text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity program and the steps taken by management to monitor and mitigate cybersecurity risks. The CIO regularly addresses the Audit Committee, typically on a quarterly basis, regarding our cybersecurity and data privacy progress to the NIST CSF standards along with briefing the Committee on any cybersecurity incidents that were determined to have a moderate or higher impact on the business, even if immaterial to the Company as a whole. In the event of an incident, management intends to follow the Company's incident response plan, which outlines the steps to be followed from the detection of an incident to mitigation, recovery, and notification, including notifying functional areas, as well as senior leadership and the Audit Committee, as appropriate. Determination of when to notify senior leadership and the Audit Committee is made by the CIO in consultation with other members of senior leadership as needed. Depending on the nature and severity of the incident, disclosure can be handled either through scheduled quarterly reporting to the Audit Committee or as an immediate disclosure to the Chair of the Audit Committee.

companyName: Andersons, Inc.

ticker: ANDE


text: Cybersecurity awareness training for all users with access to our systems including employees, consultants and senior management, with timely relevant security topics, which include social engineering, phishing, password protection, protecting personal data and appropriate use of assets.

companyName: Sagimet Biosciences Inc.

ticker: SGMT

secItem: Item 1C


text: Amedisys has established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our Enterprise Risk Management Committee ("ERMC") on a quarterly basis. In addition, our incident response plan includes processes to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. These processes are assessed annually during our penetration testing.

companyName: AMEDISYS INC


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Information Security Officer and other subject matter experts directly participating in incident response efforts.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: We have developed and implemented a comprehensive, written information security program predicated on industry best practices and applicable regulations that is comprised of administrative, physical, and technical safeguards. Through our information security program, we seek to assess, identify, monitor, mitigate, and manage cybersecurity threats and prevent the recurrence of said threats through preventative and remedial measures. Our information security program is integrated as part of our overall risk management system.

companyName: PRA GROUP INC

ticker: PRAA


text: We have designed and implemented a comprehensive program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We designed this program based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We monitor and regularly assess our cybersecurity risks and adjust our program accordingly.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: is responsible for the development, operation, and maintenance of our information security program and controls. The Director has extensive experience in the information technology field, and cybersecurity knowledge and skills gained through relevant experiences. The Director and Chief Financial Officer regularly review potential risks and measures implemented by the Company to identify and mitigate cyber security risks.

companyName: Lifeway Foods, Inc.

ticker: LWAY


text: Our Chief Operating Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: Precipio, Inc.

ticker: PRPO


text: We have also established a Security and Privacy Committee ("Committee"), co-chaired by our Senior Vice President, Head of Engineering, Chief Information Security Officer ("CISO") and General Counsel, that meets monthly. This Committee is responsible for setting cybersecurity policies, strategies, and priorities, as well as ensuring that cybersecurity initiatives are aligned with the Company's objectives. Members of the Committee may, from time to time, include representatives from information security, internal audit, legal, product, engineering, finance, operations, strategy and people and culture functions. In addition to the monthly communications at the Committee level, our Information Security team collaborates with senior leadership across our organization on a regular basis as part of the Company's overall enterprise risk management program.

companyName: Compass, Inc.

ticker: COMP


text: We implement various training programs periodically to ensure that our employees and other personnel comply with internal processes and to enhance their cybersecurity awareness. Members of our board of directors and management overseeing our information security risk management approach are provided with opportunities for continuing education in cybersecurity and evolving cybersecurity risks in order to better understand and evaluate our preparedness.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: We rely on our information technology to operate our business. As such, we have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: Authentic Holdings, Inc.

ticker: AHRO


text: Other Risk Factors. See the risk factor "Technology disruptions or cyberattacks could adversely impact operations" in the section entitled "Item 1A. Risk Factors - Operations, Growth and Competitive Risks."

companyName: Knife River Corp

ticker: KNF


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature or Information Systems and Data.

companyName: CERUS CORP

ticker: CERS


text: deployment of endpoint protection software, supported by external managed services, to attempt to proactively detect and block malicious code from affecting our systems; a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Company regularly receives and stores information about our customers, partners, vendors, and other third parties through our GROOVY 2.0 blockchain authentication platform. We rely extensively on complex information systems throughout our business, particularly our Hyperledger Fabric blockchain infrastructure, ERC-1155 token implementation, and proprietary RAG LLM analytics systems. We have implemented programs to detect, contain, and respond to information security, cybersecurity, and data privacy incidents. However, we may be unable to anticipate security incidents or implement adequate preventive measures as cyber threats continue to evolve and cyberattacks become more sophisticated and frequent, including through the introduction of viruses and malware (such as ransomware) and the use of artificial intelligence by threat actors.

companyName: GROOVY COMPANY, INC.


text: Board of Directors Our Board of Directors (the "Board") oversees our Enterprise Risk Management program, and cybersecurity risks are monitored as a part of the broader program. Our Board has primary responsibility to oversee risks from cybersecurity threats and has designated a specific director, who possesses significant experience in information technology as a special liaison (the "Technology Liaison") between management and the Board of Directors. The Board as a whole, or through the Technology Liaison, regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our Technology Liaison receives quarterly updates from the Director of Infrastructure and Security and the Vice President of Information Technology relating to significant risks, cyber incidents, key performance indicators measuring the effectiveness of the Company's cybersecurity risk program and other relevant matters. The Technology Liaison regularly briefs the Board on these updates, and the Board also receives periodic briefings on cybersecurity risk as part of the Company's broader Enterprise Risk Management program. These risks, including current and emerging risks, are regularly evaluated by the Technology Liaison and the Board. In addition to the regular updates to the Technology Liaison, we have protocols by which certain cybersecurity incidents and threats are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Technology Liaison.

companyName: FARMER BROTHERS CO

ticker: FARM


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: NETGEAR, INC.

ticker: NTGR


text: The Chief Privacy Officer oversees the Company's information security program and is responsible for the day-to-day information risk management activities through the internal information security team, and outside resources. The SVP, Chief Privacy Officer, who has over 30 years of IT and IT security experience, 21 of which are at the Company, employs a team of information technology experts, including a dedicated Cyber Security Analyst. The VP, Chief Privacy Officer and the Cyber Security Analyst are further supported by other members of the IT department.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: Our full Board of Directors oversees our enterprise risk management, which includes oversight of risks from cybersecurity threats. Our management team provides regular updates to the Board on cybersecurity risks and threats. These updates cover, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, and the emerging threat landscape. In turn, the Board provides advice and guidance on the adequacy of our initiatives on cybersecurity risk management.

