text: The Company also maintains a third-party risk management program responsible for the oversight of outsourced operations, which enables the Company to oversee and identify risks related to engaging third-party service providers, including risks from cybersecurity threats to third-party service providers. T he Company conducts due diligence using a risk-based approach in selecting and monitoring third-party service providers. The Company also obtains contractual assurances from third-party service providers relating to their security responsibilities, controls, reporting, and roles and responsibilities as it pertains to cybersecurity incident response policies and notification requirements. As appropriate, the Company obtains independent reviews of the third parties' security through audit reports and testing and conducts verification and validation with third parties to confirm cybersecurity and information security risks are appropriately identified, measured, mitigated, monitored, and reported by the third party to the Company.

companyName: US BANCORP \DE\

ticker: USB


text: We identify material risks from cybersecurity threats through various sources, including, but not limited to, controls testing, compliance testing of our security standards, penetration testing, threat intelligence, and lessons learned and assessments against control frameworks. These threats are assessed by applying our Risk and Control Self-Assessment ("RCSA"), IT risk, and cybersecurity risk management processes, each of which we review regularly. Based on the RCSA, risks from cybersecurity threats that exceed established risk tolerance thresholds are recorded and incorporated into our reporting to the Risk Committee and senior management as described in more detail below. We also engage third-party assessors, consultants and auditors to assist in the administration, assessment and improvement of our cybersecurity risk management program.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG

secItem: Item 1C


text: Incident Reporting If cybersecurity incidents occur, certain of the Company's executive leadership team, legal counsel, and Audit Committee would be briefed and a determination would be made as to whether such incident or vulnerability is deemed material to the Company. The Company's incident response plan is tested annually to assess its operational effectiveness. We conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: We recognize the crucial importance of identifying, assessing, and managing material risks from cybersecurity threats. We are committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard our systems and data, including the data of our customers.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Valkyrie does not provide its clients with online account access nor does process funds transfer requests. If the firm's business changes to allow for remote client access and funds transfer requests, Valkyrie will update the cybersecurity program accordingly by identifying the potential risks involved and implementing the appropriate safeguards to protect the client's personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Audit Committee member education is provided throughout the year through presentations to and discussions with the Audit Committee led by members of management, third-party consultants, our independent registered public accounting firm and legal counsel, on topics including information security, among others. Members of our Audit Committee have expertise in the technology industry as well as corporate risk management strategies.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Materiality Assessment, Mitigation and Reporting. Under the Company's Security Incident Response Policy, the SIRT, under the leadership of the Information Security Coordinator, is responsible for promptly assessing the materiality of security events, developing the Company's response to such events and, if a security event is determined to be a material incident, to oversee the Company's disclosures regarding the incident as required by the rule adopted by the SEC related to cybersecurity disclosures. In determining whether a security event could constitute a security incident, the SIRT considers all facts and known information, including (without limitation) the potential harm to customers, employees and other parties; possible effects on the Company's operations, financial statements, brand perception, reputation, customer or vendor relationships and competitiveness; the risk of fraud, extortion or intellectual property theft; litigation, regulatory and other legal risk; and other potential impacts. The Chair of the Audit Committee is informed of the SIRT's review of cybersecurity events and its determinations as to the materiality of such events. The Security Incident Response Policy also includes procedures for the SIRT to coordinate the containment, eradication, mitigation, recovery and remediation related to security events and security incidents and the implementation of procedures and actions designed to prevent additional security events in the future.

companyName: EVgo Inc.

ticker: EVGO


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.

companyName: GARMIN LTD

ticker: GRMN


text: We face a number of cybersecurity risks in connection with our business. Although we did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, results of operations, or financial condition. See "Item 1A. Risk Factors" for more information on our cybersecurity-related risks.

companyName: LendingTree, Inc.

