text: We have developed a written incident response plan (IRP) that delineates the procedures to be followed for handling a variety of cybersecurity incidents; categorizes potential cybersecurity incidents and the required timeframe for reporting each; establishes cybersecurity incident response levels; provides for the conducting of legally privileged investigations to enable us to meet applicable legal obligations, including possible notification requirements; and outlines the roles and responsibilities for various personnel in the event of a cybersecurity incident.

companyName: CNX Resources Corp

ticker: CNX


text: The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. In particular, the CISO is focused on assessing, managing, mitigating and reporting on cybersecurity threats and risks and is tasked with overseeing and enhancing the security posture of the Company and it subsidiaries. This role involves prioritizing and implementing security initiatives across all organizational units. The CISO plays a critical role in protecting the Company's assets, data and reputation by developing a robust security strategy and security awareness. Our current CISO brings over 20 years of experience in IT operations and information security with a proven track record working in large financial institutions, mortgage companies and banks, with expertise in managing complex security environments. The CISO, in conjunction with other executive leaders such as the CIO and the Chief Legal Officer, manages the Company's cybersecurity posture.

companyName: Rithm Capital Corp.

ticker: RITM

secItem: Item 1C


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis. The Company's Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company's cybersecurity controls and generally meets on a quarterly basis. The Company's global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company's business units. The Company's CTO has been in his senior leadership role since 2020. He has held similar positions prior to joining News Corp, has over 30 years of experience in various cybersecurity and information technology infrastructure and risk management roles and holds an advanced degree in information systems. The Company's CISO has been in his senior leadership role since 2021 and has over two decades of industry experience in cybersecurity and other technology-related roles, including as the Director of Cyber and Telecom Policy in the White House, where he advised senior administration officials on cybersecurity, technology and telecommunications policy issues. As part of the Company's cybersecurity program, described above, the CISO is informed about and monitors the Company's prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company's cybersecurity team. The CISO works closely with representatives from the Company's legal group, including to oversee compliance with legal, regulatory and contractual security requirements. The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate. The Company's reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee, or the Board of Directors, as appropriate.

companyName: NEWS CORP

ticker: NWSA


text: We believe cybersecurity is critical to our Company. We ae not conducting material operations, so cybersecurity threats have not affected our business strategy or results of operations and the Board of Directors will assess the potential threat to future operations as such operations develop. The Board of Directors will oversee management's processes for identifying and mitigating risks, including cybersecurity risks, to facilitate mitigating our risks involved with cybersecurity. help align our risk exposure with our strategic objectives. The Board relies on its executive officers to identify cybersecurity risks and retains oversight of cybersecurity. In the event of an incident, we intend to take appropriate steps from incident detection to mitigation, recovery and notification of appropriate parties. Management is responsible for day-to-day monitoring of cybersecurity, including detection and response and to report risks and incidents to the Board of Directors. We rely on computer software provided by third parties to protect our computer systems against cybersecurity threats.

companyName: TechCom, Inc.

ticker: TCRI


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LIFECORE BIOMEDICAL, INC. \DE\

ticker: LFCR


text: In the event of a cybersecurity incident, we have third-party consultants that could assist with incident response plans and protocols to minimize the impact and facilitate swift recovery. During the calendar year 2024, there have been no known reported cybersecurity incidents that have materially affected our operations or financial results.

companyName: International Land Alliance Inc.

ticker: ILAL


text: Members of management report to our Chief Financial Officer who is the member of management that is principally responsible for overseeing our cybersecurity risk management program. Our Chief Financial Officer holds an undergraduate and graduate degree in economics and has over 15 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats. Additionally, our Senior Director of IT has served in various roles in information technology and information security for over 24 years. Our Senior Director of IT holds an undergraduate degree in information technology and has attained the following professional certifications: CompTIA Network+, CompTIA Security+, and Microsoft Certified Professional. Further, our Director of Corporate Business Systems holds a Bachelor of Science degree in Construction Science and Management and has over 9 years of experience with software implementations, technology innovation, and corporate business systems.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Refer to "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk management" section of this Form 10-K for additional information on our approach to risk management, including our governance framework. Refer to "Item 1A - Risk Factors" of this Form 10-K for additional information on our cybersecurity risks.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Our Board oversees management's implementation of our cybersecurity risk management program. Our executive management team is responsible for updating the Board, as necessary, regarding significant cybersecurity incidents. Our Board shall also receive period reports from management on our cybersecurity risks and cybersecurity risk management program.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: The company does not have a dedicated incident management team responsible for managing and coordinating its cybersecurity incident response efforts. We have limited exposure to cybersecurity risks. We are a small company.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: We have established comprehensive incident response and recovery plans and continue to regularly test and evaluate the effectiveness of those plans. Our incident response and recovery plans address and guide our employees, management and the Audit Committee on our response to a cybersecurity incident.

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: Our Board of Directors, through the Audit Committee, oversees the management of our technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies. The Audit Committee receives updates from the CIO on a quarterly basis, and more frequently as needed, regarding, among other relevant information, existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives. Our Board of Directors, through the Audit Committee, also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our data, including customer data. We have strategically integrated cybersecurity risk management into our broader risk management framework, and incorporate cybersecurity considerations into our decision-making processes. iRobot's IT department evaluates and addresses cybersecurity risks in alignment with our risk profile, business objectives, and operational needs. In support of these processes, we employ cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks.

companyName: IROBOT CORP

ticker: IRBTQ


text: The audit committee oversees risks related to cybersecurity, including the security of corporate information and the steps management is taking to monitor and control these risks. Management regularly briefs the audit committee on our cybersecurity risk profile, potential threats, and continuous improvement initiatives. Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes employee training, is aimed at routinely reviewing and, as necessary, enhancing our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: These processes are integral to our overall risk management system/processes and inform the identification and assessment of risks and mitigations through our Enterprise Risk Management (ERM) program. The ERM team, led by the SVP, Audit, Enterprise, Risk and Compliance (AERC) considers cybersecurity risks alongside other PSEG risks, and facilitates discussion with PSEG subject matter experts to identify cybersecurity risks, evaluate their potential severity and likelihood, identify mitigations, including those identified above, and assess the impact of those mitigations on residual risk. In addition, PSEG maintains a Risk Management Committee (RMC), responsible for assessing exposure to and determining PSEG's overall risk management strategy, including with respect to cybersecurity. The RMC, supported by the ERM function, is chaired by the SVP, AERC and consists of members of senior management including the CIDO and six of the CEO's other direct reports. In discharging its responsibilities related to cybersecurity threats, the RMC has received presentations from the CISO. To date, there has been no material impact or reasonably likely material impact on our business strategy, results of operations or financial condition from cybersecurity attacks or incidents, including as a result of prior cybersecurity incidents.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors - We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."