companyName: CoreCard Corp

ticker: CCRD


text: Following our monitoring, we adjust, implement and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Chief Information Officer, who reports to our Chief Financial Officer, to manage any identified risks and mitigation process. As part of our overall cyber security framework, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our information technology (IT) department and management. Personnel at all levels and departments are made aware of our cybersecurity policies through ongoing training.

companyName: Atara Biotherapeutics, Inc.

ticker: ATRA


text: The CISO, who oversees an organization that supports the day-to-day operation of the Program, is qualified in the areas of data protection and cybersecurity, having more than twenty years of professional IT experience in financial services. Prior to his current role, the CISO previously served as MetLife's Global Chief Technology Officer with accountability for MetLife's global infrastructure, engineering, service operations, quality assurance, application maintenance, and production management functions; he also served variously as the chief technology officer, CISO, chief information officer and global head of telecommunications engineering at other financial institutions prior to joining MetLife in 2012.

companyName: METROPOLITAN LIFE INSURANCE CO


text: To deter and detect cyber threats, we annually provide our employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting security incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Corbus Pharmaceuticals Holdings, Inc.

ticker: CRBP


text: We are committed to safeguarding our information and information systems from unauthorized access, use, disclosure, disruption, modification or destruction. We aim to incorporate industry best practices throughout our cybersecurity program. This program is supported by both management and our Board of Directors, including our Audit Committee.

companyName: Astra Space, Inc.


text: Managing Material Risks & Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Chief Information Technology Officer ("CITO") and Chief Information Security Officer ("CISO") work closely with our Enterprise Risk Committee, which oversees—in part—cybersecurity, to continuously evaluate and address cyber risks in alignment with business objectives, operational needs and industry-accepted standards, such as the National Institute of Standards and Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") frameworks.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: Our Information Security program is led by a global-level Information Security Department that develops our security policies, standards and procedures guided by the ISO/IEC 27001:2022 principles and aligned to the Center for Internet Security controls. We seek to evolve our approach to protect against increasing and changing security threats around the world.

companyName: TransUnion

ticker: TRU


text: Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems.

companyName: Apollo Infrastructure Co LLC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of our risk management program, including cybersecurity and other information technology risks. The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.

companyName: Singular Genomics Systems, Inc.


text: The Board of Directors designated the Chief Information Officer as the Information Security Officer (the "ISO") and for oversight, the full Board receives threat intelligence reports and a Cybersecurity Executive Dashboard from the ISO each month. The ISO has more than thirty years' experience with the Company and meets with full Board of Directors in person at least annually. The ISO works with the Company's third-party Security Operations Center and the Company's Compliance/Enterprise Risk Management ("ERM") Team to identify, assess, and manage material risks from cybersecurity threats. The ISO also oversees the Company's Information Security Program, which governs various information security and cybersecurity processes, systems development, change control, disaster recovery/business continuity, physical asset classification and control policies. The Information Security Program identifies data sources, threats, and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The ISO is a member of various management committees, including the quarterly Management Control meetings which serve as the Company's IT Steering Committee.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example Professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers (including SIEM tools and 24/7 managed detection and response), penetration testing firms, and dark web monitoring services.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents. This policy guides the response of our global IT team, which, depending on the significance of the incident, includes activating response plans from third-party partners, escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted. We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.

companyName: POOL CORP

ticker: POOL


text: The Company's entire Board of Directors is engaged in risk management oversight, including the oversight of risks from cybersecurity threats. The Audit Committee assists the Board of Directors in its oversight of Domino's company-wide risk management and the process established to identify, assess, measure, monitor and manage risks, including major information security and cybersecurity risks, with input from the Company's internal committee dedicated to assessing and managing enterprise risk comprised of Company executives in addition to other senior leaders within the Company (the "Enterprise Risk Committee").

companyName: DOMINOS PIZZA INC

ticker: DPZ


text: Key elements of our cybersecurity risk management program include: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • training and awareness programs for team members that include periodic and ongoing assessments to drive adoption and awareness of cybersecurity processes and controls; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats to the Company is assessed on an ongoing basis. During the reporting period and through the issuance of this Annual Report on Form 10-K, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect the Company, including its business strategy, operational results, and financial condition. For additional information about cybersecurity risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Our incident reporting and escalation process is designed to detect and analyze cyber incidents in real time, to assess their impact, to escalate the incident to our CISO and the Company's Information Security Management Committee (which consists of our CEO, CFO, General Counsel, CISO, and EVP and President – Global Platform Group), as appropriate and consistent with our Incident Response Plan, and to determine and effectuate the appropriate response and reporting actions, including evaluating the impact and materiality of such incidents to our financial condition and operations.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: We engage in the periodic assessment and testing of our policies, standards, processes, and practices designed to address cybersecurity threats and incidents. These efforts include internal and external activities, including reviews of our information security control environment, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning, and information security maturity assessments.

companyName: Nerdy Inc.

ticker: NRDY


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CHRTO or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: We address cybersecurity risks related to third-party service providers by incorporating these risks into our enterprise risk management and cybersecurity-specific risk assessment programs. We conduct due diligence on third parties with access to our systems or data and require them to adhere to specified cybersecurity standards and audits.

companyName: ARTIVION, INC.

ticker: AORT


text: Our Board of Directors, with assistance from our Audit Committee and Cybersecurity Steering Committee, oversees our risk management program, which includes technology and cybersecurity risks. Our management team, including our Vice President - Information Technology ("VP - IT"), provides periodic updates on risk management to the Audit Committee and to the Board of Directors. Such periodic updates include presentations regarding cybersecurity matters, including any new cybersecurity threats, events, incidents, risks, risk management solutions, trainings or education, strategy pivots, or governance changes. The Audit Committee regularly reports its actions, findings and recommendations to the Board of Directors. The Audit Committee relies in large part on such periodic updates and presentations from our management team in developing its reports to the Board of Directors.

companyName: Coterra Energy Inc.

ticker: CTRA


text: As of December 29, 2023, we are not aware of any risks from cybersecurity threats, including from previous cybersecurity incidents, that materially impacted the Company's strategy, operations, or financial condition in the last three years. However, we have been the target of previous cyber attacks and anticipate we will continue to face risks of incidents through various types of attacks, including those using sophisticated techniques and evolving technologies such as artificial intelligence. Although we make efforts to maintain the security of our systems and data, we are subject to the risk of a cybersecurity incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party vendors, will prevent breakdowns or incidents to our or our third-party vendors' systems that could adversely affect our business. For further discussion, see the risk factor captioned "Our business depends on the continued effectiveness and availability of our information technology infrastructure, and failures of this infrastructure could harm our operations" included within Item 1A. Risk Factors of this Annual Report.