ticker: TREE


text: The CISO reports such cybersecurity threats and incidents to the Audit Committee. These reports may be included in, or in addition to, his regular quarterly reports to the Audit Committee. In addition, pursuant to our internal procedures, in the event of a significant cybersecurity incident, members of senior management will report such threats and incidents in a timely manner directly to the Audit Committee and, when appropriate, to the full Board of Directors.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: During the year ended December 31, 2023, the Company did not experience any risks from cybersecurity threats that materially affected or were reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition.

companyName: DYNARESOURCE, INC.

ticker: DYNR


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our board of directors (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: o Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.

companyName: BlackRock Direct Lending Corp.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We currently have security measures in place to protect our clients, customers, employees, and vendor information and prevent data loss and other security breaches. We also only use third party software for accounting, billing and payroll that have successful SOC 1 type 2 compliance. Both management and the Board are actively involved in the continuous assessment of risks from cybersecurity threats, including prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Stemtech Corp

ticker: STEK


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board of Directors oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program. The Audit Committee receives semi-annual reports from our General Counsel and Chief Technology Officer on our cybersecurity risks and the implementation of our cybersecurity risk management program. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: GOLDEN ENTERTAINMENT, INC.

ticker: GDEN


text: At Cushman & Wakefield, our Chief Information Security Officer ("CISO") oversees a global information security team which is responsible for protecting the information and operations of us and our clients. Our current CISO has over 23 years of experience and leadership in the cybersecurity industry, holds a master's degree in Information Security and Assurance, and has received numerous industry certifications, including ISO-27000 Specialist, EC-Council Disaster Recovery Professional and an ISACA certification in Risk and Information Systems Control, among others. The information security team has established a security operations center and other partnerships with service providers to monitor for technology and security incidents which are actioned based on the Company's incident response procedures.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: the formation of a multidisciplinary cybersecurity incident response team; and multiple cyber event simulation and tabletop exercises per year to hone the cybersecurity incident response team preparedness.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: Board Oversight of Cybersecurity The Company's Audit and Risk Committees oversee cybersecurity risk and the information security program which includes overseeing management's actions to identify, assess, mitigate and remediate or prevent material cybersecurity risks. The Audit Committee receives an annual report of the information security program and monthly reports from the CISO on notable security events for the period. The notable security event briefings by the CISO are intended to create discussion that allows Board members to understand the impact, controls and risk. The Risk Committee receives annual reports from the CISO on risk assessments and reports on key risk indicators at least quarterly. The Company's Risk Committee receives at least one annual training from the CISO on the information security program, cybersecurity controls or cybersecurity threats.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: The Information Technology Steering Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Officer provides quarterly reports to the Information Technology Steering Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The board of directors reviews and approves our information security and technology budgets and strategies annually.

companyName: TC Bancshares, Inc.

ticker: TCBC


text: We regularly evaluate our Information Security Program based on software vendor assessments and reports, insurance underwriter evaluations, and internal and external audits, including, without limitation, customer audits. We also periodically engage third parties to review the effectiveness of its Information Security Program. To date, these engagements have included third-party penetration testing, risk identification, and a Fiscal Year 2023 comprehensive evaluation of the maturity of our Information Security Program.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: This includes receiving quarterly exercises, cyber-event simulations, training programs and incorporating our Technology Acceptable Use Policy into onboarding and training materials.

companyName: Aeries Technology, Inc.

ticker: AERT


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, are actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").

companyName: Sigyn Therapeutics, Inc.

ticker: SIGY


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a written incident response plan and incident response policy, business continuity plans, data encryption for certain data, implementation of certain security standards, network security and access controls, data segregation, asset tracking/disposal systems, penetration testing and required crew member training programs.

companyName: Vital Farms, Inc.

ticker: VITL


text: Our cybersecurity program is led by our Chief Technology Officer ("CTO"), who has two decades of experience in various cybersecurity, software development, product management, and other technology-related roles. Our CTO oversees teams across the company supporting our security functions of identify, prevent, detect, respond, and recover. These teams are comprised of personnel with a broad range of experience across the private and public sectors, the technology industry, and different geographic regions.

companyName: Exela Technologies, Inc.

