text: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: To the extent we identify areas in our information systems that need improvement, we seek to timely implement and monitor such improvements. While we believe that we have taken appropriate security measures to protect our data and information technology systems, and have been informed by our third-party vendors that they have as well, there can be no assurance that our efforts will prevent breakdowns or breaches in our systems, or those of our third-party vendors, that could materially adversely affect our business and financial condition. For additional information regarding whether risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, see Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: BIO-PATH HOLDINGS, INC.

ticker: BPTH

secItem: Item 1C


text: We have established policies and processes for assessing, identifying, managing and disclosing, as necessary, risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes as described below.

companyName: QuantumScape Corp

ticker: QS


text: The cybersecurity, legal, and Executive Leadership teams also participated in a data security incident tabletop exercise in December 2023 to simulate responses to a ransomware attack and use the findings to improve the Company's processes and technologies.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: The experience of the combined QVC and QVC Group management teams includes a diverse background in telecom, retail and other industries, with decades of experience in various aspects of technology and cybersecurity. LMC's Head of Cybersecurity, who sits on the ISSC, has more than 25 years of cybersecurity and IT experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. QVC's VP of Cybersecurity has more than 30 years of IT experience and holds multiple certifications, including Certified Information Security System Professional and Certified Information Security Manager. Together this management team has worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, business applications, customer facing applications and customer payment systems.

companyName: QVC INC

ticker: QVCD


text: (4)Outside Consultants & Industry Experts. In addition to the broad capabilities of our internal information security team, we also engage various outside consultants, including contractors, security firms, auditors, and other third-party subject matter experts, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our cybersecurity programs. We are also members of recognized global industry organizations such as the Information Systems Audit and Control Association (ISACA), International Information System Security Certification Consortium (ISC), and International Association of Privacy Professionals (IAPP).

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Third-Party Risk Assessments – We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We take the following actions, among others, to demonstrate our commitment to maintaining the highest levels of information security, provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and to identify, protect against, detect, respond to, and recover from cybersecurity incidents: • leverage encryption, data masking technology, data loss prevention technology, authentication technology, entitlement management, access control, network and application segmentation, anti-malware software, and transmission of data over private networks, among other systems and procedures, designed to protect against unauthorized access to information; • conduct annual reviews with many of our clients on our cybersecurity and data security policies, practices and controls, and engage with regulators across the world, to remain apprised of cybersecurity and data security standards and best practices; • utilize the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the "NIST Framework") issued by the U.S. government as a guideline to manage our cybersecurity-related risk. The NIST Framework outlines security controls and outcomes over five functions: identify, protect, detect, respond, and recover; • conduct network and endpoint monitoring, vulnerability assessments, and network penetration testing; • conduct quarterly information security management and incident training, and regular phishing email simulations for all associates to enhance awareness and responsiveness to possible threats; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our policies and procedures; • conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services; and • maintain global information security policies and procedures, including an incident response and crisis management plan that include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: Based on the information available as of the date of this Form 10-K, during our fiscal year 2023 and through the date of this filing, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on risks to us from cybersecurity threats, see "Risks Related to Information Technology - A cyber security incident could cause a violation of HIPAA, breach of patient or other persons privacy, or other negative impacts." under "Item 1A. Risk Factors."

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: We are a "blank check" company whose business plan is to merge with an operating company, and, in addition, as a "shell company" we have no or nominal assets (other than cash) and no or nominal operations. Accordingly, we do no t have material information to disclose regarding our cybersecurity risk management, strategy and governance.

companyName: Stratos Renewables Corp

ticker: SRNW


text: Responsible for the day-to-day execution of our cybersecurity strategy, our Senior Director of Cybersecurity has a background with experience in information security and risk management. This person has over 28 years of IT and cybersecurity experience, with over 10 years specializing in digital forensics, incident response, and risk management, and holds a Management of Information Systems degree and Certified Information Systems Security Professional ("CISSP") and Certified Information Security Manager ("CISM") cybersecurity certifications. The Senior Director of Cybersecurity develops and implements policies, procedures, and controls to safeguard our information assets, and leads incident response efforts, ensuring a swift and effective response to potential cyber threats.

companyName: Snap One Holdings Corp.


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely our Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high-rated incidents to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.

companyName: Information Services Group Inc.

ticker: III


text: We have formed cybersecurity councils to provide overall corporate oversight for managing material risks from cybersecurity threats. The cybersecurity councils meet regularly to receive updates on cybersecurity developments at Sempra and our consolidated entities from their cybersecurity management teams.

companyName: SEMPRA

ticker: SREA


text: Finally, the IRP is also supported by a full curriculum of training for employees that is drafted and administered under the supervision of our Chief Compliance Officer. Importantly, these training sessions include several modules and quizzes for both technical and non-technical employees to assist our employees in comprehensively understanding the importance of data security to our stakeholders and our business and the various ways they can promote a security environment throughout our company.

companyName: ContextLogic Inc.


text: A cloud computing platform offered by Microsoft, delivering a range of services for building, deploying, and managing applications. Azure supports various programming languages, tools, and frameworks for efficient development and scaling of applications. applications, hybrid cloud solutions, data analysis, building predictive models, continuous integration and deployment (CI/CD) suite of productivity and collaboration tools combining familiar Office apps, cloud-based services, and robust security features. email, document creation, cloud storage, security & compliance, mobile productivity, automation (Power Automate)

companyName: RYTHM, Inc.

ticker: RYM


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We utilize various risk management guides, as well as the protocols of certain certifications as described below to identify, assess, and manage cybersecurity risks relevant to our business through our risk management program. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Teads Holding Co.

ticker: TEAD


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and IT Steering Committee each having certain responsibilities relating to risk management of cybersecurity.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging cyber threat landscape. The Audit Committee also receives updates on cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to promptly report incidents to the Chief Financial Officer in accordance with the Company's incident response plan. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Third-Party Relationships The Company utilizes partners and third-party service providers to help deliver safe and reliable water and wastewater services across its regulated operations and has implemented a third-party risk management program to understand the cybersecurity risks to the Company that may arise out of these third-party relationships. The Company categorizes third-party relationships by risk level, which is determined primarily by the service provided by the third-party and its level of access to the Company's data. Each category has specific cybersecurity controls, data privacy and documentation requirements, which are outlined in the agreement between the Company and the third-party service provider. In addition, the Company evaluates the online security footprint for its service providers at the time of agreement, and on a regular basis, thereafter, depending on the provider's risk level. The Company reviews its agreements with third-party service providers periodically related to terms and conditions governing cybersecurity controls and data privacy. The Company also monitors, as appropriate, risks relating to potential compromises of sensitive Company information through third parties and reevaluates these risks periodically. In addition, the Company obtains annual attestation reports related to data security and privacy from certain third-party providers to further support compliance with industry-standard cybersecurity protocols.