companyName: Keenova Therapeutics plc


text: Our President, CFO and CEO are responsible for overseeing our business operations and are responsible for day-to-day assessment and management of risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: We have implemented cybersecurity frameworks, policies and practices which incorporate industry-standards and contractual requirements. We gather information and review security protocols of certain third parties who integrate with our systems, such as our payroll processor, managed solutions provider, and software as a service provider, on an annual basis to identify and manage risk. We regularly seek to improve and mature our cybersecurity processes. We apply lessons learned from our efforts to help prevent attacks and utilize data analytics to detect anomalies and search for cyber threats.

companyName: Salamander Innisbrook, LLC


text: We believe our cybersecurity risk management practices are an important part of our enterprise risk management processes, and must be continuously updated and improved. As of the date of this Annual Report, we have not identified material risks from known cybersecurity threats, including as a result of any past cybersecurity incidents, since the beginning of the last full fiscal year that have materially affected the Company, including our business strategy, results of operations or financial condition. See Part I, Item 1A "Risk Factors—Risks Relating to Technology, Cybersecurity and Data Privacy" for more information about cybersecurity and data privacy risks.

companyName: Wheels Up Experience Inc.

ticker: UP


text: The Board oversees the Company's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The CISO briefs the Board on the effectiveness of the Company's cyber risk management program, typically on a quarterly basis. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk management process.

companyName: Sinclair, Inc.

ticker: SBGI


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools, employee education, password encryption, frequent password change events, firewall regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with. We use a widely-adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We conduct regular reviews and tests of our information security program and also leverage audits by our internal audit team, tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We may and are considering whether to further engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our processes.

companyName: Global Gas Corp

ticker: HGAS


text: Our board of directors has established the IT Committee, which focuses on technology impact on all aspects of the bank. The IT Committee provides oversight and governance of the technology program including the information security program. The IT Committee includes the Chief Operations Officer and key departmental managers from throughout the entire company. The IT Committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Chief Operations Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the IT Committee on a monthly basis (or more frequently as may be required by the Incident Response Plan).

companyName: Affinity Bancshares, Inc.

ticker: AFBI


text: The Board has designated that the Audit Committee is responsible for overseeing cybersecurity risks, and our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Audit Committee on cybersecurity matters. The SVP of IT & SCM has over 20 years of experience in IT systems, IT infrastructure, fab and manufacturing environments, and site disaster recovery and compliance. Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the Cybersecurity Maturity Model Certification (CMMC) program, ISO 27001, and extensive experience in systems and technology infrastructure management. In addition, our Director of Corporate Security reports to our Chief Legal Officer and is involved in the ongoing compliance with relevant cybersecurity regulations, including with regard to cybersecurity monitoring and incident response (as noted below). The Director of Corporate Security has over 20 years of experience in quality systems, semiconductor manufacturing, and industrial security.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Our cybersecurity risk management process is a component of our overall enterprise risk management process, through which our Chief Executive Officer and other members of senior management assess, identify, and manage material risks from cybersecurity threats we face. Our cybersecurity process seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. The Board of Directors (the "Board"), and the Audit Committee of the Board (the "Audit Committee"), provide oversight of our cybersecurity risk management process. The Audit Committee reviews our cybersecurity program and cybersecurity risk management process quarterly, and our Board reviews our cybersecurity program annually. Our cybersecurity program is directly managed by the Chief Information Officer ("CIO"), who is experienced in information systems and cybersecurity and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The CIO provides periodic updates to our Board and Audit Committee, as well as our Chief Executive Officer and other members of our senior management. These updates cover the Company's material cybersecurity threats, the status of projects to strengthen our cybersecurity posture, and assessments of the cybersecurity program. Our cybersecurity risk management process is evaluated by internal and external cybersecurity experts, and the material results of those reviews are reported to senior management and the Board and Audit Committee as part of their oversight role. We also engage with third-party service providers deemed to have subject matter expertise in cybersecurity matters, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and processes. We require each third-party service provider to certify that they implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect us. We use various tools and methodologies to manage cybersecurity risk and to prevent, detect, and mitigate cybersecurity incidents. Our tools and methodologies are tested regularly, including vulnerability scans, red-teaming exercises and other penetration testing, and review of cybersecurity threat intelligence feeds. We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and will continue to experience, cybersecurity incidents in the normal course of our business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – Factors Related to Overall Business & Operations – Our business depends on the use of information technology systems. A failure of these systems, cybersecurity incidents, or cyber-fraud may cause business disruptions, compromise our intellectual property or other sensitive information, or result in losses."

companyName: LATTICE SEMICONDUCTOR CORP

ticker: LSCC


text: Our IT department monitors and manages system infrastructure in an effort to protect us against threats. Our cybersecurity process considers risks from many sources including, but not limited to, alerts, threat intelligence sources, risk assessments, and vulnerability management. Our cybersecurity process includes a risk assessment procedure, a risk evaluation procedure, and a third-party partner to strengthen our cybersecurity controls. These controls are designed to block and/or provide alerts on suspicious activities. Our security team responds as appropriate to risks identified.

companyName: BGSF, INC.

ticker: BGSF


text: Our CIO is accountable for the Firm's cybersecurity and data privacy programs and is supported by the CISO. Our CIO and CISO have extensive information technology and program management experience, and have served many years in our corporate information security organization. Under the guidance of the CIO, the CISO manages day-to-day operations of the security and data privacy functions and proposes changes to the Firm's cybersecurity strategy, which is part of our overall information technology strategy. The CIO and CISO meet frequently to discuss cyber and data operations, privacy programs and risks. Each of these teams remain in close coordination to ensure risk mitigation strategies are designed and operating effectively.

companyName: KFORCE INC

ticker: KFRC


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CCO, manage the Company's cybersecurity program. The CCO of the Company oversees the Company's oversight function generally and relies on the Adviser's technology team to assist with assessing and managing material risks from cybersecurity threats. The CCO has been responsible for this oversight function as CCO of the Company for one year and has worked in the financial services industry for more than 30 years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.

companyName: CITIZENS, INC.

ticker: CIA


text: Ongoing cybersecurity training for employees; and Periodic testing of incident response procedures. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help test, develop and manage our cybersecurity risk management program.