ticker: XELA


text: Our Board of Directors and its Audit Committee oversee risks from cybersecurity threats. The Company's Vice President of Information Technology or Chief Financial Officer update the Audit Committee on our cybersecurity risk profile typically on a quarterly basis, and review with our Board of Directors at least annually.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: The Company has not experienced any cybersecurity incidents that have materially affected, or that it believes are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Our VP, Head of Information Technology is the Company's designated Chief Information Security Officer (CISO) and is responsible for developing and implementing the cybersecurity risk management program, including and reporting on cybersecurity matters to the Board. The VP, Head of Information Technology has over twenty years of experience leading cybersecurity oversight. Additionally, members of the IT security team have cybersecurity experience and/or certifications, such as the Certified Information Systems Security Professional and Certified Information Systems Audit credential. The Company views cybersecurity as a shared responsibility across our management team and plans to periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity training at least once annually and have access to more frequent cybersecurity training through online and live events. We also require employees in certain roles to complete additional role-based, specialized cybersecurity training that is documented in our quality management system. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture supportive of security, which we believe improves our cybersecurity.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: We use third-party security firms in different capacities to provide or operate some of our safeguards and technology systems. For example, we use third party consultants to conduct assessments, such as vulnerability scans and penetration testing.

companyName: Viracta Therapeutics, Inc.

ticker: VIRX


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: We believe we have appropriate processes for assessing, identifying and managing material risks from cybersecurity threats. Those processes are embodied in our enterprise-wide cybersecurity risk management program (Cyber Risk Program), which includes our cybersecurity governance structure and our cybersecurity strategy and processes.

companyName: E2open Parent Holdings, Inc.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO has industry recognized certifications including Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Payment Card Industry Professional (PCI ISA & PCIP). He worked in various information security roles at other large public traded companies.

companyName: CANTALOUPE, INC.

ticker: CTLP


text: Our CSIRT includes our independent outside cybersecurity consultant as our strategic lead and the consultant and Chief Financial Officer (CFO) lead the Incident Response Team. Our consultant is certified in cybersecurity and our CFO has overseen our IT for over twenty years. Our team meets at least annually to review the Plan, discuss simulations and appropriate actions, and update the Plan where necessary.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Based on the information that we have to date, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected, including our operations, business strategy, results of operations, or financial condition. and, as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: In particular, the Chief Operating Officer is responsible for hiring appropriate personnel and third-party vendors, communicating key priorities to relevant personnel, and, in concert with members of the Cybersecurity Risk Management Committee, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy. Our Chief Operating Officer, Vice President of Information Technology and Senior Vice President of Legal, in consultation with our third-party information technology team, is responsible for maintaining cybersecurity-related budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: Our Board of Directors' role in risk oversight is consistent with our leadership structure, with management having day-to-day responsibility for assessing and managing our risk exposure and our Board actively overseeing the management of our risks both at the Board and Committee level. The Board conducts its risk oversight by receiving reports from each of the Committees and our executive officers regarding our risk identification, risk management, and risk mitigation strategies with respect to areas of potential material risk, including cybersecurity risk. The Board has delegated to the Audit Committee of the Board primary responsibility for overseeing risks from cybersecurity threats. The Company's Associate Vice President of IT & Facilities briefs the Audit Committee on the Company's cybersecurity risk management program on an approximately quarterly basis, using risk assessment reports from our third-party cybersecurity vendor. The briefing includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation.

companyName: Ocugen, Inc.

ticker: OCGN


text: The Audit Committee has recently been assigned responsibility for overseeing our cybersecurity, including assessment, prevention, detection, and remediation of cyber risks, threats and incidents. When incidents occur, depending on the nature and severity, the Audit Committee is notified, and incidents are further reviewed with the Audit Committee. Material cybersecurity matters will be reviewed with the full Board of Directors.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: The Company regularly engages third parties to perform assessments on our cybersecurity measures, including penetration testing, vulnerability scanning and proactive threat hunting, and operating effectiveness of controls. The results of such assessments, audits, and reviews are reported to the Board, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits and reviews. The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems. In addition, our internal audit department routinely performs internal audits on various aspects of cybersecurity and reports the results in its quarterly report to the Audit Committee.