companyName: American Water Works Company, Inc.

ticker: AWK


text: Our HR department is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CFO, working with our Manager of IT Infrastructure, is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports. Our legal department is also responsible for performing a cyber risk assessment on each new vendor.

companyName: Aspira Women's Health Inc.

ticker: AWHL


text: Our SVP of Information Technology has over 20 years of information technology experience, with over 15 years of experience leading technology and cybersecurity programs in biopharmaceutical companies. Since joining Nurix in 2021, our SVP of Information Technology has led all information technology strategy and operations, including our cybersecurity program. Previously, he served as Chief Technology Advisor focused on cybersecurity incident response and strategic security consulting, and held senior IT leadership roles at multiple clinical-stage biotechnology companies. He holds industry cybersecurity certifications and is undertaking advanced studies in IT Management and Cybersecurity.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Our VPE&T, is primarily responsible for assessing and managing material risks from cybersecurity threats, including monitoring the measures used for prevention, detection, mitigation and remediation of cybersecurity incidents. The information security organization is comprised of internal IBO employees and external security suppliers who provide security monitoring and response.

companyName: DSS, INC.

ticker: DSS


text: We are not aware of any material cybersecurity violation or occurrence. We believe our efforts toward prevention of such violation or occurrence, including system design and controls, processes and procedures, training and monitoring of system access, limit, but may not prevent unauthorized access to our systems.

companyName: Gamida Cell Ltd.


text: For additional information regarding whether any risks from cybersecurity threats are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition, please see the section titled "Risk Factors."

companyName: Revolve Group, Inc.

ticker: RVLV


text: The Company's information technology department helps identify, assess and manage Capricor's cybersecurity threats and risks. The information technology department, in coordination with the finance and/or legal departments, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, evaluating threats reported to us, conducting audits, performing threat assessments, and conducting vulnerability assessments to identify vulnerabilities. We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including legal counsel, and cybersecurity software providers. Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our board of directors. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact on our business. The Company is currently in the process of implementing a cybersecurity oversight committee to enhance governance and ensure dedicated focus on cybersecurity risk management. This committee will work closely with the board to provide regular updates on the organization's cybersecurity posture, performance, and emerging risks, while ensuring that cybersecurity strategies align with business objectives and regulatory requirements.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: Moreover, our commitment to robust risk management extends to the maintenance of a comprehensive Security Incident Response Plan ("SIRP"). This SIRP serves as a framework for effectively addressing and mitigating security incidents. Within this plan, we integrate accessible resources to fortify our response capabilities. This includes establishing collaborative partnerships with insurance providers, regulatory agencies, and law enforcement agencies, ensuring a seamless and coordinated approach in the event of a security incident. Recognizing the interdependence of our practices with service providers and vendors, we actively engage with our partners during the notification and investigation processes following a security incident. This collaborative effort is designed to foster complete visibility into the nature and scope of security risks and events, enabling a unified and effective response. In addition to incident response, the Company implements robust data protection measures, including encryption protocols, multi-factor authentication, and data loss prevention controls, to safeguard sensitive information. To ensure we can keep our operations running smoothly, we maintain and regularly test our business continuity and disaster recovery plans. These measures help minimize disruption and ensure a swift recovery in the event of a cybersecurity incident.

companyName: Richmond Mutual Bancorporation, Inc.

ticker: RMBI


text: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which are used along with a risk-based approach to plan and implement changes or improvements to the security environment. The Company has engaged independent experts to assess the security environment for potential vulnerabilities or weaknesses and has plans for future engagements periodically to supplement the expertise and processes established within the Company. Thorough updates are provided to the board of directors quarterly by the Vice President, IT Operations and Security. The directors may ask questions or engage in further discussion related to the security environment.

companyName: Global Water Resources, Inc.

ticker: GWRS


text: Management of Third-Party Risk: The Company's comprehensive third-party management process includes rigorous due diligence, oversight and identification of cybersecurity risks associated with vendors and service providers.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: We engage outside experts where appropriate to aid in maturing, implementing and testing the cybersecurity program and to review our cybersecurity operations. This includes incident response testing through tabletop exercises facilitated by external consultants. We have implemented training and awareness programs to educate our employees on cybersecurity risks, which includes regular educational phishing campaigns, and our Internal Audit function performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to develop and mature our cybersecurity operations to respond to the dynamic cybersecurity landscape.

companyName: CUMMINS INC

ticker: CMI


text: Information security and data privacy have been and remain of the utmost importance to the Company in light of the value we place on maintaining the trust and confidence of our consumers, employees and other stakeholders.

companyName: YUM BRANDS INC

ticker: YUM


text: To date, we have not identified any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, because the sophistication of cybersecurity threats continues to increase with rapidly evolving techniques to overcome security measures, the preventative actions we have taken and will continue to take to reduce the risks may not successfully protect our systems against a future cybersecurity incident. For more information on how cybersecurity risk could materially affect our business, please refer to Item 1A, "Risk Factors."

companyName: HORTON D R INC /DE/

ticker: DHI


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Company's information security and cybersecurity program is managed by our Chief Information Security Officer (CISO) and our Chief Technology Officer (CTO). The CISO and the Senior Director Information Security are responsible for our overall security and assessing and managing cybersecurity risks and threats. The CISO has over 20 years of information security, privacy, auditing and compliance experience and holds numerous certifications. The Senior Director of Information Security has over 15 years of experience in information security, and holds numerous certifications. The CTO has over 20 years of experience and leads our Company's information systems and technological advancements. The SVP of Engineering has over 20 years of experience in IT and has specialized knowledge in systems and network infrastructure. The Director of Site Reliability Engineering and Security has nine years of experience and has principal responsibility for our network operations and system administration.

companyName: Talkspace, Inc.

