it has experienced a material cybersecurity incident, Ford Credit's Audit Committee and Chief Compliance Officer are notified about the incident in advance of filing a Current Report on Form 8-K.

companyName: FORD MOTOR CREDIT CO LLC


text: Following these risk assessments, we may accept identified risks; re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate high-level personnel, including our Chief Information Security Officer (CISO), who reports to our Chief Information Officer ("CIO"), to manage the risk assessment and mitigation process.

companyName: Lyft, Inc.

ticker: LYFT


text: The Company's Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board of Directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Our cybersecurity program is overseen by our Senior Vice President and CIO, who has nearly two decades of experience in information technology, having previously held CIO roles with other organizations, as well as experience in the utility sector. The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program. The CIO reports to the Executive Vice President and CFO. The CIO provides periodic briefs regarding prevention, detection, mitigation and remediation of cybersecurity incidents, as well as risks, threats and the threat landscape to the Board and executive management, including the CEO, CFO and CAO. These briefs are used to help continuously improve our cybersecurity program and to inform risk assessments as part of the ERM program.

companyName: WISCONSIN POWER & LIGHT CO


text: We rely on third parties, including cloud vendors and consultants, for various business functions. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation and scans or other technical evaluations. Governance.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: We require all employees to participate in cybersecurity awareness, privacy, security training annually and provide mechanisms to report potential threats. In addition, we use a third-party phishing awareness vendor to increase employee awareness of cybersecurity threats.

companyName: Talkspace, Inc.

ticker: TALK


text: Our Cybersecurity Program includes a cyber incident response plan that provides controls and procedures designed to enable swift response, remediation, and timely and accurate reporting of any material cybersecurity incident.

companyName: Oportun Financial Corp

ticker: OPRT


text: Our Chief Financial Officer, our Internal Audit Director and our external Information Technology department are primarily responsible to assess and manage material risks from cybersecurity threats and oversee key cybersecurity policies and processes. They are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Chief Information Manager of our Information Technology department has 35 years of experience in the design, implementation, and support of information technology infrastructures with significant expertise in information technology forensics. He is assisted by two network engineers with 26 years of information technology experience with a focus on information technology forensics.

companyName: GENCO SHIPPING & TRADING LTD

ticker: GNK


text: Understanding the potential risks associated with third-party service providers, we shall implemented stringent processes to oversee and manage these concerns. We shall conduct thorough security assessments before engaging with any third-party provider and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This involves quarterly assessments by our management and continuous evaluations by our security engineers. This approach is designed to mitigate the risks of data breaches or other security incidents originating from third-party sources. We have not encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: Vanguard Green Investment Ltd

ticker: VGES


text: Additional information on cybersecurity risks we face is discussed in Item 1A, "Risk Factors," which should be read in conjunction with the information in this section.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: As of April 1, 2024, to our knowledge, our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats or previously identified cybersecurity incidents, but there is no assurance that we will not be materially affected in the future by such risks or future incidents. For more information on our cybersecurity related risks, see ITEM 1A. RISK FACTORS.

companyName: ROSS STORES, INC.

ticker: ROST


text: We are subject to various federal and state privacy and security laws, regulations, and requirements. These laws govern the collection, use, disclosure, protection, and maintenance of the individually identifiable information that we collect from consumers. We regularly assess our compliance with privacy and security requirements and conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.

companyName: eHealth, Inc.

ticker: EHTH


text: Stewart's cybersecurity function is led by Stewart's CISO, who reports to the Group President, Technology and Operations. The Group President, Technology and Operations, is responsible for all areas of Stewart's digital business strategy, enterprise technology solutions, innovation, and global information technology. The CISO leads a holistic security program to defend enterprises against emerging threats. He has served in various roles in information technology and security leadership for over 30 years.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: We engage third-party vendors and consultants throughout our business as needed. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate the third-party provider's cybersecurity capabilities. For new cloud-based third-party providers, we aim to review their cybersecurity practices to verify compliance with our cybersecurity standards. This process is documented through our Cloud Services Assessment. Additionally, we endeavor to include cybersecurity requirements in our contracts with third-party providers and endeavor to require them to adhere to our cybersecurity standards and protocols. Further, we require any third-party service providers with access to personally identifiable information to enter into data processing services agreements and adhere to our policies and standards.

companyName: Chord Energy Corp

ticker: CHRD


text: Our management and Board recognize the critical importance of addressing cybersecurity threats and risks to our business and operations. Therefore, we have established a comprehensive framework to assess, respond to, and manage material risks arising from cybersecurity threats.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Cybersecurity Risk Management and Oversight Strategy for Management of Cybersecurity Risk Cybersecurity, resilience and data privacy are important to maintaining our proprietary information and the trust of our customers, suppliers and employees, and we recognize the importance of working to secure our data and information systems from potential cybersecurity and data privacy incidents. We are a large global manufacturer with sites around the world, and we identify and assess our cybersecurity risk through that lens. Securing the execution and control of our manufacturing operations, to the extent implemented through digital technology, is a primary area of focus. We also face risks encountered by substantially all large global companies such as the risks of intellectual property and information being compromised, fraud, business interruption and violation of privacy or security laws.

companyName: Celanese Corp

ticker: CE


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company has implemented or is in the process of continuously evaluating, testing and updating various information security processes and policies designed to identify, assess and manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to the Company's residents' and employees' personal data.

companyName: Veris Residential, L.P.


text: The Company assesses cybersecurity risks on an ongoing basis, including assessing and deploying technical safeguards designed to protect its information systems from cybersecurity threats. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements and examine the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing, incident response exercises, maturity assessments, and industry benchmarking.

companyName: MONRO, INC.