companyName: EVERTEC, Inc.

ticker: EVTC


text: In addition, the assessment, identification and management of cybersecurity risks has been integrated into our ERM efforts. As part of that annual process, cybersecurity risks across our businesses are included in the risk universe that our Executive Risk Committee (consisting of members of Company senior management) evaluates to identify our top enterprise risks and develop related mitigation plans. The cybersecurity and other risks are reviewed during the year through our ERM process and discussed with our Audit Committee at least semi-annually and with our board of directors at least annually.

companyName: Angi Inc.

ticker: ANGI


text: Our business relies on information technology (IT) systems to process, transmit and store electronic information, including customer, employee and company data. The secure processing, maintenance and transmission of this information, including information housed both within an internal IT system or with a third-party and cloud-based environments, is critical to our operations. Each of the systems utilized in our business operations is subject to continually evolving cybersecurity risks and threats that present a risk to the continuity of our business operations, potential financial losses and damage to our reputation, including a loss of public trust. For more information on potential risks related to cybersecurity threats and incidents, please see "Item 1A. Risk Factors – Breaches of our information technology systems or improper disclosure of confidential company or personal data, or a failure to comply with privacy laws, regulations and our contractual obligations concerning data privacy or the security of certain information, could have a material adverse effect on our reputation and operations."

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Recognizing the importance of cybersecurity to the success and resilience of our business, the Board of Directors considers cybersecurity to be an important aspect of corporate governance. To facilitate effective oversight, our Chief Financial Officer holds discussions on cybersecurity risks and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.

companyName: 5E Advanced Materials, Inc.

ticker: FEAM


text: Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.

companyName: DIH HOLDING US, INC.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. The Company is not aware of any material security breach to date. Accordingly, the Company has not incurred any expenses over the last three years on information security breaches. However, the Company faces certain ongoing risks from cybersecurity that, if realized, could materially affect the Company. See "Item 1A. Risk Factors - The occurrence of cyber-incidents, or a deficiency in our cybersecurity or in those of any of our third party service providers could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information or damage to our business relationships or reputation, all of which could negatively impact our business and results of operations." There can be no assurance that the Company's cybersecurity risk management program and processes, including its policies, controls or procedures, will be fully implemented, complied with or effective in protecting its systems and information.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Management and Strategy We have developed and continue to enhance our cybersecurity governance program to help protect the security of our computer systems, software, networks, and other technology assets against material risks from cybersecurity threats, including unauthorized attempts to access confidential information or to disrupt or degrade our business operations. Our cybersecurity governance program is strategically integrated into our broader risk management framework and aims to (1) proactively manage cyber and information security risks at the Company, (2) implement the internal controls required by cybersecurity regulatory requirements as well as the Company's information security control objective documents and information security standards, and (3) improve the efficiency, maturity, and effectiveness of technology functions and processes.

companyName: LogicMark, Inc.

ticker: LGMK


text: Our personnel responsible for cybersecurity proactively identifies, manages, and mitigates cyber risk in a variety of ways, including but not limited to: A formal enterprise-wide cybersecurity policy and related standards; Cybersecurity training and employee phishing simulations; Scheduled and ad hoc internal and external penetration tests; Cyber incident response, IT disaster recovery, and business continuity plans; Cybersecurity assessments and remediation planning as part of our due diligence process; Identity and access management controls;

companyName: SOLIGENIX, INC.

ticker: SNGX


text: Our management team is actively engaged in assessing and managing material risks from cybersecurity threats. We have established a robust framework for identifying, evaluating, and mitigating these risks.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: Our Board, in coordination with the Audit Committee, oversees the management of the Company's cybersecurity program and risks from cybersecurity threats. Our Audit Committee receives annual reports on cybersecurity risks resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents. The CIO/CDO also informs the Audit Committee on the prevention, detection, mitigation, and remediation of cybersecurity incidents, including significant security risks and information security vulnerabilities. The Audit committee reports any significant matters to the Board.

companyName: CONSTELLIUM SE

ticker: CSTM


text: Seaboard also maintains disclosure controls and procedures to ensure that executive management and the Board receive prompt and timely information regarding any material cybersecurity incidents. Upon confirmation of a cybersecurity incident, the impacted segment invokes their response plan and notifies the IS Director who then communicates the details of the incident to management's Cybersecurity Committee for determination of materiality.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the Audit Committee of the Board of Directors, which evaluates cybersecurity and information technology risk as well as other aspects of our overall enterprise risk.

companyName: Longboard Pharmaceuticals, Inc.


text: We maintain a program designed to assess and manage the cybersecurity-related risk associated with third-party service providers that we rely on as part of providing solutions to our clients. This program incorporates a risk-based approach based on service criticality and type of information. Vendor risk assessments are performed and documented within our vendor management system. As part of the vendor risk assessment, we conduct an information security program evaluation of critical third-party providers before engagement and, based on our assessment of the vendor's risk, contractually require certain third parties we engage to implement security programs commensurate with their risk profile.

companyName: PAYCHEX INC

ticker: PAYX


text: Like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition. See Item 1A – Risk Factors – "Risk Related to our Business – System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.," above.

companyName: PCB BANCORP

ticker: PCB


text: Our commitment to cybersecurity is integral to our business operations, and we believe our strategic investments in this area significantly mitigate the risk of cybersecurity incidents that could impact our company's reputation, financial position, or operational capabilities.

companyName: IMPACT BIOMEDICAL INC.

ticker: IBO


text: Our audit committee receives periodic updates from management on our cybersecurity processes. The audit committee receives information regarding current and emerging material cybersecurity threat risks and our ability to mitigate those risks. Our Board of Directors receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: We also acknowledge the risks associated with third-party service providers. We employ a risk-based due diligence process of engaging and managing third-party relationships. The third-party management program is integrated into our enterprise risk management process to measure risks and evaluate current and evolving resource needs. We perform risk assessments of new and existing service providers, develop and maintain a proactive approach to address non-compliance, and establish monitoring plans based on risk scores. This process continues throughout the lifecycle of the third-party relationship. Initially, new third parties are segmented into risk categories based on reputational/sanction screenings, geographical location, contractual obligations, financial arrangements, data transfer/sharing agreements, subcontractor/additional entity relationships of the third party, and business relationship oversight feedback. When the ongoing risk monitoring identifies a change in risk profiles, monitoring plans are adjusted as appropriate to ensure proper controls are in place and due diligence is applied to mitigate higher-risk relationships. These practices are designed to mitigate risks related to data breaches and other security incidents originating from third-party service providers.