ticker: TALK


text: While we have not identified any cybersecurity threats or incidents that have materially affected us since the beginning of the last fiscal year, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Relating to Our IT Systems."

companyName: QuidelOrtho Corp

ticker: QDEL


text: cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and third-party risk management process for service providers, suppliers, and vendors.

companyName: SurgePays, Inc.

ticker: SURG


text: The Board receives regular reports from the CIO concerning the Company's significant cybersecurity threats and risks and the processes the Company has implemented to address them. These reports also include materials related to certain cybersecurity trends the Company has identified, potential cybersecurity threats and risk, and proposed mitigation measures.

companyName: TerrAscend Corp.

ticker: TSNDF


text: We maintain a global cybersecurity policy that incorporates recognized industry standards from the National Institute of Standards and Technology including the Cybersecurity Framework and Special Publication 800-53 Security and Privacy Controls for Information Systems and Organizations as well as various security certifications.

companyName: FISERV INC

ticker: FISV


text: The IT Steering Committee and/or the full Executive Team receive at least quarterly reports from management on information technology matters, including cybersecurity. The reports address upgrades to hardware, software, and IT systems throughout the Company, and include the identification of IT and cybersecurity risks. Security scores, risk management, and mitigation measures are routinely presented. As discussed above, we maintain endpoint and other protection systems, and incident response processes, both internally and through third-party experts. As these systems, processes, training, and upgrades are implemented, updates are provided to the Executive Team.

companyName: HALLADOR ENERGY CO

ticker: HNRG


text: The IRT is also responsible for reporting incidents, following Valvoline's Information Security Incident Response Plan ("IRP"), in accordance with legal requirements, coordinating external communications, and setting information sharing restrictions. Other departments or individuals may be engaged according to the specific nature of the incident and will operate at the direction of the IRT. Valvoline's Senior Director of Information Security is responsible for the implementation of, and amendments to, the IRP and supporting procedures.

companyName: VALVOLINE INC

ticker: VVV


text: We faces various cyber risks, including, but not limited to, risks related to the storage of members' information, and security breaches could expose us to a risk of loss or misuse of this information, litigation and potential liability. We utilize a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cyber and information security. Additionally, we devote significant resources to protecting the security of our computer systems, software, networks and other technology assets. Our efforts are designed to adapt with the evolution of information security risks and appropriate best practices and include physical, administrative and technical safeguards. The risk assessment is discussed with the CEO on at least an annual basis. Our practices are generally developed from, and benchmarked against, recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Pony Group Inc.

ticker: PNYG


text: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-virus and anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Propanc Biopharma, Inc.

ticker: PPCB


text: We maintain a cybersecurity program designed to identify, assess, manage, mitigate, and respond to cybersecurity risks, and we partner with leading cybersecurity experts to continually enhance the security of our operating environments. Some of the key risks identified include unauthorized access to our systems, spoofing valid credentials, and monetary motivated attacks, amongst others. As an organization, we have devoted significant resources to cybersecurity processes aimed at addressing the known risks, as well as adapting to the changing cybersecurity landscape and responding to emerging threats in a timely and effective manner. We assess the materiality of cybersecurity risks and incidents based on factors such as financial impact, regulatory implications, operational disruption, and reputational harm. Material cybersecurity incidents, if any, are evaluated in accordance with SEC guidelines, and appropriate disclosures are made when required. Our comprehensive cybersecurity program is implemented and maintained using information security tools, policies, training, and a team of information technology professionals. We have a Cybersecurity Incident Response Plan and a Business Continuity and Disaster Recovery Program, in addition to other company policies and procedures that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information, and the use of the internet, social media, email, and wireless devices. These policies go through an internal review process, are approved by the appropriate members of management, and are a required part of our employee training on an annual basis.

companyName: GENESIS ENERGY LP

ticker: GEL


text: Third Party Support of the Cyber Risk Management Program We employ third parties to support our cyber risk management program in the following ways: Use of internal and external auditors to maintain compliance with regulatory requirements.

companyName: Harmony Biosciences Holdings, Inc.

ticker: HRMY


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our DO, with the appropriate members of management, will work with the Company's incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the Audit Committee of the Board of Directors ("Audit Committee") for certain cybersecurity incidents.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: We have tailored our business applications and hosting services to reduce the impact of cybersecurity incidents. We utilize the Google Cloud Suite for email, office documents, and communication. Our ERP and Financial System operate on RDP and SQL server, which are backed up nightly through a SQL backup. All our servers are backed up to tape and transferred off-site every night. Our third-party provider has the necessary tools to restore and clone servers in a timely manner.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: Engagement with Third Parties on Management of Cybersecurity Risk Recognizing the dynamic nature of cybersecurity threats, Nordstrom collaborates with external experts, including assessors, consultants and examiners, to evaluate and test our cybersecurity risk preparedness. Regular exams, threat assessments and consultation on security enhancements with these third parties ensure that our cybersecurity strategies align with industry best practices.

companyName: NORDSTROM INC


text: The Incident Response Team has overall authority and responsibility for preparing and responding to incidents and consists of various sub-teams including representation from operations, technology, risk, compliance, human resources, and marketing. While key personnel have identified roles, this team ensures appropriate reports, statuses, and decisions are presented to the Executive Management and the Board of Directors.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Management's Role in Cybersecurity Risk Management Our management, including our CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CCO oversees our risk management function generally and relies on the FS Investments CISO to assist with assessing and managing material risks from cybersecurity threats. The CISO has over 15 years of experience in actively managing cybersecurity and information security programs for financial services companies with complex information systems. The CCO has been responsible for this oversight function as our CCO for over 10 years and has worked in the financial services industry for over 40 years, during which the CCO has gained expertise in assessing and managing risk applicable to us.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: In addition, our board of directors, as a whole and through its Risk Policy & Compliance Committee (the "Risk Committee"), is responsible for the oversight of risk management. In that role, our board of directors and Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both our board of directors and the Risk Committee receive quarterly reports from our management team, including from our Chief Risk Officer and our Chief Information Security Officer regarding cybersecurity risks, and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

companyName: Midland States Bancorp, Inc.

ticker: MSBI


text: We engage third parties in connection with our risk assessment processes. We require each third-party service provider to adhere to our internal security policies and certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our systems. These service providers are primarily overseen by our Vice President of Information Technology ("VP of IT") and assist us in monitoring and testing our safeguards, including execution of external penetration testing and ongoing real time vulnerability assessments through our extended detection and response processes to identify cybersecurity threats. We conduct risk assessments in the event of a material change in our business processes that may affect information systems that are vulnerable to such cybersecurity threats through our normal change control processes. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Arq, Inc.