companyName: TopBuild Corp

ticker: BLD


text: On a regular basis, the CFO reports to the Board on cybersecurity matters, including key risks, the potential impact of those exposures on the Company's business, financial results, operations and reputation and the programs and steps implemented by management to monitor and mitigate risks.

companyName: PLUS THERAPEUTICS, INC.

ticker: PSTV


text: Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach. We utilize the National Institute of Standards and Technology ("NIST") Cyber Security Framework to define and regularly reassess our cybersecurity program. The NIST framework is structured around five commonly defined stages (Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management. Our policies, including our Information Security Policy and Privacy Policy, and procedures are designed to align with industry best practices and comply with regulatory requirements. We align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard. Throughout the year, we conduct targeted audits and assessments, using internal and external resources, of certain aspects of our information security systems. We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, ensure the integrity of critical data and automated processes, and safeguard the availability of our information technology capabilities.

companyName: US Foods Holding Corp.

ticker: USFD


text: We view cybersecurity as a shared responsibility across the company and this integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. All employees are required to complete yearly security training, and we periodically perform tabletop exercises with management participation. Further, our cybersecurity, privacy, procurement, legal and other cross-functional teams work together to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We use various security tools and processes to help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner, including, but not limited to, internal reporting, monitoring and detection tools and a vulnerability identification program.

companyName: Wayfair Inc.

ticker: W


text: Cybersecurity is a part of our risk management framework, and we have established policies and processes designed to manage cybersecurity defenses, controls and programs, including ISO 27001 compliant security procedures. Our processes are evaluated by expert cybersecurity firms through various security assessments and audits, which help us identify and mitigate cyber-related risks to our businesses. We also engage with providers of information systems as part of our continuing efforts to enhance the effectiveness of our security measures. Our vendor risk management (VRM) program, through which we screen external providers, helps us identify and evaluate known risks associated with these third parties.

companyName: Element Solutions Inc

ticker: ESI


text: Supporting our CIO in assessing and managing the Company's material risks from cybersecurity threats are the Company's COO, CFO, and General Counsel, each of whom have over 20 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: Callon Petroleum Co


text: At the management level, Danaher's cybersecurity program is led by the Company's Chief Information Security Officer ("CISO"), who reports to Danaher's Chief Information Officer ("CIO"), who in turn reports to Danaher's Chief Financial Officer. Danaher's CIO has served as a technology leader for over 25 years, leading cybersecurity, engineering, and operational functions as the CIO for two multi-billion dollar businesses prior to assuming the Danaher CIO role. Danaher's CISO has served for more than 20 years in various information security roles, including serving as the Chief Information Security Officer of two large, publicly-traded companies prior to joining Danaher. The CISO is supported by the Information Risk Steering Committee ("IRSC"), a management committee comprising senior members of the information technology, legal, privacy, finance, internal audit and communications functions. The IRSC supports the CISO and CIO in overseeing and managing information security risks and in the event of a cybersecurity incident provides oversight and leadership with respect to incident investigation, mitigation and remediation.

companyName: DANAHER CORP /DE/

ticker: DHR


text: The Company and SITE Centers conduct annual cybersecurity awareness training for all employees, new-hire cybersecurity training, monthly simulated phishing tests, and additional training for specific departmental requirements as part of their respective risk mitigation efforts. SITE Centers also maintains cybersecurity insurance (of which the Company is an additional insured); however, there is no assurance that the insurance SITE Centers maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.

companyName: Curbline Properties Corp.

ticker: CURB


text: The Company's Director of Technology, reporting to the Chief Financial Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats, and preparing updates for the Board of Directors. The Director of Technology has a combined twenty-one years of experience leading and working on cybersecurity teams at the Company and other companies in the oil and natural gas industry, has significant experience with networking, on-premises and cloud-based infrastructure, and cybersecurity controls, and has a Bachelor of Science degree.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.

companyName: AAR CORP

ticker: AIR


text: While to-date we have not experienced a significant cybersecurity incident, significant data loss or any material financial losses related to cybersecurity attacks on our systems and those of our customers and third-party service providers are under constant threat, and it is possible that we could experience an incident in the future that could have a material adverse effect on our business strategy, results of operations and financial condition. See also Item 1A, Risk Factors – Technology Risks.

companyName: BYLINE BANCORP, INC.

ticker: BY


text: Management and Strategy maintain standard procedures to help assess, identify and manage material risk posed by cybersecurity threats and regularly evaluate how we can integrate these procedures into our overall risk management processes. For example, we require that all of our employees who have access to our internal network complete formal cybersecurity training upon hire and on a periodic basis, including training on phishing, malware, and other cybersecurity risks. We also continuously evaluate our information technology systems and our practices that relate to our information technology systems. To date, we have not engaged any assessors, consultants, auditors or other third parties in connection with these efforts but may elect to do so in the future.

companyName: RenovoRx, Inc.

ticker: RNXT


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, Cyber security breaches or other systems and information technology interruptions could result in liability, harm our reputation and impact our ability to operate.

companyName: Willdan Group, Inc.

ticker: WLDN


text: Our cybersecurity risks and associated mitigations are evaluated by our management and the ITSC as needed, but no less frequently than annually. Management and representatives of the ITSC periodically report to our board of directors on developments to the information security and cybersecurity risks facing us. Reports include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, oversight of third-party service providers and related cybersecurity threats, and management's evaluation of cybersecurity risks material to us. Additional information about cybersecurity risks we face is discussed in Item 1A..—Risk Factors.—Cybersecurity Breaches, Identity Theft and Other Disasters, which should be read in conjunction with the information above.

companyName: New Mountain Guardian III BDC, L.L.C.


text: Other aspects of our cyber and information security risk management program include: • Monitoring external and internal threats and events, managing access, facilitating use of appropriate authentication options, validating controls and programs by internal teams and independent third parties and testing various compromise scenarios that are overseen by our information security team; • Investing in threat intelligence platforms and participating in financial services industry and government forums which track and report on cyber and other information security threats; • Identifying those third-party relationships that have the greatest potential to expose the Company to cybersecurity threats and, upon identification, conducting additional due diligence as a part of establishing those relationships; • Routinely performing vulnerability tests; • Engaging independent consultants and other third-parties to assist the Company in establishing and improving its policies; and • Conducting "tabletop" exercises with outside consultants at least annually to test the Company's processes and policies and using feedback from those exercises to further improve our processes. The Company also maintains insurance coverage for cybersecurity incidents as part of its overall insurance portfolio.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: Crexendo Information Security Policy defines time periods within which a particular severity (critical v/s major v/s minor) vulnerability needs to be addressed. Reported vulnerabilities, along with applicable resolution timeline and efforts are recorded within the internal problem tracking system and are tracked as part of quarterly security and privacy review sessions.