companyName: BOISE CASCADE Co

ticker: BCC


text: Our Chief Operating Officer and other members of senior management oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Operating Officer and other members of senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: rollout and expansion of cyber security tools, cyber industry awareness, trends, and simulated tabletop exercise with incident response plan.

companyName: Ventyx Biosciences, Inc.

ticker: VTYX


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Based on our small size and limited number of employees and consultants, we rely extensively on information technology systems managed by third party major service providers to securely process, store and transmit our data to conduct business. Our employees and consultants utilize end point security tools, such as firewalls and anti-virus protection, to protect our data. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with our risk management system or processes.

companyName: Birchtech Corp.

ticker: BCHT


text: We conduct regular enterprise-wide internal and external cyber risk assessments. These efforts include audits, internal and external regulatory compliance assessments, and periodic self-assessments. Vulnerability assessments are performed frequently for systems, and internal and external penetration tests are performed annually. We periodically engage vendors to review and benchmark our cybersecurity processes. In addition, members of the CST perform regular security control assurance testing.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: The Company's cybersecurity program is led by the Chief Information Security Officer (CISO), who reports to the Senior Vice President and Chief Technology Officer (CTO). The CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom hold cybersecurity certifications in Information Systems Security or Information Security Management, and through the use of technological tools and software and results from third party audits. Additionally, the CISO directs the Global Information and Cyber Security Council (the "Council"), which includes a diverse range of relevant experts. The Council includes management from global technology, compliance, privacy, controlling, operations, security, automation, ERM, and internal audit. The Council promotes alignment and communication of new and ongoing cybersecurity prevention techniques and provides a forum for staying current on the latest cybersecurity threats.

companyName: Archer-Daniels-Midland Co

ticker: ADM


text: Framework for Identifying and Mitigating Threats: We follow a structured framework for identifying and mitigating cybersecurity threats, which outlines procedures for threat detection, incident response, and risk mitigation.

companyName: Jet.AI Inc.

ticker: JTAI


text: Our General Counsel provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We have vendor management processes to help manage cybersecurity risks associated with our use of certain of these providers. For certain vendors, these processes include vendor risk assessments, security questionnaires, review of vendors' written security program, and imposition of contractual obligations related to information security on vendors.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: Information technology systems and services, including cybersecurity, used by the small team of individuals at the Markel Group holding company are provided and/or administered by teams within our insurance business, consistent with practices outlined above.

companyName: MARKEL GROUP INC.

ticker: MKL


text: No risks from IT security threats nor any previous IT security incidents have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, but we cannot provide any assurance that they will not be materially affected in the future by such risks or incidents. For a discussion of whether and how any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, see "Risks Relating to Our Business: Other––Increased IT security threats and more sophisticated and targeted computer crime could pose a risk to our systems, networks, products, solutions and services" in Item 1A, Risk Factors.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: While our Board provides oversight of our cybersecurity risk environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management. Our CISO, with assistance from internal and external resources, is responsible for the implementation and providing oversight to our ISP within the organization and maintaining the appropriate level of expertise to manage and implement cybersecurity policies, programs and strategies. Our CISO has years of applied experience in actively managing cybersecurity and information security programs for large global publicly traded companies with complex and evolving information systems. Management oversight of our ISP is provided by various governance committees including the Operational Risk Oversight Committee, the Information Security Risk Oversight Subcommittee and the Financial Crimes Control Oversight Subcommittee.

companyName: ALLIANCEBERNSTEIN HOLDING L.P.

ticker: AB


text: TEC's Vendor Risk Management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. TEC also has requirements for third-party service providers which include regulatory compliance and meeting policies and standards based on the National Institute of Standards and Technology Cybersecurity Frameworks. TEC's processes also provide for mitigating cybersecurity risk from third parties through seeking to include in its agreements with third-party service providers, as applicable, cybersecurity provisions designed to appropriately address such risks.

companyName: TAMPA ELECTRIC CO


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Further information regarding cybersecurity risks can be found in Item 1A. Risk Factors, of this Annual Report on Form 10-K.

companyName: AMERICAS CARMART INC

ticker: CRMT


text: As discussed above, our cybersecurity risk management and strategy are led by our CIO, who has extensive leadership experience with enterprise information technology in the manufacturing and telecom industries, where he has held various executive roles in which he developed and executed IT strategy, including cybersecurity programs, helped achieve and maintain Sarbanes-Oxley compliance, and brought companies into compliance with ISO 27001, among other things.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: In an effort to protect our resources from cyber threats, we maintain a security program that includes multiple layers designed to prevent, mitigate, detect, defend against, and remediate these threats. These include, but are not limited to, continuous vulnerability assessment and remediation, annual penetration testing conducted by a third party, security and monitoring tools that are monitored by a 24x7 SOC (Security Operations Center) and Incident Response Planning. Additionally, all employees are required to take annual cyber security training that aligns with our risks and current cyber trends such as ransomware, BEC (business email compromise,) phishing, and social engineering.

companyName: FRANKLIN STREET PROPERTIES CORP /MA/

ticker: FSP


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. When we identify a vendor who may pose a cybersecurity threat risk, we will require those third parties to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits.

companyName: G1 Therapeutics, Inc.


text: Our Head of IT has served in various roles in information technology for over 22 years, including serving in cybersecurity focused roles for the past 9 years. Our Head of IT holds an undergraduate degree in Computer Information Systems. Our Chief Legal Officer, Chief Technical Operations Officer and Chief Commercial Officer each hold undergraduate and graduate degrees in their respective fields, and each have substantial experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: ACELYRIN, Inc.


text: Our cybersecurity incident response process is designed to escalate significant cybersecurity incidents to a team of business leaders, including, but not limited to, our Vice President of Systems Engineering, Chief Legal Officer, and Chief Financial Officer. In the case of a cybersecurity incident, this team of business leaders will work with our incident response team to help determine the severity of the impact of a cybersecurity incident, as well as to help mitigate and remediate cybersecurity incidents of which they are notified. The incident response team will also work under the oversight of legal counsel and the Audit Committee to determine whether an incident is material for disclosure purposes under applicable law.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: Our processes for assessing and identifying cybersecurity risks include, but are not limited to, the following elements: • regular network security assessments and vulnerability scans performed by third parties; • third-party audits of our information systems, • third-party systems for monitoring and analysis of network activity and threat intelligence; • systems for protecting our information technology, such as firewalls and anti-virus software; • cybersecurity awareness training for our employees and contractors, including senior management; • and processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise. These cybersecurity partners, including consultants and other third-party service providers, are a key part of BIOLASE's cybersecurity risk management strategy and infrastructure and provide services including, maintenance of an IT assets inventory, periodic vulnerability scanning, identity access management controls including restricted access of privileged accounts, network integrity safeguarded by employing web-based software, including endpoint protection, endpoint detection and response, and remote monitoring management on all devices, industry-standard encryption protocols, critical data backups, infrastructure maintenance, incident response, cybersecurity strategy, and cyber risk advisory, assessment and remediation.