ticker: ARQ


text: To date, we are not aware of any cybersecurity breach or other incident with respect to our systems or data that would have a material impact to our business strategy, results of operations or financial condition. Additionally, we are not aware of any cybersecurity breach or other incident experienced by anyone with whom we have a third-party relationship that has had a material impact on our systems or data. However, there can be no guarantee that we will not experience any such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: ERIE INDEMNITY CO

ticker: ERIE


text: As further discussed in Item 1A. Risk Factors, a material cybersecurity incident could significantly increase the cost of doing business or otherwise adversely impact our financial results and condition. To date we have not had a cybersecurity incident that has had, or is reasonably likely to have, a material effect on our financial results or business operations; however, we monitor and work to continuously improve our cybersecurity program as threats become more frequent and sophisticated.

companyName: ALBEMARLE CORP

ticker: ALB


text: We have implemented and we maintain a cybersecurity program that includes a well-defined set of security controls and measures designed to identify, assess, and manage material cybersecurity risks.

companyName: Anterix Inc.

ticker: ATEX


text: Cibus engages external resources that contribute to and provide evaluation of, its existing cybersecurity practices and organizational risk assessment systems. Further, Cibus has processes designed to identify, assess, and manage third party service provider risks when third parties handle, possess, process, and store the Company's material information.

companyName: Cibus, Inc.

ticker: CBUS


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intel service providers, and cybersecurity software providers. We also use third-party service providers to perform a variety of functions throughout our business, such as hosting companies, application providers, contract research organizations, supply chain resources, and contract manufacturing organizations. We manage cybersecurity risks associated with our use of these providers by conducting audits and risk assessments on certain vendors, requesting and analyzing responses on a security questionnaire, and reviewing relevant reports.

companyName: Clearside Biomedical, Inc.

ticker: CLSDQ


text: management and strategy have developed and maintain a cybersecurity risk management program that focuses primarily on securing and safeguarding computer systems, networks, cloud services, business applications, and data and that is integrated in our overall risk management strategy and framework.

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: The Company recognizes the importance of cybersecurity and the potential risks associated with cyber incidents. As a small entity with simple operations managed solely by our Chief Executive Officer (CEO), we have not implemented formal cybersecurity policies or procedures. However, we take reasonable steps to protect our electronic data and ensure the security of our operations.

companyName: C & C TOURS, INC.


text: The management team – including our Chief Information Security Officer ("CISO") – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company. Such reports are typically provided at an Audit Committee meeting and enable Audit Committee members to ask questions of management and engage in additional discussions in an open forum. The Audit Committee also periodically evaluates our overall cybersecurity strategy.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT") audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; regular vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: AGM ' s CISO, in coordination with the Apollo Technology and ERM teams, works collaboratively across Apollo to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of Apollo ' s cybersecurity risk management program, multidisciplinary teams throughout Apollo are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, AGM's CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the AGM audit committee or AGM board of directors, as appropriate.

companyName: Apollo Commercial Real Estate Finance, Inc.

ticker: ARI


text: We have implemented a holistic review of incident response, with workflows in place for cybersecurity incidents, including provisions for assessing materiality, and defined escalation procedures.

companyName: Archer Aviation Inc.

ticker: ACHR


text: Our cybersecurity and privacy program includes mandatory annual training for all employees and contractors reinforced by targeted phishing tests. The annual training includes training on how to identify potential cybersecurity and privacy risks and protect our resources and information. Additionally, we provide additional specialized security training for employees in roles relating to product development or information technology.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: Our Vice President of Information Technology regularly evaluate the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management and Risk Management teams. Our Vice President of Information Technology and Director of Risk Management each have approximately 25 years of experience, and holds certifications in cybersecurity from accredited information technology certification providers.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Via Renewables, Inc. implements stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Via Renewables, Inc.

ticker: VIASP


text: To further protect their information systems, the Advisor and its affiliates structure and monitor relationships with various third-party service providers and periodically conduct due diligence on their cybersecurity architecture date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, our business strategy, results of operations, or financial condition.

companyName: Lightstone Value Plus REIT III, Inc.


text: Third Party Risk Management We use third-party service providers to perform a variety of functions throughout our business, including application providers and hosting companies. The Company has implemented a risk-based approach designed to help identify and mitigate cybersecurity threats associated with the use of third-party service providers, including an assessment of the security protocols of certain service providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our third-party service provider risk management process involves different levels of assessment designed to identify cybersecurity risks associated with the provider and imposes contractual obligations related to cybersecurity on the provider.

companyName: FrontView REIT, Inc.

ticker: FVR


text: Information Security Risk Management and Strategy The Company is committed to developing robust governance and oversight of cybersecurity risks and to implementing processes, controls and technologies designed to help assess, identify, and manage material risks. As described further in "—Information and Security and Governance Oversight" below, the Vice President of IT is responsible for Li-Cycle's information security program and as part of its broader risk oversight, the Board of Directors of the Company oversees risks from information security threats both directly and through the Audit Committee of the Board of Directors of the Company. Our information technology ("IT"), infrastructure, applications, and networks are susceptible to potential impacts due to the escalating sophistication and frequency of cyber-attacks and security incidents. Breaches in our technology systems, whether from circumventing security measures, denial-of-service attacks, hacking, phishing, computer viruses, ransomware, malware, employee errors, malfeasance, social engineering, vendor software supply chain compromises, physical breaches, or other actions, have the potential to compromise the confidentiality, availability, and integrity of crucial information. Such incidents may cause interruptions or malfunctions in our manufacturing systems, applications, and data processing, thereby disrupting other business operations. Additionally, critical information associated with our business operations is managed by some of our third-party vendors.

companyName: Li-Cycle Holdings Corp.