companyName: SUPERIOR ENERGY SERVICES INC


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is involved in the oversight of the Company's enterprise risk management program, including risks of cybersecurity threats. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on ensuring each operating company is implementing effective and efficient controls, technologies, and other processes to assess, identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents when they occur.

companyName: STEEL PARTNERS HOLDINGS L.P.


text: As of the date of this Form 10-K, the organization is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect First Guaranty. For more information on how cybersecurity risk may materially affect the organization, please refer to Item 1A Risk Factors.

companyName: First Guaranty Bancshares, Inc.

ticker: FGBI


text: Chief Financial Officer works with our IT Director regarding incident prevention and response, as well as disclosure determinations, and is accountable at the management level for our overall risk management program. She receives information about cybersecurity from our IT Director to consider as part of that program. Additionally, our Chief Executive Officer receives updates from the Chief Financial Officer and IT Director about significant threats and incidents involving cybersecurity and data protection.

companyName: Celcuity Inc.

ticker: CELC


text: We continue to face multiple cybersecurity risks, and, in the past, we have had minor incidents. None of the prior incidents had a material effect on our reputation, business strategy, results of operations or financial condition. For more information on the cybersecurity threats and risks we face, see Part I, Item 1A. – Risk Factors.

companyName: Manitex International, Inc.


text: Our CISO, who reports directly to the Chief Technology Officer, has over 15 years of experience in technology and cybersecurity matters, with expertise spanning IT leadership, incident response, enterprise security, and business technology. Our CISO holds multiple cloud and IT certifications and is an active thought leader in the cybersecurity space. Prior to joining Nextdoor, our CISO led Business Technology, IT and Cybersecurity at Workato, Inc. and held key roles at Peloton Interactive, Inc. and KPMG LLP, where they built and implemented business continuity and cyber resilience programs.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer ("CISO"), internal security staff, or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: The Company's management team has designated a Cybersecurity Advisory Council (the "Council"), which consists of members of management, including the Senior Director, Global IT Security and a cross-section of Company leaders. The Council ensures strong alignment within the Company with the objectives of the cyber program, providing input on policy and risk decisions. The Council receives periodic briefings on security status, incidents, and mitigation plans.

companyName: GREIF, INC

ticker: GEF


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Risk Committee. Aside from more immediate reporting of certain incidents to our Board of Directors as described above, our Director of Information Technology provides our Risk Committee an update on cybersecurity at least every other quarter and more often as necessary. This update includes metrics on the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.

companyName: Calumet, Inc. /DE

ticker: CLMT


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures we implement to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and Audit Committee receive reports and presentations from members of our senior leadership for overseeing our cybersecurity risk management, including our Corporate Information Technology Director, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Such members of our senior leadership also report to the Board directly at least annually on cybersecurity matters, including information security and cybersecurity risk.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Our Chief Executive Officer and Senior Vice President of Finance oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Under such policies and processes, our Chief Executive Officer and Senior Vice President are responsible for reporting to our audit committee regarding any cybersecurity incidents.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: We are a smaller reporting company. While management monitors our exposure to cybersecurity risk, as a whole, CONX Corp. has not adopted specific processes for assessing and managing such risk. The audit committee is responsible to discuss with management any significant risks or exposures, and as necessary report such risks or exposures to our board of directors. While to date we have not encountered any cybersecurity incidents, any sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure could lead to corruption or misappropriation of proprietary information and sensitive or confidential data.

companyName: CONX Corp.


text: resulted in a material effect on our business strategy, results of operations, or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.

companyName: Rallybio Corp

ticker: RLYB


text: We have a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, including through review of applicable certifications and security reports, where available, and contractual requirements, as appropriate.

companyName: MYOMO, INC.