companyName: BIOLASE, INC


text: Management briefs the Audit Committee on a quarterly basis regarding our information security programs. As part of its oversight responsibilities, the Audit Committee regularly discusses and reviews with management, among other items, Aptar's compliance and cybersecurity programs. We also periodically test our systems for vulnerabilities and regularly engage third parties to conduct evaluations of our security controls whether through penetration testing, independent audit or consulting on best practices to address new challenges. An independent review of our cybersecurity program has been assessed against the National Institute of Standards and Technology (NIST) cybersecurity framework. In addition, we maintain cybersecurity insurance as part of our overall insurance portfolio.

companyName: APTARGROUP, INC.

ticker: ATR


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The full board of directors may also receive briefings from management on our cyber risk management program. Board members may receive presentations on cybersecurity topics from our Chief Financial Officer (CFO), internal security staff or external experts as part of the board of director's continuing education on topics that impact public companies. Our IT Senior Director, is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our IT Senior Director has primary responsibility for our overall cybersecurity risk management program, and our IT Senior Director supervises our retained external cybersecurity consultants. Our IT Senior Director has over 25 years of IT and cybersecurity experience.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information assets (for example, TI business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents. As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our internal IT function and management.

companyName: Cartesian Therapeutics, Inc.

ticker: RNAC


text: •"—Delays, costs, and disruptions that result from upgrading, integrating, and maintaining the security of our information and technology networks and systems could materially adversely affect us"

companyName: ADT Inc.

ticker: ADT


text: Cyber threats are considered one of the most significant risks facing financial institutions. Because the Trust has no directors, principal officers or employees, the Sponsor is responsible for managing cybersecurity risks to the Trust. To mitigate risk from cyber threats, Invesco Ltd. ("Invesco"), the Sponsor's parent company, has a designated Global Chief Security Officer ("GCSO") who leads the global security department that is responsible for identifying, assessing, and managing cybersecurity threats across the Invesco organization. The GCSO experience in the public and private sectors, specializing in security, investigations, and incident response. The Global Security Department oversees, among others, the following groups across Invesco: Information Security, Global Privacy, Business Continuity & Crisis Management, Resilience, and Corporate Security. This converged security structure supports a more comprehensive, holistic approach to keeping the Trust's and Invesco clients, employees, and critical assets safe, upholding privacy rights, while enabling a secure and resilient business.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: To operate our business, we utilize certain third party service providers to perform a variety of functions, such as outsourced business functions, professional services, software-as-a-service platforms, managed services, property management, cloud-based infrastructure, data center facilities, encryption and authentication technology and corporate productivity services. Depending on the nature of the services provided, the sensitivity and quantity of information processed and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, conducting on-site inspections and requiring their completion of written questionnaires regarding their cybersecurity programs.

companyName: Lyell Immunopharma, Inc.

ticker: LYEL


text: DigitalBridge assesses cybersecurity risk through a process based on the cybersecurity framework established by the U.S. National Institute of Standards and Technology (NIST). Each year, the Company's IT team conducts a series of sessions to discuss and evaluate risk and ranks the potential severity and likelihood of each identified risk, as well as the current and planned controls to mitigate such risks informed by the NIST Risk Management Framework. Based on this analysis, a risk matrix is created, and project plans are developed to prioritize and allocate resources effectively, which are then discussed with key members of management, including the Company's Chief Executive Officer, and are approved by the Company's Data Protection Team ("DPT"), which consists of the Company's Chief Information Officer, Chief Financial Officer, Chief Operating Officer, Chief Compliance Officer, Head of Internal Audit and Chief Legal Officer.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Operating Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: Our IT Governance Team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Aardvark Therapeutics, Inc.

ticker: AARD


text: The Senior Director, Global IT Security has primary responsibility for the management of ongoing cyber risks under the oversight of the CIDO. The Senior Director holds a Certified Information Systems Security Professional certification and has nearly 30 years of experience in technology, including over 10 years in software development and enterprise architecture and over 15 years implementing, maturing and leading cybersecurity programs. The CIDO is responsible for global IT strategy and operations and has nearly 30 years of experience leading enterprise technology organizations. The CIDO and Senior Director, together with others on their teams, are informed about the monitoring, prevention, detection, mitigation and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management policies, processes and operations discussed above.

companyName: GREIF, INC

ticker: GEF


text: As stated above, the Board of Directors and the Audit Committee maintain oversight of the cybersecurity program to ensure risks to the Company are managed appropriately. Our CISO, who reports to the Chief Executive Officer ("CEO"), is responsible for providing annual updates to the Board of Directors and to executive leadership. In addition, our CISO partners closely with our CIO and CTO and their respective organizations to execute defined functions within our cybersecurity program. Our CISO, CIO, and CTO each report directly to the Chief Executive Officer ("CEO") who, as appropriate, will escalate any cybersecurity issues to the Board. Our CISO and CIO both attend regular meetings with the executive officer team, including our CEO, Chief Financial Officer and other senior executive officers, and report on cybersecurity matters as appropriate.

companyName: CORVEL CORP

ticker: CRVL


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our Board is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Chain Bridge I

ticker: CBRRF


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external consultants and auditors to assess and enhance our security posture. These third parties conduct periodic audits, vulnerability assessments, and provide recommendations to strengthen our overall cybersecurity framework. These partnerships enable us to leverage specialized knowledge and insights.

companyName: Snap One Holdings Corp.


text: Cybersecurity risk management is part of the Company's overall risk management program. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. The Company's cybersecurity programs are under the direction of its Treasurer with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors.

companyName: Idaho Strategic Resources, Inc.

ticker: IDR


text: The Company has information technology security practices to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: • cybersecurity controls embedded in the Company's information technology systems; • implementation of changes to address potential threats and vulnerabilities of the Company's information technology systems; • incident response program, including proactive simulations, to identify and manage cybersecurity threats, risks or incidents; • participation in industry forums and collaboration with peers; and • security awareness and data protection training for applicable employees.