text: The Company conducts regular assessments of cybersecurity risks both internally and with third party assistance Information Technology Director reports on the results of these assessments and corresponding recommendations to the full Board of Directors at least annually. We use the National Institute of Standards and Technology ("NIST") framework to regularly assess the threat landscape and support a cybersecurity strategy based on prevention, detection and mitigation. In general, the Company seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving confidentiality, managing data security and availability and effectively responding to cybersecurity incidents when they occur. Management's philosophy on cybersecurity is to be vigilant in protecting the Company through investments in tools and employee awareness to aid in the prevention, detection and mitigation of cyber threats, while recognizing that not all threats are preventable.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: This structured approach to governance and oversight, with an emphasis on receiving feedback allows us to align across the Alta organization. By prioritizing the identification and management of cybersecurity risks, we aim to safeguard our assets and maintain the continuity of our business operations in the face of evolving cyber threats.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: Company maintains a cybersecurity risk management program that establishes safeguards for protecting the confidentiality, integrity, and availability of our data, technology, and information systems. The program includes general controls for managing changes in and access to the Company's IT environment, cybersecurity awareness and training to help employees identify and mitigate against cybersecurity threats, cybersecurity incident response plans and third-party incident response retainers to help expedite the Company's response in the event of a cybersecurity incident.

companyName: Royale Energy, Inc.

ticker: ROYL


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For more information about the cybersecurity risks we face, see the risk factor entitled "Any security breach, unauthorized access or disclosure, or theft of data, including personal information, we, our third party service providers, or our suppliers gather, store, transmit or use, could harm our reputation, subject us to claims, litigation, and financial harm and have an adverse impact on our business" within Item 1A. Risk Factors.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: In December 2024, we completed the Palisades Acquisition and have aligned all new employees acquired through such acquisition with our cybersecurity training and governance framework, including the Incident Response Team, which now includes legacy Palisades employees. We are conducting comprehensive risk assessments to identify additional steps that may be necessary to fully align the legacy Palisades information systems and cyber security practices with our systems and practices.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity program.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: The cybersecurity risk management and strategy processes are overseen by the Sponsor's cybersecurity committee which consists of the Company's chief financial officer and general counsel, and the CTO, legal, risk management, and compliance teams Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, and compliance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: Risk Management and Strategy Overview As cybersecurity threats rapidly evolve in sophistication and become more prevalent, especially with the increasing use of artificial intelligence technology, we have implemented a cybersecurity risk management program as part of our oversight, evaluation and mitigation of enterprise-level risks. We recognize the importance of developing, implementing, and maintaining cybersecurity measures that are designed to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors of any significant cybersecurity risks and developments.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: All cybersecurity risks are logged into our cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.

companyName: Terran Orbital Corp


text: Our chief information officer meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the chief financial officer reviews with the audit committee at least annually our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: The Company's IT Manager and executive team is responsible for the day-to-day management of cybersecurity risks, while the Company's Board of Directors has responsibility for oversight of risk management.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Due diligence is performed prior to onboarding all third parties with access to the Company's information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company's Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool and the Center for Internet Security Critical Security Controls.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our senior IT leadership is responsible for the day-to-day management and development of appropriate cybersecurity programs, including as may be required by applicable law or regulation. Our senior IT leadership monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents as part of the cybersecurity programs described above, works closely with the SC, and reports regular updates to the Audit Committee. Our IT team is led by our Vice President – IT, who has over 13 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support, and execution.

companyName: Nine Energy Service, Inc.


text: In general terms, under our cybersecurity program, we undertake measures to protect the safety and security of our information systems and the data maintained within those systems. We have implemented administrative, technical and physical controls on our systems and devices in an attempt to prevent unauthorized access and to promote business resilience in the event of that access. Core elements of our program include the real-time monitoring of both our network and external cybersecurity activity by our internal security operations center and our third-party service providers and the procedures for backing up and recovering our systems. We periodically test the adequacy of our security, business continuity, and disaster recovery measures, including an annual tabletop exercise involving representatives from all key functional departments with the Company, our outside cybersecurity legal counsel, and our primary forensic services firm. Our legal and technical advisors direct the exercise and provide feedback on our performance, which is shared with management and our board of directors. We provide our employees annual training and regular reminders on measures they can take to prevent breaches and other cyber threats, including phishing schemes. We participate in the vulnerability scanning service offered by the Cybersecurity and Infrastructure Security Agency on our internet facing systems and engage external security consultants to perform an annual penetration test of our network. Our systems that process electronic protected health information are risk assessed on a quarterly basis against NIST security controls. Additionally, we maintain insurance coverage for cybersecurity incidents.

companyName: Encompass Health Corp

ticker: EHC


text: In order to be appointed to one of the roles described above, we require the individuals to possess significant relevant experience and expertise in information security, technology, risk management or audit, as demonstrated by a combination of prior employment, possession of relevant industry certifications or related degrees, and other competencies and qualifications. In particular, our CISO has more than 30 years of cybersecurity and information technology experience, including for nearly five years as CISO at a major global technology company before joining the Company, and holds a CISO Certificate from Carnegie Mellon's Heinze College. Our CTRO has been in cybersecurity for approximately 25 years and spent over three years as the global CISO of a G-SIB. Prior to that, he served as a senior executive in cybersecurity in the U.S. government. Our CIO has been with the Company for approximately 20 years, during which he has overseen multiple technology transformation initiatives, including the Company's transition to the public cloud. He holds degrees in physics and business administration from Harvard University.

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We have established a comprehensive, enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. This program is seamlessly integrated into our overall risk management and internal control systems, subject to regular reviews by senior management.

companyName: Cineverse Corp.

ticker: CNVS


text: Board of Directors The Southern Company Board of Directors (Board), along with certain committees (primarily the Audit Committee of the Board) oversees the Southern Company system's enterprise risk management process. The Board devotes significant time and attention to overseeing cybersecurity risk, and the Southern Company system's approach to cybersecurity governance establishes oversight throughout the enterprise. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Business Security and Resiliency Committee (BSRC) of the Board. Having a committee like the BSRC, focused on and dedicated to security, is a strong governance practice. Comprised solely of independent members of the Board, the BSRC is charged with oversight of risks related to cybersecurity, physical security, and operational resiliency. The BSRC includes directors with an understanding of cyber issues. The BSRC meets at every regular Board meeting and when needed in the event of a specific threat or emerging issue. The Chair of the BSRC regularly reports to the Board in connection with key matters the BSRC considered. The BSRC routinely receives presentations on a range of topics, including the threat environment and vulnerabilities and risks, policies, practices, technology trends, and regulatory developments, from the Chief Information Security Officer (CISO) and the legal organization and, as needed, the Chief Information Officer (CIO). The CISO reports to the BSRC at each regular committee meeting. Protocols have been established by which certain cybersecurity incidents are escalated internally and, where appropriate, reported to the BSRC, and ongoing updates regarding any such incident are provided until it has been resolved. See "Incident Response" herein.