ticker: MYO


text: We design and assess our program based on established frameworks, such as the CIS Critical Security Controls ("CIS Controls"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."

companyName: Waste Connections, Inc.

ticker: WCN


text: Risk Management and Strategy Aurora's Information Security team has implemented a robust cybersecurity risk management program in order to protect the confidentiality, integrity, and availability of the Company's products, infrastructure, and data. The program, which is integrated with our overall risk management system, aims to identify, assess, and mitigate cybersecurity risks for both the product and the organization. It includes a cybersecurity incident response procedure ("CIRP") that defines roles and responsibilities during cybersecurity incidents, outlines incident handling procedures, including detection, investigation, and mitigation of incidents, and provides a framework for assessing incidents. Aurora's CIRP contributes to satisfaction of certain elements of Aurora's Safety Case. Additionally, the CIRP is referenced in and integrated into the Company's Cross-Functional Incident Response Plan, which serves as an outline of the actions to be taken across the Company immediately following a vehicle incident.

companyName: Aurora Innovation, Inc.

ticker: AUR


text: Cyber Risk Governance The Board provides strategic oversight over the Company generally, including oversight of risks associated with cybersecurity threats. The Investment Manager's CISO and the Company's Secretary periodically report to the Board on the status of the Investment Manager's ISP, cybersecurity risks, risk management policies and risk assessment initiatives. Such reports particularly emphasize any material risks concerning the Company.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: AMN's information security program reports up to our Chief Information & Digital Officer ("CIO") and is managed by our Senior Director, Information Security, whose team is responsible for leading our enterprise-wide cybersecurity strategy. Through ongoing communications with the team, the CIO and the Senior Director, Information Security, are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents and progress on cybersecurity infrastructure initiatives. In the event of a material cybersecurity incident, the CIO will escalate to the Audit Committee and the Board is made aware as appropriate and in accordance with AMN's incident response plan. Our CIO and Senior Director, Information Security have proven experience as technology leaders establishing and overseeing enterprise information security programs in the healthcare industry. Our CIO has over 25 years of experience serving as Chief Information Officer, Senior Vice President of IT, and Director of IT at various healthcare services and technology companies. AMN's Senior Director, Information Security has over 20 years of experience in various roles in information technology and information security. He holds a M.Sc. in Computer Information Systems and holds several relevant certifications, including Certified Information Security Manager and Zero Trust Certified Architect.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: We have designed and assessed our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, rather only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: LANDS' END, INC.

ticker: LE


text: In accordance with our board policy for incident management and business continuity planning, we have implemented security incident response plans and security incident response teams. These teams include members from multiple functional areas of our organization that identify, investigate, respond, and resolve cybersecurity incidents. Cybersecurity incidents are evaluated and ranked by severity and prioritized for response. We also evaluate the need to include the use of third parties to assist us in the response to a cybersecurity incident. Our Senior Vice President and COO leads the security response teams, and the activities of the security response teams are overseen by our senior management team. Based on the severity of incident, members of the senior management team determine whether the incident requires immediate escalation to our board of directors.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: We use third-party service providers to perform a variety of functions throughout our business, such as third party content providers, application providers and contract manufacturing organizations.

companyName: PlayAGS, Inc.


text: We have aligned our cybersecurity program to the National Institute of Standards and Technology's ("NIST") published cybersecurity standards and our policies and processes are compliant with NIST Special Publication 800-171 and other applicable publications. Given our status as a defense contractor, we are subject to numerous regulations, including those pursuant to the Defense Federal Acquisition Regulation Supplement, ("DFARS") requiring us to have controls in place to protect U.S. Government controlled unclassified information ("CUI") and to report cybersecurity incidents to the DoD. We will also be subject to the DoD Cybersecurity Maturity Model Certification ("CMMC") requirements, which will require companies like AeroVironment that do business with the DoD to obtain specific third-party certifications relating to specified cybersecurity standards to be eligible for new contract awards. We are in the process of preparing for the CMMC requirements. While we believe we are in a good position to meet the requirements of CMMC, if we fail to achieve certification in advance of contract awards, or we fail to achieve certification at the level required for a particular contract award, we will be unable to bid on such contract awards or follow-on awards for existing work with the DoD, which could adversely impact our results of operations. Additionally, our subcontractors, and certain of our vendors, may also need to comply with CMMC requirements and, potentially obtain CMMC certification. We may be negatively impacted if our subcontractors or vendors are not compliant with CMMC requirements.