companyName: PUBLIX SUPER MARKETS INC


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems are necessary for the operation of our business. We use these systems, among others, to manage our product development, to communicate internally and externally, to operate our accounting and record-keeping functions, to store and access data including sensitive patient data and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: In the past 2 years, the Company does not believe that it has experienced any material cybersecurity incidents, nor any material costs related to immaterial cyber incidents. Although we have a comprehensive process for the prevention of material cybersecurity incidents as discussed, we cannot provide assurance that our results of operations and financial condition and business strategy will not be materially impacted from cybersecurity risks in the future. For more information on our cybersecurity related risk and potential effects on the Company of a material cybersecurity breach, see under "General Risk Factors" in "Item 1A. Risk Factors"

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: As indicated above, our management, with oversight from the Board, performs an annual ERA and cybersecurity is among the main risks identified by the ERA for Board-level oversight. Our full Board has oversight of our efforts in cybersecurity and meets regularly with our Vice President – Information Technology (three times during fiscal 2024) on our cybersecurity risks and programs. The Board is also updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT


text: Our CISO is primarily responsible for assessing, monitoring and managing cybersecurity risks as well as overseeing employee training programs. Our CISO has served in this role since July 2019, has a Master's Degree in Information Security from the University of London, has been working in technology risk management since the early 1990s, holds Certified Information Systems Security Professional status and is a member in good standing of the Institute of Electrical and Electronics Engineers ("IEEE") and the International Information System Security Certification Consortium ("ISC2"). The CISO reports at least annually to the Board of Directors on material cyber risks, including those identified in our business and rising threats, and the current state of L&W's information security and will continue to do so on a regular basis as needed.

companyName: Light & Wonder, Inc.

ticker: LAWIL


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and maintains oversight of risk assessment and risk management, including cybersecurity and other information technology risks. In addition, our Board of Directors oversees management's implementation of our cybersecurity risk management program.

companyName: SIFCO INDUSTRIES INC

ticker: SIF


text: All employees receive cybersecurity training upon hire with at least annual training thereafter with job-specific topic considerations. Our Information Security team, consisting of the VP of Information Technology, Sr. Manager of Network Security and IT Security Manger, among others, engage third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring for cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems through testing and threat intelligence awareness. The employees within our Information Security team and broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: We have an established cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our cyber risk management program is designed to protect the confidentiality, integrity and availability of our systems and the data of our clients, candidates and company. This program and its processes are an integral component of our enterprise risk management ("ERM") program.

companyName: KORN FERRY

ticker: KFY


text: Our IS Program includes frequent reviews and development of our security policies and standards, monitoring to detect potential threats or disruptions, testing of protocols to verify the effectiveness of our defense systems, and training for our workforce. Our teams continuously and proactively monitor our information systems for potential risks, threats, and disruptions, including at our U.S.-based third-party data centers. Through the use of our rapid response and incident management processes, which include our IT incident management and IT disaster recovery processes, we assess potential incidents and determine a course of action. This may involve risk mitigation, resolution plan development and process improvements.

companyName: Veradigm Inc.


text: Board Reporting. On a quarterly basis, the CISO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, on the overall status of the Information Security Program, including the Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context of the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).

companyName: RENASANT CORP

ticker: RNST


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data.

companyName: Telomir Pharmaceuticals, Inc.

ticker: TELO


text: Our Audit Committee of the Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives annual updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents, if applicable.

companyName: Sage Therapeutics, Inc.


text: To protect against the risk of cybersecurity threats associated with the use of third-party providers in support of our operations, we take reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the information at use, requiring our service providers by contract to implement and maintain such safeguards, and periodically assessing our service providers based on the risk they present and the continued adequacy of their safeguards. In addition, we may engage third-party service providers to perform functions associated with our information security program and the assessment of security threats.

companyName: PRA GROUP INC

ticker: PRAA


text: We also educate with our employees to raise awareness of cybersecurity threats and best practices. As part of our onboarding process, we train all new employees on cybersecurity and maintain an annual retraining for all employees on cybersecurity standards and best practices, such as how to recognize and respond to phishing and social engineering schemes, which is supported by periodic phishing testing and training. We also have additional specific and regular training for our IT professionals.

companyName: SpringWorks Therapeutics, Inc.


text: Our information security program aligns with industry standards and best practices, such as the Center for Internet Security Critical Security Controls ("CIS Controls"). It consists of information security and privacy policies and procedures, which include, among other things, endpoint threat detection and response, identity and access management, vulnerability and patch management, and multi-factor authentication.

companyName: QXO BUILDING PRODUCTS, INC.


text: Our VP of Cybersecurity reports cybersecurity-related matters twice annually to the audit committee, and promptly reports any significant cybersecurity developments or incidents to our management, who may similarly escalate to the audit committee. These periodic updates include updates on our cybersecurity risk posture, including material risk assessments, the status of any projects to improve our information security systems, and the emerging cybersecurity threat landscape. The audit committee's reviews may also include presentations by members of senior management, as well as briefings with other internal and external subject-matter experts to help broaden the board of directors' understanding of the latest cybersecurity issues and the latest regulatory and threat landscapes. Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as cybersecurity incident response and recovery metrics. Our management also periodically engages external service providers to conduct objective assessments of our cybersecurity program, and results of such assessments are directly reported to the audit committee. Finally, the audit committee reports out to the larger board of directors periodically on the company's cybersecurity risks and posture.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Next-Generation Firewalls with Unified Threat Management provide perimeter security, while Microsoft 365 protection and Microsoft Defender enhance cloud-based safeguards especially email. We leverage Security Information and Event Management (SIEM) solutions like Microsoft Sentinel for real-time threat detection and response. Identity and Access Management: We have strict password policies which include multi-factor authentication. Awareness: Mandatory Security Awareness Training educates our workforce on best practices and evolving cyber threats performed annually.

companyName: DecisionPoint Systems, Inc.


text: Cybersecurity risk management is integrated into our broader risk management framework. The Audit Committee of our Board of Directors, which has responsibility for oversight of risk management, also has responsibility for oversight of our program, policies and procedures related to information security and data protection. On a regular basis, the CIO reports to the Audit Committee of our Board of Directors on cybersecurity risks as well as mitigation strategies and the status of initiatives to strengthen our information security systems. The CIO also provides periodic updates to our full Board of Directors, as appropriate. We also mandate a rigorous cybersecurity training program for all employees, which includes regular updates and assessments to ensure they are equipped to recognize and respond to potential cyber threats.