ticker: MNRO


text: The Company has also engaged a third -party managed service provider to manage server, network, and email security, including continuous monitoring and industry-leading antivirus software. Presidio Property Trust has robust business continuity and disaster recovery procedures in place, and an insurance policy that provides for network security liability, event response and recovery, direct business interruption, contingent business interruption, cyber extortion, social engineering, and computer fraud should an incident occur.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: Risk Management & Strategy Cybersecurity is identified as a top enterprise risk given the company's reliance on information technology systems and networks for business and operational activities. Linde has taken steps to address these risks and concerns by implementing cybersecurity and risk management processes that include advanced security technologies, internal controls, network and data center resiliency and disaster recovery processes.

companyName: LINDE PLC

ticker: LIN


text: We take a risk-based approach to cybersecurity and have implemented policies throughout our operations that are designed to address cybersecurity threats and our response to actual or suspected incidents. In particular, the Information Security Governance Committee is responsible for the ongoing identification and assessment of reasonably foreseeable cybersecurity threats and based on these assessments, evaluating and overseeing the implementation of safeguards for limiting such risks, including employee training and compliance, and detection and prevention mechanisms. If a cybersecurity incident occurs, the Information Security Governance Committee will assemble an incident response team responsible for the identification, remediation, and post-incident review of such incident, engage outside advisors and notify third parties as appropriate, and assess the materiality of the nature, scope, and timing of a given incident and whether public disclosure is required.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Personnel and Third-Party Engagement Our Information Technology department is led by the Director of Technology and Innovation who has more than twenty-five years of experience in technology management and cybersecurity, conducts regular risk assessments and continuously monitors our networks and systems.

companyName: Good Times Restaurants Inc.

ticker: GTIM


text: Cybersecurity Governance Onex Corp. has a dedicated cybersecurity team, led by the Managing Director – Enterprise Technology Services, who works closely with senior management, including Onex Corp.'s Chief Financial Officer, to develop and advance the firm's cybersecurity strategy, which applies to us.

companyName: Onex Direct Lending BDC Fund


text: The Audit Committee, in coordination with the Risk Management Steering Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee and the Risk Management Steering Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Risk Management Steering Committee promptly receives information regarding cybersecurity incidents and elevates information to the Audit Committee about incidents when appropriate, as well as ongoing updates regarding any such incident until it has been addressed. The Audit Committee also receives routine executive reports on cybersecurity risk management from the GC, SVP-Ops and GVP-IT. On an annual basis, the Board of Directors discusses our approach to cybersecurity risk management with a representative of the Risk Management Steering Committee.

companyName: Vizio Holding Corp.


text: Our management team, including the Chief Financial Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors. There is also an annual senior management meeting and report to our CEO and COO that follows our internal information security audit, which is overseen by the CEO.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: Conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;

companyName: AvePoint, Inc.

ticker: AVPT


text: Company maintains an Enterprise Risk Management ("ERM") program, which includes processes for key risk identification, mitigation efforts, and day-to-day management of risks, including cybersecurity risks. The ERM program is administered by our risk management committee, consisting of the Company's Chief Executive Officer, Chief Financial Officer, and Vice President, Compliance & Risk Management, and involves our outsourced global cybersecurity team, which possesses significant knowledge and expertise in cybersecurity risks.

companyName: Unique Logistics International, Inc.


text: We use independent third-party service providers to perform penetration testing of our infrastructure to help us better understand the effectiveness of our controls, improve our defenses, and conduct assessments of our program for compliance with regulatory requirements and industry guidelines.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: As part of our information security program, we undertake efforts to monitor new and emerging risks and evaluate the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing (including penetration testing), incident response exercises, maturity assessments, and industry benchmarking. In connection with these efforts, we use, on an as-needed basis, certain third-parties, including auditors, consultants, and others, that have particular cyber expertise.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: As part of the risk management oversight (including oversight of cyber risks) of the audit committee of our Board of Directors, our audit committee regularly interacts with, and receives reports from, our management, the Investment Adviser, AGM, and other service providers. The audit committee of our board of directors receives presentations and reports on cybersecurity risks from AGM's CSO or CISO, at least annually, and they address a wide range of topics including recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to AGM's peers and third parties. Additionally, AGM and other service providers periodically report to management as it relates to our cybersecurity practices.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: The Nominating and Corporate Governance Committee, which is comprised entirely of independent directors, reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile both at its regularly scheduled meetings and, if appropriate, in real time. Cybersecurity Leadership, members of the cybersecurity team, or other advisors, as requested by the Nominating and Corporate Governance Committee, report at least quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Nominating and Corporate Governance Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Reporting to the Nominating and Corporate Governance Committee is multi-format and includes both live presentations and memoranda. The Board believes that this regular cadence of reporting helps to provide the Nominating and Corporate Governance Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Nominating and Corporate Governance Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities, including our cybersecurity and business interruption insurance coverages, and the effectiveness of the Company's escalation procedures. Based on these management reports, the Nominating and Corporate Governance Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated by management on an as needed basis to the Nominating and Corporate Governance Committee. The Nominating and Corporate Governance Committee may also escalate such issues to the full Board at any time.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: from Cybersecurity Threats have not encountered cybersecurity challenges that have materially impaired our business strategy, results of operations, or financial condition during the financial year ended December 31, 2023.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: The Audit & Finance Committee regularly reviews our cybersecurity program with our CIO and management and reports to the Board of Directors. Cybersecurity reviews by the Audit & Finance Committee generally occur annually, or more frequently as determined to be necessary or advisable. Additionally, on a quarterly basis, members of the Audit & Finance Committee receive updates from our CIO regarding matters of cybersecurity, including, but not limited to, information on new and/or existing cybersecurity risks and management's response to such risks, cybersecurity and data privacy incidents, if any, and status on key information security initiatives.

companyName: Westrock Coffee Co

ticker: WEST


text: The Sponsor's Vice President of IT & Cybersecurity, Mr. Tiago DeMesquita, is responsible for identifying, assessing and managing the Sponsor's risks from cybersecurity threats. Mr. DeMesquita has over 5 years of experience in technology and cybersecurity. Mr. DeMesquita heads the Cybersecurity Committee of the Sponsor which meets regularly to evaluate strategies, governance, risk management, compliance, engineering and development, security operations, and incident management. In addition, the Sponsor maintains a cybersecurity insurance policy.