companyName: AeroVironment Inc

ticker: AVAV


text: We recognize the critical importance of maintaining the trust and confidence of business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our Board is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks by utilizing reputable third party vendors and service providers to manage and maintain our information systems and assets in accordance with strong cybersecurity policies, standards, processes and practices, and by preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: TAO Synergies Inc.

ticker: TAOX


text: To date, we have not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations or financial condition. The cybersecurity risks that could materially affect Anywhere, including our business strategy, results of operations, or financial condition, are set forth in "Item 1A.—Risk Factors".

companyName: Anywhere Real Estate Group LLC


text: As part of our overall cybersecurity strategy, as and when we detect cybersecurity threats, our Global IT Security team documents the relevant incident details, assesses the impact and severity of it, identifies the root cause and corrective actions, and communicates the incident to our CISO and any other relevant parties as needed. We also seek to address cybersecurity risks associated with our third-party vendors by making our Global IT Security team a key part of relevant vendor onboarding, whereby we conduct comprehensive risk assessments of such vendors' cybersecurity policies and practices. When necessary, we utilize third party auditors and consultants to assess third-party cybersecurity risks, and we consult with outside counsel as appropriate, including on materiality analysis and disclosure matters. Our senior management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: The Chief Information Security Officer (CISO) leads our global information security organization responsible for overseeing the Company's information security program. Our CISO has over 30 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies. Team members who support our information security program have relevant educational and industry experience, including holding similar positions at various technology companies. The global information security organization provides regular reports to senior management on various cybersecurity threats, assessments and findings.

companyName: ManpowerGroup Inc.

ticker: MAN


text: As part of our board of directors' enterprise risk management program, our board of directors has responsibility for oversight of cybersecurity risk management. Our board of directors has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full board of directors.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Oversight of Cybersecurity Risks The Board and our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, our Board and/or our Audit Committee receive periodic reports and/or updates from management on the primary cybersecurity risks facing us and the Advisor, the Sub-Advisor, and the Dealer Manager and the measures we, the Advisor, the Sub-Advisor and the Dealer Manager are taking to mitigate such risks. In addition to such reports and updates, our Board and/or our Audit Committee receive updates from management as to changes to our and the Advisor's, the Sub-Advisor's and the Dealer Manager's cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow Inland's incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.

companyName: InPoint Commercial Real Estate Income, Inc.

ticker: ICR-PA


text: We recognize that third parties that provide information systems used by the Advisor to provide services to the Company can be subject to cybersecurity incidents that could impact the Company. To mitigate third party risk, Franklin Templeton maintains a vendor code of conduct, which is designed to require third party vendors to comply with our requirements for maintenance of passwords, as well as other confidentiality, security, and privacy procedures. Third-party IT vendors are also subject to additional diligence such as questionnaires and inquiries.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: The Chief Financial Officer and Senior Director of Information Technology work with other groups in the Company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. All employees and contractors receive cybersecurity training, and we plan to implement additional annual training for all employees and contractors. All trainings are intended to raise awareness of cybersecurity threats in order to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions.

companyName: Altimmune, Inc.

ticker: ALT


text: Our cybersecurity risk management program is intended to protect the confidentiality, integrity and availability of our critical systems and information. Our program includes processes for identifying, assessing and managing material risks from cybersecurity threats that are guided by the National Institute of Standards & Technology's Cyber Security Framework, the ISO 27001 international standard for information security and other applicable industry benchmarks.

companyName: Broadcom Inc.