companyName: Quanterix Corp

ticker: QTRX


text: The Company recognizes the critical importance of safeguarding sensitive information and responding effectively to cybersecurity threats or incidents. As a part of the Company's overall risk management strategy, the Company implements a lines-of-defense model for protecting the enterprise against cybersecurity related threats. The Chief Information Officer ("CIO") has first line responsibility for the protection of the Company against cybersecurity related threats, which includes evaluating potential threats and determining the appropriate responses. The Chief Information Security Officer ("CISO"), who reports to the CIO, is the executive accountable for the monitoring, continuous development and improvement of the Company's Information Security program. This program, which is aligned to the National Institute of Standards and Technology Cybersecurity Framework, (i) provides strategic oversight with respect to cybersecurity controls for the Company's technology, (ii) identifies potential risks in the Company's supplier ecosystem and (iii) outlines threat intelligence and incident response coordination for current and emerging cybersecurity risks. Additionally, the CISO and CIO continually evaluate and make updates to the Information Security program to align with regulatory requirements and industry best practices to keep company-wide training initiatives related to cybersecurity risks robust and up to date.

companyName: Walgreens Boots Alliance, Inc.


text: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, end users, business partners, governmental entities, stockholders and employees. Our board of directors is actively involved in oversight of our risk management program, and information and product security represent an important component of our overall approach to enterprise risk management ("ERM"). Our risks from cybersecurity threats are considered in conjunction with other risks in our ERM program. In addition, we leverage a cybersecurity-specific risk assessment process and strategy based on the NIST Cybersecurity Framework to manage risks to organizational operations and assets, individuals and other organizations associated with the operation and use of systems. Risk assessments are periodically conducted to identify threats and vulnerabilities, and then used to determine the likelihood and impact for each risk using a qualitative risk assessment methodology. In general, we seek to address cybersecurity risks through a broad, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Fortinet, Inc.

ticker: FTNT


text: Cyberattacks could compromise confidential customer and employee information. Cyberattacks may result in business interruptions, lost revenues, higher commodity prices, disruption in fuel supplies, lower energy consumption, unstable markets, increased security, repair or other costs, or may materially adversely affect us in ways that cannot be predicted at this time.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: Our Board administers its risk oversight role directly and through its committee structure. While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity. Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, and Global Privacy Officer, our cyber, information security, and data privacy risks and programs. This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management's actions to identify and detect cyber threats and incidents, the results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance. Our management team also provides updates to the Board periodically.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: In an effort to detect and defend against cyber threats, the Company plans to provide its employees with various cybersecurity and data protection training programs which will cover timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly.

companyName: Future FinTech Group Inc.

ticker: FTFT


text: As discussed in more detail under the heading "Governance" below, our cybersecurity program is overseen by our Chief Information Officer ("CIO"), who reports to our Chief Executive Officer ("CEO"), and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our CIO regularly reports to our Audit Committee on the status of the cybersecurity program.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: In order to mitigate data or security incidents that may originate from third party vendors or suppliers, we conduct both privacy and security assessments to properly identify, prioritize, assess and remediate any third-party risks, and require security and privacy addenda to our contracts where applicable.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: While our Board has responsibility for oversight of risk management on an enterprise-wide basis, it has delegated certain risk oversight responsibilities to its committees. The Audit Committee of our Board of Directors has responsibility for oversight of our cybersecurity risk management program. Full responsibilities of the Audit Committee are set forth in the publicly available Audit Committee Charter on our website. The Committee receives quarterly cybersecurity updates covering risks, mitigation plans, and cybersecurity incidents. The full Board of Directors is provided with periodic cybersecurity updates from the CIDO or the Senior Director, Global IT Security, or both.

companyName: GREIF, INC

ticker: GEF


text: Our cybersecurity risk management program is a key component of our overall process concerning assessment and management of enterprise risk. Risks relating to cybersecurity, data privacy and other information technology risks are overseen by the Information Systems Audit Committee of the Board (the "IS Audit Committee"), and the assessment and management of other enterprise-level risks are overseen by the Audit Committee of the Board.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Ongoing activities To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, we undertake the following activities: • Perform an annual review of all of our policies related to cybersecurity; • Monitor emerging data protection laws and implement changes to our policies to remain compliant; • Run tabletop exercises with the cybersecurity incident response team, including executive team members, to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Conduct regular phishing email simulations and quarterly security awareness trainings for all employees to enhance awareness and responsiveness to such possible threats; • Require all employees to review and acknowledge the company's information security policies upon hiring and annually thereafter; • Leverage the company's incident response plan framework and a full set of cybersecurity technology tools, processes and procedures including, for example, security incident and cyber event management, endpoint detection and response, extended detection and response, e-mail gateway, and vulnerability management to monitor any cyber threats and to proactively detect, respond and recover when there is an actual or potential cybersecurity incident; • Carry insurance that provides protection against the potential losses arising from a cybersecurity incident; • Conduct annual penetration testing of our external technology and systems perimeter, including remediation and retesting; • Conduct security assessments for code level vulnerabilities of all our internally developed business-critical applications; and • Engage independent third parties to perform penetration testing of select business applications.

companyName: TrueBlue, Inc.

ticker: TBI


text: The Company will conduct initial and ongoing due diligence of each current or prospective third-party service provider to evaluate whether the third-party service provider will have access, maintain, or store any client private information. Vendor cybersecurity controls are then assessed to determine if the vendor's control environment meets the Company's standards. Vendors are also assessed on a periodic ongoing basis according to their risk classification.

companyName: Binah Capital Group, Inc.

ticker: BCG


text: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity and data privacy program. Our Board of Directors (the "Board") is responsible for the oversight of our cybersecurity and privacy program and risks from cybersecurity threats. Our Board's Audit Committee, which supports the Board in its oversight of our cybersecurity and data privacy program, is focused on cybersecurity and data privacy risk, including incident response planning, and timely identification and assessment of cybersecurity threats, cybersecurity incident recovery and business continuity considerations.

companyName: Certara, Inc.

ticker: CERT


text: For additional information about cybersecurity risks, see the risk A cyber attack involving our business, operational control systems or related infrastructure, or that of third parties with whom we do business, including pipelines which supply our Liquefaction Project, or an attack on our critical suppliers, could negatively impact our business or operations, result in data security breaches, impede the processing of transactions, delay financial or compliance reporting and potentially harm our reputation under Risks Relating to Our Operations and Industry in Item 1A.Risk Factors.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information, please see "Item 1A, Risk Factors."