companyName: SOUTHERN CO GAS


text: Like many other companies, the Company relies on third-party vendor solutions to support its operations, and these third-party vendors continue to be a source of operational and informational risk. Accordingly, the Company utilizes a third-party risk management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: An incident response plan designed to coordinate the activities that we and our third-party security service providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate incidents, as well as to comply with applicable legal obligations and mitigate any reputational damage;

companyName: FutureFuel Corp.

ticker: FF


text: The SIRT is composed of employees with expertise in various aspects of our operations including information security, information technology, DevOps, legal, and EVSE engineering, as well as senior leaders, including our President, Chief Financial Officer and Chief Legal Officer.

companyName: EVgo Inc.

ticker: EVGO


text: Our information security team plays a pivotal role in managing our cybersecurity risk. They oversee security controls and orchestrate our response to incidents—whether they originate internally or from our vendors, suppliers or other third parties that we conduct business with. As part of our vendor selection process, we evaluate cybersecurity risks in appropriate situations. Furthermore, we conduct tabletop exercises periodically. These simulations allow us to test our response strategies across various business functions, allowing preparedness for real-world incidents. When risks are identified through our processes, we analyze their potential impact on the Company and assess the likelihood of occurrence. Our monitoring efforts help us to timely mitigate and remediate risks and incidents. As part of our commitment to security awareness, information security training is mandatory for every employee and contractor. This ongoing compliance program reinforces best practices and helps to foster a security-conscious culture.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: Cybersecurity Risks Notwithstanding the discussion above and our efforts to address cybersecurity risks, we cannot guarantee you that we can mitigate or eliminate all cyber-related risks, including those related to operational disruption; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; customer attrition; and reputational risks. We urge you to read our discussion regarding whether and how risks from identified cybersecurity threats could materially affect us as part of our risk factor disclosures at "Item 1A - Risk Factors"—Risks Related to Our Business and Industry" and "—Risks Related to Our Technology and Intellectual Property" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Our Senior Vice President of Corporate Services & Chief Risk Officer (SVP & CRO), who reports directly to our Chairman, President & CEO leads a team that is responsible for managing our enterprise-wide information security strategy, policy, standards, architecture, and processes, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our SVP & CRO holds a Master's Degree in Business Administration and a Bachelor's Degree in Management Information Systems, has over 25 years of information and operational technology experience, is a certified Project Management Professional, and is a Certified Information Security Manager from the Information Systems Audit and Control Association. He served for one year as the President of the Bay Area InfraGard chapter and four years on its Board. InfraGard is a collaboration between the Federal Bureau of Investigation (FBI) and members of the private sector that promotes the protection of U.S. critical infrastructure and enables the exchange of important information. Our Director of IT Security and Chief Information Security Officer (CISO), who reports to the SVP & CRO, has over 25 years of information technology and 15 years of cybersecurity experience and holds a Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: In the event of a possibly material cyber incident, the Security Incident Response Team, under the direction of the Corporate General Counsel and/or the Chief Legal Officer, would collect and document information relevant to materiality and make a threshold determination as to whether such cybersecurity incident (including those occurring on the information systems of third parties) is potentially material. The Security Incident Response Team would meet with the Chair of the ERC Committee to review the preliminary findings of the Security Incident Response Team, including the possible factors in determining materiality. If the Security Incident Response Team and the Chair of the ERC Committee determine that the cybersecurity incident warrants further review after consideration of such findings and factors, the Audit Committee would be convened for a meeting (to which all members of the ERC Committee would be invited) to review the cybersecurity incident and the findings of the Security Incident Response Team and the Chair of the ERC Committee. The Audit Committee would then make a materiality determination consistent with SEC guidance and by considering relevant quantitative and qualitative factors, informed by any recommendations of the ERC Committee and/or its Chair.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: We use third-party service providers to assist us from time to time to identify and monitor material risks from cybersecurity threats, including legal counsel and other professional services firms, threat intelligence services, and cybersecurity consultants.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Live Nation, an equity affiliate, as a separate publicly traded company from Liberty, operates its own cybersecurity function. Oversight for Live Nation's cybersecurity functions rests with its board of directors, of which an employee of Liberty is a member, in collaboration with Live Nation's Global Data Governance Board and Audit Committee.

companyName: Liberty Media Corp

ticker: FWONA


text: Our senior management, including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Co-Chief Operating Officers, are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to provide reasonable assurance that such potential cybersecurity risk exposures are monitored, instituting appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity program is led by our CFO who has experience in cybersecurity risk management from both a practical and management standpoint and utilizes third-party consulting firms on a regular basis to assist with risk mitigation, incident response and overall maintenance of our cybersecurity program.

companyName: ARK RESTAURANTS CORP

ticker: ARKR


text: • Cohen & Steers' CISO oversees the information security group and program within its IT department and holds a Bachelor of Arts degree in computer science. The CISO has served in various roles in information technology for over 24 years within the financial services industry, including previously serving as Head of Information Security and Enterprise Infrastructure, Head of IT Audit and Chief Information Security Officer at other companies, and holds the Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC) certifications and is registered with FINRA for the Series 99. • Cohen & Steers' CTO oversees the IT department and holds a PhD in computer science, an MBA and Postgraduate Diploma in physics. The CTO has served in various roles in information technology for over 28 years, including senior leadership roles for the investment banking division of a financial services company. • Cohen & Steers' Head of IT Infrastructure oversees the infrastructure and service desk departments within the IT department and holds a Bachelor of Business Administration degree in finance and computer information systems. The Head of IT Infrastructure has served in various roles in information technology for over 20 years.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: Review all regulatory examination reports impacting compliance and/or risk as well as any required responses The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company's environment. Technical vulnerabilities are identified using automated vulnerability scanning tools, penetration testing, and system management tools, whereas non-technical vulnerabilities are identified via process or procedural reviews. The Company conducts a variety of assessments throughout the year, both internally and through third parties. Vulnerability assessment and penetration tests are performed to provide the Company with an unbiased view of its environment and controls. Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis. A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments. The results of key assessments are reported in summary to the Board of Directors annually.

companyName: Waterstone Financial, Inc.

ticker: WSBF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, finance, legal, human resources, among others. Our team includes individuals with relevant experience in enterprise risk management and disclosure controls and procedures. Additionally, certain members of our IT department have experience managing cybersecurity programs and are specifically assigned cybersecurity oversight. Our cybersecurity incident response processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including in some cases to our executive team. Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified.