ticker: AVGO


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information and email systems that may result in adverse effects on the confidentiality, integrity, or availability of our information and email systems or any information residing therein.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: Vulnerability and penetration assessments are also conducted at least annually by an independent third party. In addition to a strong set of internal controls, the company has implemented a robust due diligence process for third-party providers prior to executing an agreement. Risk assessments include evaluating the third-party's security posture through intelligence feeds, SOC reports, ISO certifications and self-attestation questionnaires. Third parties processing customer data are contractually required to meet all legal obligations for protecting against anticipated security threats to client data, protecting against unauthorized access to client data, and ensuring proper disposal of client data.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: Company has not experienced any material cybersecurity incidents, and expenses related to minor incidents have remained immaterial. However, as highlighted in "Risk Factors" in Part I, Item 1A of this Annual Report, cybersecurity threats continue to pose significant risks to our operations and financial condition. These risks are amplified as cyber threats become more sophisticated and coordinated.

companyName: Vislink Technologies, Inc.

ticker: VISL


text: Index to Financial Statements • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process. • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences. • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.

companyName: TARGET CORP

ticker: TGT


text: Risk Management and Strategy have implemented a multi-layered cybersecurity program designed to identify, assess, and manage material risks related to information technology systems and data. Our approach includes: Continuous monitoring of systems for vulnerabilities, unauthorized access, and threats; of third-party security assessments and tools, including firewalls, endpoint detection and response (EDR), encryption, and secure cloud infrastructure. employee training on data security, phishing awareness, and incident response protocols;

companyName: Eva Live Inc

ticker: GOAI


text: Cyber Risk Management and Strategy Under the oversight of our Audit Committee, we intend to implement and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes would be integrated into our overall risk management processes. We intend to implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. In support of this approach, it is expected that we would have a third-party security consultant implement processes to assess, identify and manage security risks to our company, including in the pillar areas of security and compliance, application security, infrastructure security and data privacy. This process, once implemented, would include regular compliance and critical system access reviews. In addition, we intend to conduct application security assessments, vulnerability management, penetration testing, security audits and ongoing risk assessments as part of our risk management process.

companyName: T-REX Acquisition Corp.

ticker: TRXA


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. These policies and standards are reviewed annually to reflect emerging threats and evolving industry practices, including elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.

companyName: Johnson Controls International plc

ticker: JCI


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continue to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: MERCANTILE BANK CORP

ticker: MBWM


text: Given the importance of cybersecurity to our business, we maintain a comprehensive information security program for assessing, identifying and managing material risks from threats to our information security. Our information security program is based on industry standards and best practices, following the National Institute of Standards and Technology (NIST) Cybersecurity Framework. As part of our information security program, we also require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. We also train employees on how to identify potential cybersecurity risks and protect our information and resources. This training is mandatory for all employees globally upon hire and on an annual basis.

companyName: Enstar Group LTD


text: We consistently engage in proactive measures aimed at preventing, detecting, and effectively minimizing the impact of cybersecurity incidents. We maintain an incident response plan to swiftly respond to breaches, protect customer data, and minimize disruption to our operations. The incident response process is consistently tested and reviewed through simulated incidents and tabletop exercises with key stakeholders. To bolster our incident response process, we have robust business continuity, contingency, and recovery plans to ensure operational resilience during a cybersecurity incident.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: c.if deemed appropriate, reporting by our CISO to the Company's Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and d.informing the Audit Committee of our Board of significant or material cybersecurity incidents, as appropriate.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Evaluating our own and our industry's risk profile is an ongoing process, allowing us to continually tailor our cybersecurity measures to specific needs and vulnerabilities. We also coordinate with law enforcement agencies concerning threats, so that our approach benefits from broader insights and intelligence.

companyName: Cidara Therapeutics, Inc.


text: By implementing these risk management strategies, we aim to minimize the likelihood and impact of a cybersecurity breach, thereby safeguarding our assets and maintaining the trust of our stakeholders.

companyName: Arcellx, Inc.