companyName: Akari Therapeutics Plc

ticker: AKTX


text: The Board of Directors established its CIT Committee with specific responsibilities for overseeing cybersecurity threats, among other things. Our Chief Information Security Officer provides the CIT Committee with periodic reports on our cybersecurity risks and any material cybersecurity incidents. The CIT Committee retains an independent external cybersecurity consultant who regularly attends all CIT Committee meetings and reports directly to the CIT Committee Chair. In addition, the Chief Information Security Officer provides periodic training and reports to our Board of Directors.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: The cybersecurity function within the Company helps identify, assess and manage the Company's cybersecurity threats and risks. Our cybersecurity function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example manual tools, internal or external audits, automated tools, subscribing to and analyzing reports and services that identify cybersecurity threats and threat actors, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us. Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response, data encryption, network security controls, system monitoring, penetration testing, employee training, a dedicated cybersecurity staff member, and physical security mechanisms.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates.

companyName: Rising Dragon Acquisition Corp.

ticker: RDAC


text: Incident Reporting and Communication: We have established protocols for reporting material cybersecurity incidents to management, stakeholders, and regulatory bodies as required. The Board is promptly informed and receives ongoing updates regarding material cybersecurity incidents as described below.

companyName: Velo3D, Inc.

ticker: VELO


text: The audit committee of our board of directors has primary responsibility for overseeing our risk management process relating to cybersecurity, which includes risks arising from cybersecurity threats.

companyName: Xponential Fitness, Inc.

ticker: XPOF


text: Dow's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages International Organization for Standardizations 27001/27002 standards for general information technology controls, International Society of Automation/International Electrotechnical Commission standards for industrial automation, the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls. In addition, the Company maintains business continuity and disaster recovery plans as well as a cybersecurity insurance policy.

companyName: DOW INC.

ticker: DOW


text: AMN Healthcare's board of directors (the "Board") is responsible for overseeing our enterprise-wide risk management program. The audit committee of the Board (the "Audit Committee") has primary oversight responsibility for information security and cybersecurity, including internal controls designed to mitigate risks related to these topics. This includes regular, and at least quarterly, review by the Audit Committee of reports on topics including, among others, significant cybersecurity risks results from third-party assessments, training and vulnerability testing, and our incident response plan. Material breaches, if any, and any disclosure obligations arising from any such breach are also discussed during separate Audit Committee meetings as part of the Boards' risk oversight generally.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual cybersecurity risk assessment. Further, we conduct periodic external penetration tests to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program to protect our investors, consumers, customers, employees, vendors, and intellectual property.

companyName: LendingTree, Inc.

ticker: TREE


text: Our Board of Directors and our Audit Committee oversee our enterprise-wide risk management, including with respect to cybersecurity. Our Chief Financial Officer presents information on our enterprise-wide risks to the Board of Directors at each of its regularly scheduled meetings. Our SVP, Enterprise Risk Management presents to our Board of Directors and our Audit Committee at least once a year on our significant enterprise-wide risks as well as our enterprise-wide risk program. In addition, our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO") present to the Audit Committee at each regularly scheduled Audit Committee meeting on information technology infrastructure as well as risks related to cybersecurity and information security.

companyName: Edwards Lifesciences Corp

ticker: EW


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. As part of our company-wide enterprise risk management process, we conduct a comprehensive annual enterprise risk assessment that includes evaluation of cybersecurity risks and development of risk mitigation response plans. Company management reviews our enterprise risk assessment with our Audit Committee and our Board of Directors and provides periodic updates with respect to our risk mitigation response plans to our Audit Committee and our Board of Directors. We have established internal policies and procedures for cybersecurity risk management and incident response management that are based on industry standard cybersecurity frameworks, and we provide regular training to our employees regarding evolving cybersecurity threats and risk management.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: We maintain an incident response plan with a cross-functional team comprised of members of the information technology department, senior management and other appropriate individuals. The team is responsible for assessing and managing the cybersecurity incident response process and taking necessary corrective actions to mitigate and/or eliminate any issues.

companyName: Forward Industries, Inc.

ticker: FWDI


text: We design and assess our cybersecurity risk management program guided by the NIST Cybersecurity Framework. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: We have implemented a security training and awareness program for all Gartner employees and third-party contractors. Employees receive security training in connection with onboarding as well as annual awareness and training activities throughout their employment. Further, Gartner carries cybersecurity insurance covering the company and its subsidiaries. Material Cybersecurity Risks, Threats & Incidents.

companyName: GARTNER INC

ticker: IT


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. Should any reportable cybersecurity incident arise, our management shall promptly report such matters to our Board for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board deems appropriate to take.

companyName: FORMATION MINERALS, INC.


text: The Company’s cybersecurity program is integrated within the Company’s enterprise risk management program, which provides oversight and governance of cybersecurity risk through risk assessment, risk monitoring, and follow-through on stated objectives and investments to actively manage and remediate related risks. The Company also engages third party experts to assist with compliance and maturity assessments and penetration testing, as appropriate.

companyName: Phoenix Education Partners, Inc.

ticker: PXED


text: Our cybersecurity program is run by our Chief Financial Officer, who reports to our Board, with support from our specialty IT advisor. Our specialty IT advisor has extensive experience leading and managing cybersecurity programs and in cybersecurity risk management. Our specialty advisor has served in this position since 2023 and is supported by its information security team, many of whom hold cybersecurity certifications and who collectively possess relevant experience in different areas of cybersecurity.

companyName: Perception Capital Corp. IV


text: Risks from Material Cybersecurity Threats As of the date of this report, we have not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although we have not previously experienced cybersecurity incidents that are individually, or in the aggregate, material, we have experienced cyberattacks in the past, which we believe have thus far been deflected or mitigated by our preventative, detective and responsive measures. For additional discussion of our cybersecurity related risks, see "Item 1.A Risk Factors."

companyName: Alpha Metallurgical Resources, Inc.

ticker: AMR


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program and an annual report from management on our cybersecurity risks.

companyName: Arcutis Biotherapeutics, Inc.

ticker: ARQT


text: Following cybersecurity incidents, GIS, in conjunction with members of management of CRH's operating subsidiaries and business units as necessary, conduct post-incident analysis and exercises designed to strengthen CRH's cybersecurity practices. The management Risk Committee and broader executive leadership team are briefed on the occurrence, mitigation and remediation of cybersecurity incidents on a regular basis, including ad-hoc briefings covering significant or potentially material incidents.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: The Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation's overall approach to enterprise-wide risk management. The Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: ASSOCIATED BANC-CORP

ticker: ASB


text: We leveraged internal and external resources to support our cyber risk management efforts, including security monitoring tools, periodic penetration tests and vulnerability assessments. We have in the past also engaged the services of external information security service providers to help support our information technology environment, assist with security monitoring, and help us draft and implement information security policies.