companyName: Hashdex Commodities Trust

ticker: DEFI


text: Our senior management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Cybersecurity Program at the Audit Committee's quarterly meetings. Routine reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident and consults with the Audit Committee chair in connection with any material decisions or actions related thereto.

companyName: MSC INCOME FUND, INC.

ticker: MSIF


text: Our CTPO is responsible for assessing and managing the Company's material risks from cybersecurity threats, and our CISO reports directly to our CTPO regarding such threats. Our CTPO is informed about and monitors the prevention, detection, mitigation and remediation or cybersecurity incidents through the management of and participation in the Company's Internal Audit team, Incident Response Team and Cybersecurity Task Force, as described above. As discussed above, our CTPO or CISO reports biannually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters. To the extent a material cybersecurity incident occurs, our CTPO and broader management team would inform the chair of our Audit Committee of the nature, scope and impact of the incident, and involve the other members of the Audit Committee or the full Board as necessary to evaluate the risks and determine next steps. Our CTPO and CISO have served in these roles since 2023. Our CTPO has more than 20 years of experience in various senior leadership roles involving managing cybersecurity and compliance teams, including as Head of Tech and Digital at Lovevery and as Chief Technology and Product Officer at Zulilly. O ur CISO has more than 20 years of experience in leadership roles focused on cybersecurity, cloud engineering, infrastructure, and technical operations, including as CISO and Head of Cloud and Infrastructure Engineering at AutoZone and as Principal Executive Advisory Consultant at Amazon Web Services.

companyName: TheRealReal, Inc.

ticker: REAL


text: JFG's Chief Information Security Officer ("CISO") and his Global Information Security team ("GIS") oversee JFG's cybersecurity program and exercise overall responsibility for the strategic vision and the design, development, and implementation of, and adherence to, the program's protocols. The comprehensive program includes policies and procedures designed to protect JFG systems, operations, and the data entrusted to it, including by us, from anticipated threats or hazards. The program applies seven layers of controls: governance, identification, protection, detection, response, recovery, and third-party vendor management. Protective measures include, where appropriate, physical and digital access controls, software security and patch management, identity verification, mobile device management, data loss prevention solutions, employee cybersecurity awareness communications and best practices training programs, security baselines and tools to detect and report anomalous activity, service provider risk assessments, network monitoring of data usage, hardware and software, and data erasure and media disposal, among others. Measures, policies and standards are aligned with industry-leading frameworks, such as those promulgated by the International Organization for Standardization and the National Institute of Standards and Technology ("NIST").

companyName: Senior Credit Investments, LLC


text: The Information Security Program is designed with a defense-in-depth mentality, using a variety of techniques, tools, policies, and procedures to create a layered security posture against the various methods of cybersecurity attack and compromise. The day-to-day management and monitoring of the program's technical aspects are handled by the ISO and the Information Technology team. They are responsible for user access and permissions control, system and network monitoring, vulnerability detection and mitigation, employee security awareness and training, and creating and maintaining technology and information security policies. The Corporation does engage with third parties, including a managed security service provider, to assist with or enhance aspects of the day-to-day Information Security Program. The ISO and IT team are currently in the process of strengthening the overall program by aligning controls and procedures with the Cybersecurity Frameworks established by the Center for Internet Security (CIS) and Cyber Risk Institute (CRI).

companyName: FIRST KEYSTONE CORP

ticker: FKYS


text: As part of our cybersecurity risk management program, we undertake ongoing cybersecurity risk assessments to help us detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal cyber operations team. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing. We have implemented measures designed to address the risks associated with the use of industrial control systems to help maintain the reliability and safety of our operations. Our information technology and operational technology disaster recovery program is designed to help maintain the continuity of critical business operations in the event of a disruptive cybersecurity incident through procedures for data recovery, system restoration, and business resumption. We engage third-party cybersecurity consultants to provide cybersecurity audits, targeted attack testing, cybersecurity threat intelligence and cybersecurity incident response services. We also operate a threat hunting program to help us identify potential cybersecurity threats in our systems. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential incidents.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Risks from Cybersecurity Threats From time to time, the Corporation has experienced attempts by unauthorized parties to access or disrupt its information technology systems. To date, it has not experienced any known material breaches or material losses related to cyber-attacks. However, a failure of the Corporation's information systems or a cybersecurity breach could materially and adversely affect its business, results of operations and financial condition. The Corporation manages its cybersecurity risk by limiting its threat landscape. For example, the Corporation does not store, transmit or process many of the types of data commonly targeted in cyber-attacks, such as consumer credit card or financial information. The Corporation recognizes cyber-threats are a permanent part of the risk landscape, and new threats are constantly evolving. For these and other reasons, cybersecurity is a top risk management priority.

companyName: AMPCO PITTSBURGH CORP

ticker: AP


text: Our assessment and management of material risks from cybersecurity and privacy threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. In addition, the information security team works with management to prioritize our risks that are more likely to have a material impact on our business and our CISO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the technology committee of the board of directors (the "technology committee") and the board of directors. In addition, the audit committee of the board of directors (the "audit committee") oversees our overall enterprise risk management program and receives semi-annual updates on cybersecurity and privacy threat-related risks as part of such program.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: As part of the Company's incident response plan, a committee known as the Cyber ERM (Enterprise Risk Management) Committee has been established comprising cross-functional representation across the Company. The Cyber ERM is responsible for implementing a rapid response and incident program in the event of an identified cybersecurity threat and is responsible for reporting all incidents to the Audit Committee and Board of Directors in the case of any cybersecurity incident to enable the Audit Committee and Board of Directors to assess the materiality of any such incident and determine any Exchange Act reporting obligations of the Company in connection therewith.

companyName: Veris Residential, L.P.