companyName: Crexendo, Inc.

ticker: CXDO


text: The Chief Information Security Officer (CISO) brings over 27 years of experience in Cyber Security and IT Controls, with the last 15 years serving as CISO at OPKO Health and previously at Everest Insurance Corp. Prior experience includes several years at PricewaterhouseCoopers as an IT auditor and Cyber Security consultant. The CISO holds comprehensive Cyber Security accreditations and certifications, including CISSP, CISA, CRISC, CHP, CDRE, and MBCI, and has completed undergraduate degrees in Accounting and Computer Information Systems from Baruch College. The CISO oversees a department comprising five cyber security engineers with extensive experience.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Primary responsibility for assessing, monitoring, and managing our Cybersecurity Program rests with the CISO, Mr. Richard Friedberg. With over 25 years of experience in the field of cybersecurity, his background includes extensive experience across the financial sector, technology sector, and U.S. government. Mr. Friedberg is also an adjunct faculty member at Carnegie Mellon University, teaching risk and cyber practices. Mr. Friedberg holds a Bachelor of Science from Carnegie Mellon University, a Master of Business Administration from George Washington University, and maintains certification as a Certified Information Systems Security Professional and Certified Information Security Manager.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our director of information security, who reports both to our chief risk officer and our chief information officer, manages the Bank's cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of the Bank's information technology assets and data under our control. Our director of information security has more than 25 years of experience in information technology in successively more responsible roles and has led teams to design, secure, and implement numerous technology solutions. Our information security department is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by our board of directors and the Bank Technology Governance Committee.

companyName: Federal Home Loan Bank of Boston


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial condition. Additional information regarding risks from cybersecurity threats is provided at "Item 1A. Risk Factors".

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: The Company has implemented a comprehensive, cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to properly identify, classify and escalate certain cybersecurity incidents to provide management visibility and obtain direction from management as to the public disclosure and reporting of material incidents in a timely manner.

companyName: Kayne DL 2021, Inc.


text: The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts. The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company's systems. The CIRT will review the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary. The Company's information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company's cybersecurity policy.

companyName: FLOTEK INDUSTRIES INC/CN/

ticker: FTK


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Financial Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats The information security function is led by our CISO, under the direction of our CIO. In fiscal 2025, following the retirement of our former CISO, we appointed an interim CISO who has over 20 years of experience in information technology and security and is a Certified Information Systems Security Professional. Our CISO maintains primary responsibility for developing cybersecurity strategies; cybersecurity governance; identifying, assessing and monitoring cybersecurity risks; preparing for and responding to cybersecurity incidents; verification and testing of cybersecurity; and disaster recovery governance. Our CISO may authorize specific Company associates to assist in managing these responsibilities if determined necessary, including the Crisis Response Team. Our CIO and CISO have oversight responsibilities of the Company's cybersecurity program.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: Our executive management team has the day-to-day responsibility of assessing and managing our overall risk exposure, and our Board of Directors oversees those efforts. We have integrated cybersecurity risk into our overall risk management systems and processes. Our full Board has direct oversight over our cybersecurity risk management. The Board interfaces regularly with management and receives periodic reports on our areas of risk, including cybersecurity. Management interacts regularly with our Cyber Risk Governance Committee (CRGC), which meets regularly and oversees the effectiveness of our cybersecurity program. We make additional disclosures regarding our assessment, identification and management of cybersecurity risks below under the caption "Governance," and we hereby incorporate by reference those disclosures into this discussion of "Risk Management and Strategy."

companyName: NuStar Energy L.P.


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer, or CDIO, is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.

companyName: Inogen Inc

ticker: INGN


text: Our Chief Information Security Officer (CISO), Guy Rosen, leads our cybersecurity program and oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions. Mr. Rosen has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Mr. Rosen has served in a number of significant leadership roles at our company since 2013, including oversight of security, safety, and integrity initiatives, and was appointed as our CISO in 2022. Prior to joining our company, Mr. Rosen served in senior leadership, engineering, and operational roles across technology organizations.

companyName: Meta Platforms, Inc.

ticker: META


text: On a quarterly basis, or sooner if appropriate, cybersecurity incidents are summarized and reported to the Cybersecurity Governance Committee comprised of senior executives. Additionally, the Audit Committee of the Board of Directors receives quarterly cybersecurity reports from senior management which cover any identified cybersecurity incidents, results of third party vulnerability testing, and key developments in policies and practices during the quarter.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: In general, the Company addresses cybersecurity risks through a comprehensive approach that is focused on preserving the security of its information and by identifying, preventing and mitigating cybersecurity threats, as well as effectively responding to cybersecurity incidents when they occur. The Company believes that this comprehensive approach helps to ensure that the highest levels of oversight is provided to its cybersecurity risk management activities and fosters collaborative consultation between management and the Board.

companyName: OMNICELL, INC.

ticker: OMCL


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Item 1A. entitled Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers".

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: The Sponsor has developed a cybersecurity program to manage cyber risks relevant to the Trust. This program includes risk assessments, security measures, and continuous monitoring of systems and networks. The Sponsor proactively identifies significant risks from new and evolving cybersecurity threats.

companyName: 21Shares Ethereum ETF

ticker: TETH


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program, in the discretion of the Board and management. Board members may receive presentations on cybersecurity topics from external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Lite Strategy, Inc.

ticker: LITS


text: We based and tailored our framework on the National Institute of Standards and Technology, or NIST, Cybersecurity Framework and the Center for Internet Security, or CIS, Critical Security Controls.

companyName: S&T BANCORP INC

ticker: STBA


text: We have implemented a cybersecurity risk management program that is designed to limit and mitigate risks from cybersecurity threats. Our cybersecurity risk management program incorporates several components, including employee training, periodic penetration tests, and multifactor authentications.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: The Company's CISO is primarily responsible for management of the Company's information security program. The Company's current CISO has significant experience in information security, as do members of the information security team. The Company participates in certain industry cybersecurity intelligence, risk sharing organizations and law enforcement organizations.

companyName: KEMPER Corp

ticker: KMPR


text: Amwell's cybersecurity team has implemented processes to: • assess the severity of a cybersecurity threat through continuous monitoring and determine the nature, scope and timing of the event to assess whether it is material; • identify the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, utilizing our Information Security Incident Response Plan; • implement cybersecurity countermeasures and mitigation strategies; • and inform our board of directors of material cybersecurity threats and incidents.