companyName: Kalaris Therapeutics, Inc.

ticker: KLRS


text: Cyber Incident Response Plan We maintain a cross-functional cyber incident response plan with defined roles and responsibilities and reporting protocols. This plan focuses on responding to, identifying the severity of, and recovering from a breach as well as mitigating any impact to our business. Generally, when a suspected breach is identified, the ITSS team will escalate the issue to the personnel identified in the plan for initial analysis and guidance. In the event of an actual breach, the CISO will prepare an initial assessment and consult with our general counsel (GC) and our Chief Financial Officer (CFO). Together, our GC, CFO and CISO will consult with other executives, including our Chief Executive Officer and our Chief Operating Officer, to determine the incident's impact to our business. This management group (in consultation with outside experts) will be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any public reporting or third-party notification requirements.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: As a company managing the use and disclosure of PHI and PII, we annually undergo internal and/or third-party HIPAA Security Rule risk assessments of our administrative, physical, and technical safeguards. In addition, external assessors periodically evaluate our safeguards against multiple frameworks, including NIST Cyber Security Framework (CSF).

companyName: InnovAge Holding Corp.

ticker: INNV


text: As part of its oversight, the audit committee will receive reports from management on our cybersecurity risks including any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: FRACTYL HEALTH, INC.

ticker: GUTS


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Our third-party vendor management program has a tiered approach to assess vendors based on risk profile. We review each third-party vendor's architectures, security practices and data flows, and integrate stringent contractual terms encompassing breach notifications and other security requirements. The risk profiles associated with our service level agreements are monitored by senior employees in our information security and technology departments. Our vendor management program also includes an annual reassessment of the risk profile of each vendor and interim vendor reviews are completed if service alterations occur.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Managing Material Risks & Integrated Overall Risk Management We take an integrated approach to assessing and identifying cybersecurity risks and threats. At the corporate level, cybersecurity is identified as a key risk within our Enterprise Risk Management (ERM) program. Our management of cyber risk is based on the National Institute of Standards and Technology's (NIST) cybersecurity framework. While the NIST cybersecurity framework is our foundation, we combine that with the Center for Internet Security's (CIS) control framework.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: The Company's program to identify, assess, and manage cybersecurity risks is led by our Chief Information Officer, and leverages the expertise of our Chief Financial Officer and General Counsel. Our Chief Information Officer holds a Bachelor of Science in Computer Science and has over 30 years of work experience, with more than 20 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs. Our Chief Information Officer, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company's cybersecurity and data privacy risk mitigation plans.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: The Adviser has a dedicated cybersecurity team, led by its Vice President, IT Security, who works closely with the Adviser's Information Security Steering Committee, to develop and advance the firm's cybersecurity strategy, which applies to us. The Adviser's Information Security Steering Committee includes its Chief Information Officer, Chief Risk Officer, and General Counsel.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: 8. Use of Third-Party Services The Company partners with third-party cybersecurity firms to support penetration testing, threat monitoring, and risk assessments. Vendors are required to adhere to stringent security controls to minimize risks associated with third-party data access.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Oversight of Cybersecurity Risks Our board of directors and audit committee have primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Certain members of the HMC Capital cybersecurity team periodically report to our audit committee as well as our full board of directors, as appropriate, on cybersecurity matters. Such reporting includes updates on HMC Capital's cybersecurity program as it impacts us, the external threat environment, and HMC Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our and HMC Capital's preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: StratCap Digital Infrastructure REIT, Inc.


text: Depending on the environment and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response and detection policy and processes; vulnerability management processes; a secure software development lifecycle policy and change management procedures; business continuity plans; penetration tests; encrypting certain data; using network security controls; segregating and maintaining access controls over certain data; asset management and tracking; training our employees; and maintaining cybersecurity insurance.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: The Audit Committee is responsible for overseeing risks from cybersecurity threats, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from our Vice President – Information Technology (Chief Information Officer) concerning our significant cybersecurity threats and risks, and the processes we have implemented to address them.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.

companyName: GARMIN LTD

ticker: GRMN


text: In furtherance of detecting, identifying, classifying and mitigating cybersecurity and other data security threats, we also: • Use MFA based authentication and other cryptographical processes to address identity-based cybersecurity risks. • Use context aware access control processes. • Adopted processes to ensure security in specific remote environments. • Have implemented anti-phishing technologies. • Deploy anti-malware solutions, and have them continuously updated. • Implemented a SIEM system, where we monitor (automatically and otherwise) our networks, systems and users. • Perform periodic network and vulnerability scans of our external and internal networks and systems. • Have an incident detection and response team, with its policies and procedures, to review all events that may be part of a security incident. • Use processes to assess and prioritize risks related to applications and how we use them. • Ensure the asset inventory for relevant system components is kept current and accurate; • Maintain updated network and systems architecture documentation • Periodically engage well known external consultants, where appropriate, to assess, test or otherwise assist with aspects of our security controls. • Provide mandatory training on security and compliance matters to all employees, and some more specific as roles and responsibilities require. • Have defined and periodically updated our information security policies regarding, among others, access and control, networked devices, credentials management, physical security, etc. • Implement a secure software development life cycle and a maturity model to assess it, and accompany engineering teams during all the phases of the cycle. • Evaluate the information security risk associated with suppliers, partners, applications and services used.

companyName: Satellogic Inc.

ticker: SATL


text: In addition, our management team considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks, at monthly performance review meetings. Our CEO, CFO and other members of senior management participate in such meetings.

companyName: DAYTON POWER & LIGHT CO


text: o implementation of a managed security operations center (SOC) to provide 24/7 managed detection and response (MDR) services for all corporate endpoints.

companyName: scPharmaceuticals Inc.


text: Board of Directors The audit committee of the Company's board of directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The audit committee is informed of material risks from cybersecurity threats pursuant to the Company's disclosure controls and procedures and the audit committee provides updates to the Company's board of directors at regular board meetings.

companyName: Inuvo, Inc.

ticker: INUV


text: In certain circumstances, BHE relies on third-party service providers for a variety of products and services to run its information systems. This dependence exposes BHE, along with others who use these service providers, to the impact of a cyber attack on its service providers. Cyber attacks at a third-party service provider could have a significant financial, operational, or reputational impact. BHE continuously monitors the risks associated with its service providers. BHE's Board of Directors has responsibility for oversight of BHE's cybersecurity risk management program.

companyName: BERKSHIRE HATHAWAY ENERGY CO