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, violation of privacy or security laws and other litigation and legal risk; and reputational risks. We are committed to maintaining robust governance and oversight of these risks and to implementing mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks. While we have not, as of the date of this Annual Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future.

companyName: MetaVia Inc.

ticker: MTVA


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we are in the process of adopting and implementing many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework, which we believe is a best practice for U.S.-based real estate companies.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security team, such as our Chief Information Officer, Director, Applications Delivery, and our Director of Information Technology. Such individuals have nearly 40, over 30, and over 20 years of experience, respectively, in various roles involving information technology, including infrastructure and operations, security, auditing, compliance, and application development. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: Oil-Dri Corp of America

ticker: ODC


text: The Company's Board of Directors provides oversight of the Company's cybersecurity program through periodic updates, typically on a quarterly basis. Additionally, on an annual basis, cybersecurity risks are discussed as part of enterprise risk management.

companyName: NOV Inc.

ticker: NOV


text: We have also implemented procedures set forth in our cybersecurity policy that secure sensitive data protected by us, which include: • Establishing policies governing data security; • Monitoring data access throughout the organization; • Providing annual security training and awareness; • Protecting sensitive data through encryption techniques; and • Designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Further, as part of our cybersecurity risk management, we have adopted an incident response plan that has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.

companyName: MYOMO, INC.

ticker: MYO


text: The Committee receives updates at least annually from our Chief Technology and Product Officer and management on our cybersecurity risk management and strategy, including, as applicable, progress towards our risk-mitigation goals, results from third-party assessments, and the emerging threat landscape. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. Our vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for monitoring, assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats we face. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.

companyName: Knife River Corp

ticker: KNF


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the CFO. Our CFO and others work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: Structure Therapeutics Inc.

ticker: GPCR


text: In an effort to detect and defend against cybersecurity threats, the Company annually provides its employees with various cybersecurity and data protection training programs. These programs cover timely and relevant topics, including social engineering, phishing, deep fakes, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents promptly to the Company's centrally managed cyber defense and security operations.

companyName: COCA COLA CO

ticker: KO


text: Our information security function is led by our third party security consultant ("IT consultant") with whom we have worked since formation, and it helps identify, assess and manage the Company's cybersecurity threats and risks. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example automated tools, subscribing to reports and services that identify certain cybersecurity threats, conducting threat assessments for internal and external threats, engaging third parties for threat assessments, and conducting assessments to identify vulnerabilities. Our assessment and management of material risks from cybersecurity threats are integrated into our risk management processes. For example, our IT consultant and certain management, including our CFO, evaluate material risks from cybersecurity threats against our overall business objectives and our CFO periodically reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.

companyName: IN8BIO, INC.

ticker: INAB


text: During fiscal years 2024, 2023, and 2022, we did not experience a material information security breach incident, and the expenses we have incurred from information security breach incidents have been immaterial. We are not currently aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations, or financial condition. For additional discussion of the risks posed by cybersecurity threats that are reasonably likely to materially affect us, refer to Item 1A, "Risk Factors" in Part I of this Annual Report.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: The Company has an enterprise risk management program to identify, assess, monitor, and manage significant risks of the Company. The Company evaluates cybersecurity risks alongside other critical business risks under this program, and the Company also has a standalone cybersecurity program. The Company's approach to assessing, identifying, and managing material risks from cybersecurity threats is grounded in established frameworks, including those set forth by the National Institute of Standards and Technology (NIST) and other industry standards and requirements as defined by various compliance frameworks. Our cybersecurity program prioritizes key areas such as: • Policies, Standards, and Practices: We maintain comprehensive policies, standards, and practices aligned with industry practices and regulatory requirements. These documents serve as the foundation for our cybersecurity program, providing clear guidelines for safeguarding our information systems and data assets. • Threat Monitoring and Assessment: Continuous monitoring and assessment of cyber threats and vulnerabilities are integral to our risk management strategy. We utilize advanced monitoring tools and threat intelligence sources to proactively identify and address potential security risks. The Company uses third-party service providers to support its operations. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. • Audits and Assessments: Regular audits and assessments are conducted by both internal and external experts (consultants, auditors, and other third parties) to evaluate the effectiveness of our cybersecurity controls and processes and recommend improvements. These assessments help us achieve compliance with internal policies as well as external regulations and standards. • Incident Response Planning: We have developed comprehensive incident response plans to mitigate cybersecurity incidents. These plans outline clear procedures for detecting, responding to, and recovering from security breaches, minimizing the impact on our operations and stakeholders. External technical, legal, and law enforcement support is engaged as needed to support response efforts.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: Failure to maintain a reasonable and effective cybersecurity program, or any compromise of the security, confidentiality, integrity, or availability of our information systems and the sensitive, proprietary, and confidential data on such systems could lead to additional costs and liabilities, as well as damage our reputation or deter people from purchasing our products. There can be no assurance that a future breach will not occur or, if any does occur, that it can be promptly detected and sufficiently remediated without materially impacting our business or our operations. While we maintain insurance coverage that, subject to policy terms and conditions, is designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all losses or all types of claims that may arise in the event of a material cyber risk incident. For a discussion regarding risks associated with cybersecurity threats, see Risk Factors – General Business Risk – "Interruption in telecommunication, information technology and other operational systems, or a failure to maintain the security, confidentiality or privacy of sensitive data residing on such systems, could harm our business," and "The use or anticipated use of AI technologies, including generative AI, by us or third parties, may increase the operational risks discussed above, or create new or unanticipated operational risks."

companyName: CNO Financial Group, Inc.

ticker: CNO


text: The Chief Information Officer supervises the information security team, which is responsible for maintaining and implementing our enterprise-wide cybersecurity strategy, policy, standards, and architecture processes. The Information Security Officer, in coordination with compliance and human resources, conducts annual and ongoing company-wide information security awareness training. The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience. We have developed processes to identify and oversee risks from cybersecurity threats associated with third-party service providers, which include the information security team assessing cybersecurity robustness during third-party vendor onboarding, the inclusion of protective provisions in third-party vendor agreements, and risk-based monitoring of third-party vendors on an ongoing basis.