companyName: American Well Corp

ticker: AMWL


text: The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with Williams' Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, General Counsel, and Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: The audit committee of the board of directors (the "Audit Committee") is responsible for overseeing cybersecurity risk and periodically updates our board of directors on such matters. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding any significant new cybersecurity threats or incidents.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001 certification since 2018 for certain online business.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: ALLETE's Chief Technology Officer (CTO) has primary responsibility for the development and oversight of ALLETE's cybersecurity team and the development and maintenance of the company's related cybersecurity policies and procedures. The CTO has over 25 years' experience working in the information and operational technology field and is a registered professional engineer in the State of Minnesota. The company's cybersecurity team continuously assesses the evolving cyber threat landscape based on their expertise and that of our third-party partners. They then work with all parts of ALLETE to protect against, detect, identify, respond to, and recover from the risks that cybersecurity threats present. The cybersecurity team views and responds to cybersecurity risks in a holistic manner, applying a comprehensive multilayered strategy to prevent, detect, and mitigate them. They have identified ALLETE's critical cyber assets and taken appropriate steps to protect them. External expertise is regularly engaged to assess ALLETE's cybersecurity program and help the cybersecurity team to strengthen the organization's monitoring, alerting, prevention, mitigation, and recovery capabilities. Tabletop simulations, third-party cyber vulnerability assessments, maturity assessments, and partnerships are used to assess and refine all elements of our cybersecurity program. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of ALLETE's applications are required to document user access reviews regularly. We request a System and Organizational Controls (SOC) 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.

companyName: ALLETE INC

ticker: ALE


text: The Audit Committee provides oversight for our cybersecurity program and our enterprise risk management process. The Audit Committee also evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: In an effort to further deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with data protection, cybersecurity and incident response and prevention materials, which educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks.

companyName: Gain Therapeutics, Inc.

ticker: GANX


text: As part of the Board of Directors' role in overseeing our enterprise risk management program, which includes our cybersecurity risk management, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to have an adverse effect on us. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Audit Committee. The Audit Committee conducts reviews of the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and in aligning cybersecurity efforts with the overall risk management framework and promotion of our business objective and operational needs. In addition to our scheduled meetings, the Audit Committee maintains an ongoing dialogue with management, including emerging or potential cybersecurity risks.

companyName: COHU INC

ticker: COHU


text: Processes and Risk Assessment Our cybersecurity program is focused on (i) protecting the confidentiality of business, client, investors in our products and employee information; (ii) maintaining the security and availability of our systems and data; (iii) supporting compliance with applicable laws and regulations; (iv) documenting cybersecurity incidents and our responses; and (v) notification of cybersecurity incidents to, and communications with, appropriate internal and external parties.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support table top exercises and to conduct security testing.

companyName: Fyntechnical Innovations Inc

ticker: FYNN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity program.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: CEL-SCI recognizes the importance of assessing, identifying, and managing material risks from cybersecurity threats. CEL-SCI's policies, standards and procedures for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management system. In this regard, CEL-SCI uses various tools and processes to help prevent, identify, and resolve any identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, routine employee awareness updates, annual cyber security training, monthly email testing engaging experts and third-party monitoring and detection tools.

companyName: CEL SCI CORP

ticker: CVM


text: Periodic assessments of the Global Information Security Program are conducted to ensure it is well-positioned to meet its objective of reducing the threat of known and emerging cybersecurity risks, as well to confirm ongoing compliance with legal and industry best practices and standards. Assessments of the program are continuously conducted by management and by an independent third party at least annually or whenever there is a material change to a business practice that may implicate the security or integrity of records containing personal information, to ensure the continuing suitability, adequacy, and effectiveness of the organization's approach to managing information security. As part of the annual review process, the Company engages external auditors to assess compliance with SOC2/SOC1, SOX, PCI-DSS and HITRUST, in addition to engaging an independent third party to conduct penetration testing and an overall risk assessment. The results of these assessments are reviewed and discussed with senior members of Company management and the Technology and Cybersecurity Committee of the Board (the "Technology Committee"), which is comprised of individuals with cybersecurity experience from both a technical and governance perspective. The Technology Committee, pursuant to its charter, is responsible for the oversight of the Company's management of risks regarding technology, data security, cybersecurity, disaster recovery and business continuity. To perform this function, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company's CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. The Technology Committee then, in turn, regularly reports out to the full Board and the Audit Committee as necessary during succeeding meetings to keep them informed. In addition, members of senior management, including the Chief Technology Officer ("CTO"), the CISO, and the Chief Legal Officer ("CLO") correspond directly with, or present to, the full Board, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. We believe the members of our senior management responsible for assessing and managing material risks from cybersecurity threats and interfacing with the Board and Board Committees on such matters collectively possess the appropriate expertise and experience from both a technical and governance perspective to ensure that they are able to carry out these responsibilities effectively. In particular, our CISO has spent over 30 years in various information security roles, including serving as the CISO of WEX since March 2014. Additionally, he holds professional degrees in the areas of Computer and Information Systems Security and multiple ISACA and ISC2 certifications (CISM, CISA, CRISC, CISA and CISSP). Our CTO has spent over 25 years in various engineering and technology roles, including serving as Chief Technology Officer for two other companies prior to joining WEX. In his past roles he was responsible for implementing product and technology initiatives and gained extensive experience in payments technology, technology infrastructure, technical engineering, AI, and machine learning.

companyName: WEX Inc.

ticker: WEX


text: The Company's CIO oversees the day-to-day implementation of the Company's cybersecurity risk management programs, tests its compliance with standards, remediates known risks, and leads its employee training program. The CIO is tasked with keeping informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, in an attempt to assist in effectively preventing, detecting, mitigating, and remediating cybersecurity incidents. The CIO implements and oversees processes for the regular monitoring of the Company's information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CIO is responsible for implementing the Company's incident response plan to mitigate the cybersecurity incident's immediate impact, implement long-term strategies for remediation, and prevent future incidents.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard the Company's networks and digital assets and maintain the integrity of our operations.

companyName: Vital Energy, Inc.

ticker: VTLE


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives periodic reports from management on our cybersecurity risks. In addition, management is required to update the Committee, as necessary, regarding any material cybersecurity incidents.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: 26North's CTO regularly updates the full Risk Committee and oversees a team of dedicated professionals responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The CTO has a Bachelor of Science in Computer Engineering from the University of Virginia and 25 years of experience leading technology teams, maintaining IT infrastructure within financial services firms, and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures to mitigate these threats.

companyName: 26North BDC, Inc.