text: Multi-Layered Defense and Continuous Monitoring - We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. We use a third-party Managed Security Service Provider (MSSP) to provide comprehensive cyber threat detection and response capabilities and maintain a 24x7 monitoring system which complements the technology, processes, and threat detection techniques we use to monitor, manage, and mitigate cybersecurity threats. At least annually, we engage third party consultants or auditors to assist in assessing, identifying and/or managing cybersecurity threats.

companyName: Eagle Bancorp Montana, Inc.

ticker: EBMT


text: The Board provides regular oversight of the Company's cybersecurity risk management program. The CISO presents to the Board and the audit committee of our Board (the " Audit Committee ") at least annually and quarterly updates via business review dashboards. The Board provides guidance to the CISO, including with respect to any changes to business priorities, risk tolerance, or security initiatives. These briefings are also augmented by ongoing and continuous interactions between the Board and the CISO, as needed.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Our cybersecurity risk management program provides a framework for handling cybersecurity threats and incidents, including receiving notification of threats and incidents associated with the use of services provided by business associates. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider and implementing cybersecurity countermeasures and mitigation strategies. In addition, it provides steps for our cybersecurity team to report to management and our Board of Directors on information security and cybersecurity matters including material cybersecurity threats and incidents.

companyName: Progyny, Inc.

ticker: PGNY


text: (iii) containment, eradication and recovery; and (iv) post-incident activity. Our CISO and ISSO are responsible for developing, implementing, coordinating, and maintaining IT security policy and procedures. These individuals also fill the role of Computer Incident Response Team (CIRT) Leaders. They are responsible for the operations of the system and its applications, including reporting, responding to security incidents, and ensuring that adequate event logging is enabled. Our ISSO is responsible for the security of the system and for ensuring incident response (IR) policy and plan are documented, followed, that the IR plan is tested annually, updated with lessons learned from training exercises and on-going incident handling activities, and periodically reviewed at least on an annual basis. This person also fills the role of Deputy CIRT Leader. Our CISO is responsible for information security within the organization and is responsible for the review and approval of the incident response policy and plan. General end-users and non-CIRT personnel are responsible for actively securing their systems and notifying the CIRT of any suspected information security incident (e.g., potential virus detection, phishing emails, potential malware infection, etc.).

companyName: Cycurion, Inc.

ticker: CYCU


text: Notwithstanding the focus Premier places on cybersecurity, Premier may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this Form 10-K, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: PREMIER FINANCIAL CORP


text: We take a comprehensive approach to managing cybersecurity risk, starting with the integration of cybersecurity risk into our overall enterprise risk management framework, among other significant risks to the Company.

companyName: DecisionPoint Systems, Inc.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; Director of Corporate Security; and the Information Security Manager. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.

companyName: CONTINENTAL RESOURCES, INC


text: We face a number of cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, we have experienced threats to our data and systems, including malware and computer virus attacks. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Any material disruption of our information systems could disrupt our business and reduce our sales" and "A data security or privacy breach could damage our reputation, harm our customer relationships, expose us to litigation or government actions, and result in a material adverse effect to our business, financial condition and results of operations."

companyName: Fossil Group, Inc.

ticker: FOSL


text: Leadership of our cybersecurity efforts is provided by our VP, Global Information Security, a seasoned expert with over a decade of experience. This role ensures continuous program improvement and alignments with evolving threats and standards.

companyName: MASIMO CORP

ticker: MASI


text: Our cybersecurity risk management processes and policies include the following: • We seek to deploy best practice cybersecurity standards promulgated by the National Institute of Standards and Technology Cybersecurity (NIST), the International Organization for Standardization and the Center for Internet Security. • We employ a dedicated cybersecurity team who routinely conduct specific risk assessments and endeavor to mitigate identified risks. This team is responsible for implementing measures to detect, prevent and respond to threats and malicious activity. We also maintain a Security Operations Center (SOC) that provides a mechanism for addressing cyberthreats before they comprise data security. • The cybersecurity team operates, maintains and monitors an integrated eco-system of security tools designed to detect, prevent and respond to threats and malicious activity. These tools include, but are not limited to, next generation firewalls, anti-malware, IPS / IDS, end point protection, encryption, email and cloud app security, privileged access management, vulnerability scanning / patching. These are a blend of on-premise, cloud and network hosted tools. Monitoring activities include threat hunting and use of multiple intelligence sources to manage and respond to events. • Access to information is subject to authorization, review, classification and substantially controlled through multi-factor authentication. • All employees and contractors who are issued a Tronox user account for our IT system must complete and pass cybersecurity training before being provided full system access. • All employees and contractors with access to our IT systems must complete and pass a mandatory annual cybersecurity awareness training and acknowledgement of Tronox's Acceptable Use Policy. Failure to complete the training successfully may result in further system access restrictions and HR escalation. • We periodically orchestrate simulated phishing attacks on all IT system users and those who fall victim to the simulated attacks are required to take additional mandatory cybersecurity training. • To reduce the risk of phishing attacks, we have identified groups of Tronox employees and contractors who do not require access to external emails in order to perform their work responsibilities and begun a process of blocking their external emails. • We have a written Incident Response Plan that encompasses a range of activities to detect, respond to and recover from cybersecurity incidents, including compliance with applicable legal obligations and mitigation damage. • We work closely with a number of regional and international bodies from which we draw intelligence and contribute to cybersecurity initiatives such as incident simulation exercises and development working groups. • We regularly evaluate the appropriateness of cyber insurance coverage in light of the cyber risks we face and we do not currently carry cyber insurance.