companyName: PLUMAS BANCORP

ticker: PLBC


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, which includes disaster recovery, are designed to deliver resilience and comply with several regulatory requirements including DFARS/NIST 800-171 controls. For our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Adviser, J.P. Morgan, and its affiliates have experienced, and expect to continue to experience, a higher volume and complexity of cyber-attacks against the backdrop of heightened geopolitical tensions. The Adviser leverages J.P. Morgan's Global Technology's Cybersecurity and Technology Control ("CTC") Function, which is responsible for the governance and oversight of J.P. Morgan's cybersecurity program. In partnership with J.P. Morgan's lines of business, the CTC organization identifies information security risk issues and champions programs for the technological protection of J.P. Morgan's information resources, including applications, infrastructure and confidential information related to the firm's clients. J.P. Morgan has implemented measures and controls reasonably designed to address this increased risk, such as enhanced threat monitoring. There can be no assurance that the measures taken by us, the Adviser, J.P. Morgan and its affiliates will be successful in defending against cyber-attacks.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Members of management report to our Chief Financial Officer who is the member of management that is principally responsible for overseeing our cybersecurity risk management program. Our Chief Financial Officer holds an undergraduate and graduate degree in economics and has over 14 years of experience with managing risks at the Company and in environments similar to the Company's, including risks arising from cybersecurity threats. Additionally, our Director of IT has served in various roles in information technology and information security for over 23 years. Our Director of IT holds an undergraduate degree in information technology and has attained the following professional certifications: CompTIA Network+, CompTIA Security+, Microsoft Certified Professional, Cisco Certified Network Associate, and Department of Defense Information Assurance Technical, Level II. Further, our Director of Corporate Business Systems holds a Bachelor of Science degree in Construction Science and Management and has over 8 years of experience with software implementations, technology innovation, and corporate business systems.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Our cybersecurity policies, standards, processes and practices are integrated into our enterprise risk management processes and are based on a recognized framework established by the National Institute of Standards and Technology ("NIST"). In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. We have established and maintain comprehensive incident response and recovery plans that detail our planned responses to cybersecurity incidents. These plans are tested and evaluated on a regular basis. We periodically assess and test the policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Our Board of Directors oversees an enterprise-wide approach to risk management, including cybersecurity risks. While the Board has the ultimate responsibility for risk oversight, each committee of the Board also oversees risk to the extent it relates to the committee's responsibilities and provides reports to the Board in its respective area of responsibility. The Risk Committee of our Board also focuses on an enterprise-wide approach to risk management, and has primary oversight responsibility for areas of quality and nonfinancial compliance issues, including cybersecurity risks. The Risk Committee receives periodic updates from the CISO and CIDO on our cybersecurity risks and threats, assessments of our cybersecurity program and the evolving threat landscape. Our Board of Directors also receives annual updates on such cybersecurity matters, or more frequently as appropriate under the procedures described below. Our Board of Directors also receive cybersecurity risk assessments as part of the annual ERM program presentation described above.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed by IT Management for remediation. When we engage vendors and other third party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Board of Directors Our Board of Directors oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has primary responsibility to oversee risks from cybersecurity threats and has designated a specific Director, who possesses significant experience in information technology, as a special liaison (the "Technology Liaison") between management and the Board of Directors. The Board of Directors as a whole, or through the Technology Liaison, regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Technology Liaison receives quarterly updates from the Director of Infrastructure and Security and the Vice President of Information Technology relating to significant risks, cyber incidents, key performance indicators measuring the effectiveness of the Company's cybersecurity risk program and other relevant matters. The Technology Liaison regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Technology Liaison and the Board. In addition to the regular updates to the Technology Liaison, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Technology Liaison.

companyName: FARMER BROTHERS CO

ticker: FARM


text: Our Vendor Risk Management ("VRM") program aids in evaluating the cybersecurity and data privacy risks associated with the use of vendors and other third parties that will be processing, storing, or handling Bandwidth employee, business or customer data. The VRM program is designed to evaluate third-party risk, advise on selection or implementation recommendations, and inform privacy, security and data protection contractual terms. We rely, however, on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: Bandwidth Inc.

ticker: BAND


text: Members of senior leadership, including the Volato Group Board ("Board"), assesses potential material risks to the business and the Company's ability to meet strategic priorities, including risks from cybersecurity threats. The Company's senior leadership receives updates from relevant functional heads or other subject matter specialists on these potential material risks as well as the processes or other steps being taken to manage or mitigate the risks. The senior leadership team includes senior leaders in areas of importance to Company priorities. The Company's senior leadership assesses and prioritizes risk based on impact to shareholders, operations, and strategic priorities, among other factors. Members of senior leadership discusses enterprise risks and compliance programs with the Audit Committee of the Board. The Audit Committee makes reports to the Board, who also receive updates from members of senior management on material risks to the Company.

companyName: Volato Group, Inc.

ticker: SOAR


text: The Cybersecurity Program and related initiatives are managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.

companyName: BORGWARNER INC

ticker: BWA


text: We are committed to protecting the security of our systems and the data we handle. We are currently designing a program to align with international best practices used in our industry, such as the Cyber Security Framework from the National Institute of Standards and Technology ("NIST").

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: Engaging third-party cybersecurity consultants, who conduct periodic penetration testing, vulnerability assessments and other procedures to identify potential weaknesses in our systems and processes; and Conducting periodic cybersecurity training for our employees and the Company's Board.

companyName: SECURITY FEDERAL CORP

ticker: SFDL


text: We have developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, NIST 800-53 and International Organization for Standardization 27001, or ISO 27001, Framework, although we do not comply with all technical standards, specifications or requirements under NIST or ISO 27001.

companyName: NorthStar Healthcare Income, Inc.


text: Saia has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation. The annual cybersecurity training consists of threat avoidance when working remote, proper password construction techniques, identifying and reporting suspicious activity, social engineering and insider threats. Additionally, we have implemented a regular phishing assessment that provides feedback and additional training as needed to enhance the annual training program. Our information technology professionals also receive additional training related to their position.

companyName: SAIA INC

ticker: SAIA