text: The Company's cybersecurity strategy is based on recognized best practices, standards, and frameworks for cybersecurity and information technology, including the Center for Information Security ("CIS") Controls and National Institute of Standards and Technology ("NIST"). The strategy focuses on implementing technologies, controls, and processes to constantly monitor, identify, assess, and manage cybersecurity risks.

companyName: ULTRALIFE CORP

ticker: ULBI


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and we have integrated these processes into our overall risk management program. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: STAAR SURGICAL CO

ticker: STAA


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register. Additionally, the cybersecurity team monitors activity on a continual basis and works with security management to prioritize our risk profile and mitigate cybersecurity threats that are more likely to lead to a material impact to our business on a monthly basis; executive management evaluates material risks from cybersecurity threats against our overall business objectives on a periodic basis and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk periodically.

companyName: Personalis, Inc.

ticker: PSNL


text: The Board of Directors' Risk Committee has the responsibility for oversight of our cybersecurity program. This committee's membership includes subject matter experts in both cybersecurity and national security. Spirit's CISO reports to the Risk Committee quarterly on the state of our cybersecurity program.

companyName: Spirit AeroSystems Holdings, Inc.


text: The Company maintains an Information Security Committee (the "ISC") which is a cross-functional governance committee comprised of the AVP- Enterprise Information Technology ("IT AVP"), Chief Financial Officer ("CFO") and Chief Executive Officer ("CEO"). The ISC is the focal point for all information security activities throughout the Company and acts as a liaison on security matters throughout our group of affiliates. The ISC, led by the IT AVP works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC is charged with developing and implementing policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC is responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the ISC to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: The Company has deployed an in-depth cybersecurity strategy to protect its assets, which includes a diverse preventive and detective tool set to stop, monitor, and alert management of suspicious activities and potential advanced persistent threats. We have implemented other preventive technologies and mitigating processes that include on-going education and training for employees, periodic tabletop exercises and recovery tests, and regular infrastructure penetration tests conducted by cybersecurity professionals and third-party specialists. Our internal and external auditors, along with independent external partners, periodically assess our processes, systems and controls for design and operating effectiveness, and provide recommendations to bolster our cybersecurity program. In addition, employees are subjected to regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. We also monitor our email gateways for malicious phishing emails and monitor remote connections through a secure virtual private network. Like many companies, we rely on third-party vendor solutions to support our operations. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. We have a vendor management program in place to assess and manage risks associated with third-party service providers.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: Board Oversight and Management's Role: The Board of Directors, both directly and through the delegation of responsibilities to the Audit Committee oversees the proper functioning of our cybersecurity risk management program to ensures strategic alignment and governance of our cybersecurity efforts at the highest level. All of the Audit Committee members are independent directors. In particular, the Audit Committee assists the Board in its oversight of management's responsibility to assess, manage and mitigate risks associated with our business and operational activities, to administer our various compliance programs, in each case including cybersecurity concerns, and to oversee our information technology systems, processes and data.

companyName: Inogen Inc

ticker: INGN


text: As of the date of this Report, we have no t encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.

companyName: GPODS, INC.


text: The Company's Enterprise Risk Committee provides high-level guidance and direction regarding the assessment, identification and management of cybersecurity risks. Key members of the Enterprise Risk Committee, such as our Chief Executive Officer, Chief Financial Officer and General Counsel, participate in all or substantially all of the meetings of the Committee and make decisions to address cybersecurity and non-cybersecurity risks across the enterprise on a prioritized basis. The Committee meets regularly, usually on a quarterly basis, to reassess the risks facing the Company, as cybersecurity and other risks change from time to time, both in their nature and potential impact to the Company. The Company identifies cybersecurity risks through a layered system of automated and human-staffed monitoring systems and controls, as well as through guidance from internal and external subject matter experts. Potential cybersecurity incidents are subsequently assessed through both automated and human-staffed systems and controls that prioritize event review based on their likelihood or probability of occurrence, together with their potential harm or impact.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years. Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition. While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that we face, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A ("Risk Factors – Our business could be adversely affected by a security breach or other attack involving our computer systems or those of one or more of our vendors.") in this Annual Report.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: Incidents are investigated by the cybersecurity team as they are identified and may be resolved or escalated based upon the specific details and severity of each incident. Incidents are evaluated throughout the investigation and remediation processes and incidents determined to be insignificant may be resolved by the cybersecurity team without further escalation at that time. Incidents determined to be more severe, such as those that may have compromised the confidentiality, integrity and availability of our critical systems and information, are escalated by the cybersecurity team to notify legal counsel, our Cybersecurity & Privacy Executive Steering Committee, our Board of Directors, or various regulators, as required.

companyName: Caesars Entertainment, Inc.

ticker: CZR


text: Strategic periodic engagements of consulting firms to advise the Board and our executive officers regarding the structure and oversight of our cybersecurity risk management program, cyber strategy framework evolution, risk-based assessments, incident response services, and cyber technology;

companyName: TopBuild Corp

ticker: BLD


text: We assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We use a widely adopted risk quantification model to identify, measure and prioritize cybersecurity and technology risks and develop remediation or mitigation controls and safeguards. We conduct regular reviews and tests of our information security program including penetration and vulnerability testing to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: Paragon 28, Inc.


text: Management Oversight At a management level, our cybersecurity program is led by our Vice President, Global Cybersecurity who oversees a team with extensive knowledge and expertise. He is a Certified Information Security Professional and has over 20 years of cybersecurity experience and reports to our Chief Information Officer, who reports to our Chief Executive Officer. Our Vice President, Global Cybersecurity also chairs our Cybersecurity Management Committee which consists of senior business and functional leaders, including our Chief Information Officer and General Counsel. The Cybersecurity Management Committee is intended to provide cross-functional support for cybersecurity risk management and facilitate the response to any cybersecurity incidents.

companyName: ACCO BRANDS Corp

ticker: ACCO


text: Our cybersecurity program and related initiatives are managed by the CIO/CISO, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.

companyName: METHODE ELECTRONICS INC

ticker: MEI


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors of this Annual Report on Form 10-K — "We face risks related to cybersecurity for both our infrastructure and products and any cybersecurity breach or failure of one or more key information technology systems, or those of third-parties with which we do business could have a material adverse impact on our business or reputation."