companyName: Tronox Holdings plc

ticker: TROX


text: To date, the Company has not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations or financial condition; however, there can be no guarantee that we will not experience such an incident in the future.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: To date, our business strategy, results of operations or financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. The sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. For more information on our cybersecurity related risks, see "Item 1A—Risk Factors—Risks Relating to Our Business" in this Annual Report on Form 10-K.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on an annual basis.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: The Company's Information Security Program includes key program stakeholders who meet regularly to discuss and execute on continually improving the Company's Information Security Program through ongoing initiatives. The Company implements a formal Information Security Program aligning to industry best practices and focuses on the following key areas to mitigate cyber risks: i. Risk Assessment – At least annually, a risk assessment is conducted that incorporates other security assessments and testing conducted throughout the year, ongoing and completed security initiatives, evaluation of the cyber threat landscape, compliance, incidents, etc. The assessment results are presented to executive management and the Board of Directors.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our Board and our management actively oversee our risk management program, including the management of cybersecurity risks. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that the Company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: SOLITRON DEVICES INC

ticker: SODI


text: The federal Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") impose minimum standards on covered entities, such as health insurers, for the privacy and security of protected health information ("PHI"). The Health Information Technology for Economic and Clinical Health Act, enacted in 2009 ("HITECH") provides for the extension of certain privacy and security provisions of HIPAA to business associates of covered entities that handle electronic PHI. Xchange specializes in accident and health insurance and is a business associate of the health insurers carriers it partners with, making it subject to compliance with the provisions of HITECH and HIPAA applicable to business associates.

companyName: OCTAVE SPECIALTY GROUP INC

ticker: OSG


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.

companyName: PRUCO LIFE INSURANCE CO


text: We have established policies and processes for assessing, identifying and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing within these systems.

companyName: Lite Strategy, Inc.

ticker: LITS


text: This cross-functional team possesses a comprehensive understanding of cybersecurity, data privacy, and risk management, essential in developing, monitoring, and enforcing our cybersecurity strategy.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: The Director of Internal Audit, in their capacity, regularly informs the Chief Executive Officer ("CEO"), the Chair of the Audit Committee, and other members of management of aspects related to cybersecurity risks and incidents. This ensures that the appropriate levels of management are kept abreast of the cybersecurity posture and potential risks facing SandRidge. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: SANDRIDGE ENERGY INC

ticker: SD


text: We use certain cloud-based third-party vendors for the core trading systems of certain of our exchanges and certain of our governance products and solutions. Prior to engaging such vendors, we analyze each provider's SOC2 certifications, perform due diligence testing for information security and interoperability with our systems, and annually review the SOC2 certifications. Our security assurance and threat assessment team, within our Information Security organization, collaborates with our external threat intelligence providers to proactively review Nasdaq, and our vendors with respect to emerging threats and associated risks.

companyName: NASDAQ, INC.

ticker: NDAQ


text: The Enterprise-Wide Risk Management Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the CISO provides information security updates to the Enterprise-Wide Risk Management Committee at each Enterprise-Wide Risk Management Committee meeting. Additional information security training to the committee is provided through a management Information Security Steering Committee and also through targeted training overseen by the CISO. In addition, as discussed below, the Corporation has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Corporation. The Incident Response Plan is implemented and maintained by the CISO and is subject to annual review and approval by the Enterprise-Wide Risk Management Committee. Cybersecurity metrics are reported to both management level committees and the Enterprise-Wide Risk Management Committee on a quarterly basis.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our Board of Directors has established robust oversight mechanisms to support effective governance in managing risks associated with cybersecurity threats. All of our Board members have experience in the tech industry. Data protection under their guidance and oversight remains a strategic priority at the highest levels of our organization. The Audit Committee is responsible for oversight of our information security program and is consulted with at least twice a year by management. Our VP of Internal Audit leads an annual internal audit plan, and its status and internal audit findings are reported to the Audit Committee on a quarterly basis. Our cybersecurity strategies and initiatives are refined by the continuous dialogue and the rich insight of our Board members.

companyName: JFrog Ltd

ticker: FROG


text: Our cybersecurity risk program also includes a documented incident response plan to be used in the event of a cybersecurity incident. The incident response plan provides for certain responses based on various factors of a cybersecurity incident and integrates with our enterprise crisis management program.

companyName: Celanese Corp

ticker: CE


text: Wesbanco maintains an Information Security and Cybersecurity program that is responsive to statutory and regulatory requirements, which includes policies, standards, rigorous testing by internal and external parties pursuant to those standards and policies and operating procedures. Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to help ensure that the security control infrastructure adequately addresses current and emerging technical threats with appropriate countermeasures. This oftentimes includes the engagement of consultative assistance for each of the three lines of defense to ensure appropriate technical expertise exists in the control area that is being evaluated and to maintain best practices.

companyName: WESBANCO INC

ticker: WSBC


text: The Information Security Team is segmented into three distinct sections: IDR, Secure Development ("SDLC"), and Infrastructure and Access Control ("IAC"). Furthermore, it collaborates with our product groups to integrate security measures into our products and services, thereby enhancing the overall security posture for our customers.

companyName: Satellogic Inc.

ticker: SATL


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles. Our CIO is supported by a dedicated team of cybersecurity professionals in addition to managed services and retained external experts.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: The Board oversees the Company's overall ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee is responsible for overseeing our risk exposure to information security, cybersecurity, and data protection, as well as the steps management has taken to monitor and control such exposures, and regularly provides reports to the Board on cybersecurity risk management. The Audit Committee Charter explicitly sets forth the Audit Committee's responsibility for such oversight. The Audit Committee receives regular presentations and reports from our Executive Director of Cybersecurity and Infrastructure and our CIO on cybersecurity risks and prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds. Our Executive Director of Cybersecurity and Infrastructure and our CIO also report to the Board at least annually and to Audit Committee at least quarterly on current internal and external developments in cybersecurity, as part of the Board's enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk. We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer who reports to our Chief Executive Officer, to manage the risk assessment and mitigation process.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: Inc. recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: SideChannel, Inc.

ticker: SDCH


text: The Company's cybersecurity risk management program is supervised by the Managing Director of Enterprise Security who reports directly to the CISO. The Chief Information Officer and CISO regularly update senior leadership and the executive committee on cybersecurity risks.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: We have implemented an internal risk assessment process that focuses on the principal risks that have been identified for us, including risks associated with our regulatory environment, business operations and continuity, compliance requirements, information technology and data storage and retrieval facilities, cyber risk, insurance coverage. The Audit Committee, pursuant to its charter, meets at least quarterly with senior leadership and other employees to discuss identified risks and the measures taken to control, manage and mitigate those risks, which include cyber and information security risk. On the basis of these meetings and discussions regarding such risks, the Chairman of the Audit Committee reports periodically to the full Board. The Vice President, Information Security Officer provides cybersecurity updates to the Audit Committee and other members of our senior management as appropriate at least quarterly. Our Vice President, Information Security Officer, and his team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, with the support of third-party experts. The Vice President, Information Security Officer has over 30 years of experience in information technology of which over 20 years is in cybersecurity, with industry experience in utilities, banking and e-commerce.

companyName: H2O AMERICA

ticker: HTO


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our board of directors for certain cybersecurity incidents.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Key elements of our cybersecurity processes include, but are not limited to, the following: • Firewalls, data encryption and tokenization, multifactor authentication and data backup, among other safeguarding tactics; • Routine tests of our back up processes, the physical security of our data storage and access to systems via penetration testing; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • Training and testing of the diligence and awareness of our employees regarding social engineering email and other cybersecurity schemes and risks; • Engaging third-party cybersecurity companies periodically to assess our cybersecurity posture and assist with identifying and remediating cybersecurity risks; and • Contractual commitments from vendor partners and a review of controls at vendor partners via System and Organization Controls reports.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Our executive management team, along with our managed information technology service provider, is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems. The team has primary responsibility for our overall cybersecurity risk management program. Our management team works closely with our information technology service provider.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: CoreCard's information technology network, infrastructure, and software systems, including integration points to third parties related to the FinTech services the Company offers, are critical to the Company's business and operations. The Company holds confidential, proprietary, and personal information about its customers, its customers' customers, employed or contracted personnel, and third-party vendors. In addition, the Company's business in the FinTech industry requires it to be compliant with Payment Card Industry (PCI) Data Security Standards and U.S. and foreign data and information security mandates specific to its operations and services. To address these items, CoreCard has developed a robust cybersecurity risk management program focused on identifying, assessing and managing cybersecurity risk. The program involves a dedicated team responsible for operational cybersecurity, and includes an internal IT Security Team, PCI Compliance Force, and Emergency Management Team, which together are responsible for developing and executing the Company's cybersecurity strategy and identifying and mitigating related risks.

companyName: CoreCard Corp

ticker: CCRD


text: Our cybersecurity program includes a variety of processes to assess, identify and manage risks from cybersecurity threats arising from our own and third-party provided systems, including annual training requirements, simulation exercises, threat monitoring and detection tools (including those using artificial intelligence and machine learning), threat containment methods, risk assessments, third-party penetration testing and security requirements for our suppliers and other third parties. We have established processes providing for review of identified cybersecurity incidents by a cross-functional cybersecurity incident response team who monitors and manages the detection, assessment, mitigation and remediation of cybersecurity incidents and escalates incidents to the Chief Information and Security Officer and to our disclosure review board, which evaluates such incidents for materiality and potential disclosure, and works to ensure that members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. Our cybersecurity incident response team and disclosure review board are comprised of subject matter experts, including employees in cybersecurity, information technology and other areas, to evaluate potential security, financial, operational, reputational and other risks, and to address our process. We also engage third parties to enhance and strengthen our cybersecurity program, to provide additional capabilities and support and to provide periodic independent assessments and evaluations of our cybersecurity program. Third parties also provide managed services for security operations, incident response, and security remediation services.

companyName: ACCURAY INC

ticker: ARAY


text: To protect the information that we gather and the availability of our IT systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes continuous detection, prevention and monitoring from an external cybersecurity service provider. A cybersecurity threat is any potential unauthorized occurrence, or a series related to unauthorized occurrences, on or conducted through our information systems or the information systems of a third party that we utilize in our business which may adversely affect the confidentiality, integrity or availability of our information systems or any information residing therein. Our cybersecurity policies, standards, processes and practices are based on the Center for Internet Security Critical Security Controls framework and include the following components:

companyName: POTBELLY CORP

ticker: PBPB


text: We have developed policies and processes for assessing, identifying, and managing material risk from cybersecurity threats informed by industry-recognized standards. We have integrated these processes into our overall risk management systems and programs. Our cybersecurity program includes, among other things: procedures to assess material risk from cybersecurity threats, protocols to monitor any potential unauthorized access to, or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein, mechanisms to safeguard network infrastructure, mandatory employee training on information security, and assessing the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. As part of our risk management process, we have engaged and expect to continue to engage third party experts to help identify and assess risks from cybersecurity threats. Our risk management process is also designed to address cybersecurity risks associated with our use of third-party service providers, and includes procedures such as reviewing security audits and controls of these providers during the onboarding process.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: Risk Management and Strategy face various cyber risks, including, but not limited to, risks related to unauthorized access, misuse, customer data theft, computer viruses, system disruptions, ransomware, malicious software and other intrusions. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security threats through our cybersecurity risk management program 24/7.

companyName: NETSOL TECHNOLOGIES INC

ticker: NTWK


text: Starbucks has implemented a cybersecurity program that leverages industry-standard cybersecurity frameworks to assess, identify, and manage cybersecurity risk. Our cybersecurity program is integrated with the Enterprise Risk Management ("ERM") framework and governance processes utilized by management and our Board to oversee our various top enterprise risks. Our internal audit function periodically evaluates our cybersecurity program and selected aspects of it.

companyName: STARBUCKS CORP

ticker: SBUX


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 10 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.

companyName: FS Credit Real Estate Income Trust, Inc.


text: Board of Directors plays a critical role in the oversight of risk, including risks from cybersecurity threats, and has established a risk oversight structure that seeks to ensure that cybersecurity risks are identified, monitored, assessed, and mitigated appropriately.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Coupang has a cyber risk management framework designed to identify, assess, and manage cyber related risks. Cyber related risks are identified through self-identification, audits, assessments, and incidents. Our vulnerability scanning process uses both automated tools and penetration testing to identify vulnerabilities within our environment.

companyName: Coupang, Inc.