companyName: Aptiv PLC

ticker: APTV


text: We maintain a comprehensive cybersecurity program which is integrated within Caterpillar's enterprise risk management system and encompasses the corporate information technology and operational technology environments as well as customer-facing products. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity risks. We utilize cybersecurity policies and frameworks based on industry and government standards. Our cyber risk management program controls are based on recognized best practices and standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework and the International Organization for Standardization (ISO 27001) Information Security Management System Requirements. We partner with third parties to support and evaluate our cybersecurity program. These third-party services span areas including cybersecurity maturity assessments, incident response, penetration testing, consulting on best practices, bug bounty programs, and others. We also consume threat intelligence from several paid and non-paid sources.

companyName: CATERPILLAR FINANCIAL SERVICES CORP


text: The Company's cybersecurity program is managed by a dedicated vice president of cybersecurity, who reports directly to Belden's chief information officer and whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The chief information officer reports directly to the Company's chief financial officer and has access to other members of senior management, including Belden's chief executive officer, as appropriate. Belden's vice president of cybersecurity has over 30 years of IT experience, including twelve years of cybersecurity experience. Belden's chief information officer has over 35 years of IT experience, a BS in Computer Science and an MBA.

companyName: BELDEN INC.

ticker: BDC


text: The ISMS is applicable to all individuals and third parties providing services to the Company and is informed by multiple industry-recognized standards and frameworks, including the International Organization for Standardization ("ISO") standards for information security management systems, the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework, and the Payment Card Industry ("PCI") Data Security Standard ("PCI-DSS"). It leverages the guidance of ISO 27001 in its design and operation, with policies intended to align to the requirements of ISO 27001 and follow the technical guidance of the appropriate NIST SP 800-53 Security and Privacy Controls standards where applicable. We review our security policies and procedures at least once annually, as well as in connection with significant enterprise-wide changes, such as technical or structural changes in our business or regulatory changes, and our policy content is continuously updated to account for a shifting threat landscape and to incorporate emerging best practices. We are a PCI-DSS Level 1 Merchant and are independently assessed against the PCI-DSS standard annually by an external PCI Qualified Security Assessor. Pursuant to the ISMS, we continuously monitor cybersecurity threats and strive to preemptively identify vulnerabilities. Our vulnerability management program operates on multiple layers of vulnerability discovery, such as third-party software component analysis, static and dynamic security testing, continuous infrastructure vulnerability scanning, cloud infrastructure scanning, independent third-party penetration testing, and a public bug bounty scheme. Our threat detection capabilities include automated 24/7 detection and alerting with automated response protocols designed to support rapid analysis and enrichment for security analysts who are guided by a formally documented Incident Response Plan in the event of a breach, as more fully described below.

companyName: Bumble Inc.

ticker: BMBL


text: Recognizing people as a key component of an effective information security program, the Merchants Information Security Program strives to enhance education and awareness at all levels of the Company. One critical component of education and awareness is an internal cybersecurity committee, comprised of employees from all levels and departments, who act as embedded security representatives for their business units.

companyName: Merchants Bancorp

ticker: MBIN


text: Our board of directors has risk oversight responsibility for AbbVie and administers this responsibility both directly and with assistance from its committees. Each of the committees periodically reports to the board of directors on its risk oversight activities. Cybersecurity is a critical component of our enterprise risk management program, which is designed to be business aligned, risk-focused and multi-faceted to protect our and our patients', customers' and business partners' data. Our board of directors is actively involved in reviewing our information security and technology risks and opportunities (including cybersecurity) and discusses these topics on a regular basis.

companyName: AbbVie Inc.

ticker: ABBV


text: The head of information technology and the CSSC have primary responsibility for assessing and managing our cybersecurity program. The head of information technology, who reports to the Chief Financial Officer, has more than 25 years of experience in building and leading information technology and security teams.

companyName: Kymera Therapeutics, Inc.

ticker: KYMR


text: Our audit committee receives periodic reports from management regarding our cybersecurity risks and is notified of any significant cybersecurity threat or incident. The audit committee reports to the board of directors regarding its activities, including with respect to cybersecurity matters and the occurrence of any material cybersecurity incident, if appropriate.

companyName: TECOGEN INC.

ticker: TGEN


text: As a smaller reporting company with limited business, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. As of the date of this report, we have not adopted an incident response plan as our only access to internet is the use of email account by large websites such as google and yahoo. Our business is managed by only one person, Mr. Umesh Patel, our Chief Executive Office, Chief Financial Officer and director and he is the person oversea our cybersecurity as well. We have a small board with three members including Mr. Patel, who will report and discuss the updates on cybersecurity matters, including material risks and threats to other two non-executive directors of the board.

companyName: FUSE GROUP HOLDING INC.

ticker: FUST


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks and the sufficiency of existing policies, procedures, systems and safeguards in place to manage such risks.

companyName: Lite Strategy, Inc.

ticker: LITS


text: As of February 25, 2025, we are not aware of any material cybersecurity incidents that impacted the Company or are reasonably likely to impact the Company materially. There have been instances of unauthorized access to company assets, including both those managed directly by the Company and those managed by vendors or stored in vendor systems containing company information. These systems have also been, and will likely continue to be, vulnerable to threats such as computer viruses, malware, malicious code, social engineering attacks, unauthorized access attempts, password theft, physical breaches, employee errors, misconduct, and cyber or phishing attacks. For a more detailed discussion of our cybersecurity risks, see "Risks Related to Our Intellectual Property and Technology - Technology failures, cyber-attacks, privacy breaches or data breaches could disrupt our operations or reputation and negatively impact our business."

companyName: WK Kellogg Co


text: Our Chief Technology and Information Officer is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Technology and Information Officer and his team are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Dutch Bros Inc.

ticker: BROS


text: We have taken proactive measures intended to minimize the likelihood of successful cyberattacks, including the establishment of incident response procedures designed to address potential cyber threats that may arise. These response procedures are structured with the aim to identify, analyze, contain, and remediate any cyber incidents that occur. We also have risk management processes to oversee and help identify risks from cybersecurity threats associated with our use of third-party providers.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: We recognize the importance of assessing, identifying, managing and mitigating material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to Topper Group employees or customers and violation of data privacy or security laws.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: The Company has adopted multiple incident response plans that establish guidelines for responding to incidents that may compromise the confidentiality, integrity and availability of Company information and systems, including referring matters to the Company's Incident Response Team and, as appropriate, to the Chief Executive Officer and the Board of Directors for additional evaluation and oversight.

companyName: HF Sinclair Corp

ticker: DINO


text: We have experienced malicious attacks and other attempts to gain unauthorized access to our systems, including a ransomware attack on our computer network which occurred on April 28, 2023. Following remediation, our network returned to full operation on May 1, 2023.