ticker: CPNG


text: Management is responsible for implementing and monitoring the Company's cybersecurity framework, assessing risks, coordinating incident response efforts, and maintaining policies and practices to mitigate cybersecurity risks. The Board is informed of material cybersecurity risks or incidents as they arise and reviews management's responses and remediation activities.

companyName: Hartford Creative Group, Inc.

ticker: HFUS


text: Our management Compliance Committee reviews our cybersecurity risk across the enterprise and our cybersecurity strategy framework and operational posture. The Compliance Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls to (a) identify, assess, monitor, and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: Our management team's experience includes a diverse background in telecom, financial services and other industries, with decades of experience in various aspects of technology and cybersecurity. Our SVP and Head of Technology Services has more than 30 years of leadership experience, including delivering technology solutions and designing and building new business strategies in regulated businesses and our Director Cybersecurity and IT Infrastructure has more than 20 years of cybersecurity and information technology experience and is a Certified Information System Security Professional. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: The Company's Chief Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee. Our Chief Information Security Officer has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.

companyName: Sinclair, Inc.

ticker: SBGI


text: To address risks associated with third-parties, Prudential has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: Internal Audit serves as the third line of defense and provides independent assurance on how effectively we are mitigating, managing, and challenging our cybersecurity risks.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Our Director of Information Technology, Mitch Reszczenski, is primarily responsible for assessing and managing our cybersecurity risks. Mr. Reszczenski has over 28 years of extensive information technology experience in highly successful manufacturing, engineering and financial organizations. Mr. Reszczenski provides regular updates on cybersecurity risks and threats and key developments in Company policies, practices and related risk exposures to the Chief Executive Officer and Chief Financial Officer. Additionally, senior management provides an update to the Board of Directors on cybersecurity matters at least once a year, and more often as appropriate. The Board of Directors annually reviews and approves the capital and operating budgets, ultimately reviewing and approving the amount spent by the Company on cybersecurity measures.

companyName: TAYLOR DEVICES, INC.

ticker: TAYD


text: We recognize the ever-present global risk of cyberattacks from diverse threat actors, including nation-states, cybercriminals, hacktivists, insiders and organized crime. In spite of our efforts, we (or third parties we rely on) may not be able to fully, continuously and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement, but it is possible we may not implement appropriate controls if we do not recognize, or we underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Further, even events that are detected by security tools or third parties may not always be immediately understood or acted upon. While no organization is immune to attack attempts and we cannot eliminate all risks from cybersecurity threats or provide assurance that we have not experienced an undetected cybersecurity incident, in 2024 we did not identify any material cybersecurity events that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. For additional information regarding risks from cybersecurity threats, including our business strategy, results of operations, or financial condition, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "We face risks related to cyber security attacks and other incidents."

companyName: Village Farms International, Inc.

ticker: VFF


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee pursuant to its charter. Our Audit Committee is primarily responsible for monitoring and assessing strategic risk exposure and receives periodic updates from management at Audit Committee meetings regarding cybersecurity threat risks and management's strategies to manage the same, and our management is responsible for the day-to-day management of the material risks we face. Our Audit Committee reports to the board of directors regarding its activities, including with respect to cybersecurity risk oversight as appropriate, on a quarterly basis.

companyName: RxSight, Inc.

ticker: RXST


text: We also utilize the services of third -party providers to conduct an IT audit, external and internal vulnerability testing, external and internal penetration testing, and social engineering testing on at least an annual basis. The results of these independent audits and tests are sent to the Board of Directors for review.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: Strategy and Governance Overview The Trust and the Fund do not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust and the Fund. The Sponsor is a wholly owned subsidiary of Franklin Resources, Inc. ("FRI"). FRI maintains global, firm-wide policies and procedures governing matters relating to crisis management, corporate continuity, business continuity planning and disaster recovery, enterprise business resilience, and corresponding risk mitigation processes and systems in these areas (collectively referred to as the "Global Corporate Continuity Program").

companyName: Franklin Templeton Holdings Trust

ticker: FGDL


text: As of the date of this Annual Report, we have not experienced a cybersecurity incident that results in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such an incident or risks related thereto.

companyName: CervoMed Inc.

ticker: CRVO


text: The ISMP was developed by the Company's information security team in collaboration with cross functional stakeholders, and is designed to ensure the organization's security posture and practices are in alignment with contractual, regulatory and industry requirements. Risk assessments against specified criteria are conducted no less than annually, and sooner if there are significant changes in the environment. Security services are delivered through a combination of internal and third party resources. Formal periodic meetings are held with Company's executive leadership to review relevant components of the ISMP, formal annual reviews of the policies are conducted, formal reviews of the entire ISMP and risk register are conducted at least annually, and more frequently if there are significant changes to the environment. Also, an independent review of the ISMP is conducted in the following ways: (i) an annual Health Insurance Portability and Accountability Act (HIPAA) risk assessment conducted by a third party; and (ii) a Health Information Trust Alliance (HITRUST) risk based two year assessment conducted by a third party.

companyName: Ontrak, Inc.

ticker: OTRKQ


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: Our Board of Directors is ultimately responsible for the Company's risk oversight, including cybersecurity and privacy risks. Our Board of Directors has delegated responsibility for oversight of cybersecurity risks to the Audit Committee. The Audit Committee comprises board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Our Audit Committee is charged with reviewing and discussing our policies with respect to risk assessment and risk management, which includes overseeing our major financial, privacy, security, cybersecurity, and technology risk exposures and the steps our management has taken to monitor and control these exposures. A t the management level, our Head of Engineering and the system operations team are primarily responsible for identifying, assessing, monitoring, and managing cybersecurity. Our team also regularly partners with a firm with cybersecurity specialists, implementing best practices and building a cybersecurity framework around identifying, protecting, detecting, responding, and recovering from cybersecurity threats. The Audit Committee receives reports from senior management, including our periodic committee meetings, which include, on a rotating basis, in-depth presentations on specific areas of risk and regular enterprise risk management updates. In addition to our scheduled meetings, our Global Incident Response Plan ensures that significant developments or incidents, even if immaterial to us, are reviewed regularly by a cross-functional team to determine whether further escalation to the Audit Committee is appropriate, ensuring the committee's and the Board of Directors' oversight is timely and responsive. Our Global Incident Response Plan also includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: BlackRock seeks to address cybersecurity risks through a global, multilayered strategy of control programs that is designed to preserve the confidentiality, integrity and availability of the information that BlackRock collects and stores by identifying, preventing and mitigating cybersecurity threats and incidents. As one of the critical elements of BlackRock's overall ERM framework, BlackRock's cybersecurity program is focused on the following key areas:

companyName: ISHARES GOLD TRUST

ticker: IAU


text: Item 3. Legal Proceedings. From time to time, the Company and its subsidiaries may become involved in actions, claims, suits or other legal or administrative proceedings arising in the ordinary course of business. The Company does not expect, based on circumstances currently known, that the ultimate resolution of any of these proceedings will have, either individually or in the aggregate, a material adverse effect on the Company's consolidated financial position, results of operations or cash flows. We hereby incorporate by reference Note 10 (Commitments and Contingencies) to the Consolidated Financial Statements included in Part II, Item 8. "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K.

companyName: Cars.com Inc.

ticker: CARS


text: Our full Board of Directors has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, and, in conjunction with the Audit Committee, the related effects, if any, on financial reporting and internal controls. Our Chief Information Security Officer, Chief Technology Officer, and Chief Legal Officer regularly update the Board of Directors on the Company's cybersecurity risk profile and incidents, if any, and our overall cybersecurity strategy and process improvements, including the results of "tabletop" exercises, as well as the Company's insurance coverages and related matters.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: As a cloud-based digital agreements and identity and authentication security solutions provider servicing customers in regulated industries, cybersecurity risk management is an important part of our identity. We maintain an enterprise cybersecurity risk management program designed to assess, identify, and manage material cybersecurity risks within our corporate information security environment and the systems we develop and operate for the benefit of our customers. Our cybersecurity risk management program is based upon best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements.

companyName: OneSpan Inc.

ticker: OSPN


text: Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond to and recover from cybersecurity incidents. These include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We have an IT continuity plan that we continuously review and update in line with our evolving applications architecture.

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our tenant and employee data or our systems. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: CONSOL Energy has not experienced any operational or financial impact as the result of a cybersecurity risk or incident and, at this time, the risks from cybersecurity threats are not reasonably likely to materially affect the Company's business strategy, results of operations or financial condition. However, it is prepared to mitigate and respond to such an event should it occur. CONSOL Energy has prepared a comprehensive Cybersecurity Incident Response Plan, as well as an Information Technology Disaster Recovery Plan. These plans are reviewed, updated and tested on a regular basis. Specifically, CONSOL Energy conducts cybersecurity tabletop exercises that include participation by Audit Committee members, senior management and third-party cybersecurity consultants.

companyName: Core Natural Resources, Inc.

ticker: CNR


text: Our Board actively oversees our risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies, including related to cybersecurity and the data protection program, and performs reviews and assessments of the primary operational and regulatory risks facing the Company, their relative magnitude and management's plan for mitigating these risks. At least annually, our CISO reports to the full Board with a comprehensive report addressing a broad range of topics, including significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.

companyName: 5&2 Studios, Inc.


text: The Company's Board of Directors oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually. In the event of a cybersecurity incident determined to be significant, management will notify the Board.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: We have processes to inform the Board Risk Committee and the Board about risks from cybersecurity threats. Our management team reports its findings using the FFIEC Cybersecurity Assessment Tool and our information security team's determination as to whether our security controls, at a minimum, are in place and effective. The Chief Information Security Officer and the information security team regularly report to the Board Risk Committee and the Board regarding cybersecurity and related threats and trends, changes, control effectiveness and residual risk, the areas where our cybersecurity program may be improved and improvements made to address and remediate issues.

companyName: HOPE BANCORP INC

ticker: HOPE


text: Our cybersecurity risk management program is managed by our Director of Information Technology (the "IT Director"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The IT Director has been with the organization since 2007, has a post-graduate degree in Information Security, and is a member of InfraGard, a partnership between the Federal Bureau of Investigation and members of the private sector for the protection of U.S. critical infrastructure. The IT Director is informed about and monitors prevention, detection, mitigation and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with dedicated internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our information technology environment. The IT Director provides periodic reports on cybersecurity risk to the audit committee of our board of directors, as well as our chief executive officer and other members of our senior management as appropriate.

companyName: OMEROS CORP

ticker: OMER


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting companies similar to ours operating in the technology, software and identification space. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board of directors and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective to prevent cyberattack incidents. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We have seen an increase in cyberattack volume, frequency, and sophistication. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that as of the date of this Annual Report on Form 10-K, risks from prior cybersecurity threats, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: authID Inc.

ticker: AUID


text: Platform Engineering Manager has over 5 years of experience and holds a bachelor's degree in computer science. The VP of Digital Engineering brings 19 years of expertise in digital transformations across various industries, holding leadership roles at Nordstrom, Walgreens, T-Mobile, and Sony PlayStation, with a Master's degree in Business Administration from the University of Michigan have robust logging systems in place to monitor our systems, and our response plan includes promptly identifying the executives and parties affected Governance: Our governance includes routing all production changes through approval processes and testing in the test environment adhere to SOX regulations to ensure proper documentation and signoffs for any production data alterations due to incorrect data entry the event of changes, we document the reason for the update, the responsible individual, and the details of what was modified (both before and after). Additionally, all modifications undergo verification by at least one individual before and after the change board holds oversight of the Company's risks related to cybersecurity risks.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity attack will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. See Part I, "Item 1A. Risk Factors" of this Annual Report for additional information about the risks to our business associated with a breach or other compromise to our information and operational technology systems.

companyName: ProPetro Holding Corp.

ticker: PUMP