ticker: ACLX


text: To mitigate identified cyber-related risks to our organization, we employ a multi-layered approach that has been integrated into our overall risk management systems and processes that includes: • Security Controls: We have implemented industry-standard security controls aligned with the NIST CSF framework such as identity and access control, multi-factor authentication, encryption, and data protection measures. • Security Awareness: We conduct regular cybersecurity awareness training to educate employees about potential threats and best practices for safeguarding company assets and data. In addition, we conduct periodic phishing tests to enhance our security awareness program. • Third-Party Oversight: We evaluate third-party partners' cybersecurity practices through due diligence assessments and contractual obligations. Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers. • Continuous Monitoring: We have partnered with a third-party Managed Security Services Provider to provide event logging, monitoring for detection of cybersecurity events, and assistance with investigations into possible cyber-related events, as well as assessment and consultation on security enhancements. • Business Resiliency: We have developed emergency response, business continuity, and disaster recovery plans to respond to a widespread disruption to business operations. • Continuous Improvement: Any previous cybersecurity incidents, whether material or not, have resulted in improvements in the company's cybersecurity program, policies, or technical controls, where applicable.

companyName: Quest Resource Holding Corp

ticker: QRHC


text: Our cybersecurity management teams supervise efforts designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by information security tools deployed in the information technology environment. Cybersecurity management also supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Sempra's director of cybersecurity governance & chief information security officer provides additional oversight and support for the operational cybersecurity activities at our consolidated entities.

companyName: SEMPRA

ticker: SREA


text: To date, risks from cybersecurity threats or incidents have not materially affected the Company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect the Company's business strategy, results of operations, or financial condition, please refer to "Item 1A. Risk Factors."

companyName: FirstCash Holdings, Inc.

ticker: FCFS


text: The Company's Vice President of Information Technology is the central contact point to receive (i) alerts regarding potential cybersecurity incidents and (ii) reports from the Company's Information Technology personnel regarding potential cybersecurity incidents. All confirmed cybersecurity events are communicated by the Vice President of Information Technology to the Corporate Controller and Vice President of Internal Audit. Material confirmed cybersecurity events are further escalated to the Chief Executive Officer and Chief Financial Officer for further review, discussion and remediation.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Both our Chief Information Officer and our Chief Information Security Officer have extensive experience in assessing and managing cybersecurity risks, including decades of collective experience in information technology and cybersecurity roles of increasing responsibility both at the Company and in prior positions. We prioritize cybersecurity awareness among our employees and contractors through various training exercises, including formal programs and simulated phishing events. We maintain incident response plans, playbooks, and engage third-party cybersecurity firms for simulated cyberattacks and penetration testing to identify potential risks. We also have a third-party cybersecurity firm on retainer for incident assistance and response. Periodic internal self-assessments are conducted by our cybersecurity organization using the National Institute of Standards and Technology Cybersecurity Framework.

companyName: WESTLAKE CORP

ticker: WLK


text: Oversight of cybersecurity risk is a joint responsibility of the Board of Directors and the Audit Committee. The Company's Chief Information Officer (the "CIO") provides quarterly updates to the Audit Committee and the chair of the Audit Committee regularly updates the Board of Directors on cybersecurity matters potentially impacting the Company. Additionally, the CIO briefs the Board of Directors on information security matters at least annually. In addition to oversight by the Audit Committee and the Board of Directors, our CIO chairs a Working Council that includes our Chief Financial Officer, Chief Human Resources and Communications Officer and our Chief Legal and Administrative Officer. Our IT organization also includes a Chief Information Security Officer who is responsible for establishing processes as well as management of all cyber security risks and programs to mature our NIST posture. Our CIO has served in this role since 2023 and has more than 30 years of experience in the aggregate in various IT leadership roles. His educational background includes a master's in business administration in Information Systems from The State University of New York at Albany, and a bachelor's degree in electrical engineering from Harcourt Butler Technological Institute, Kanpur, India.

companyName: Mativ Holdings, Inc.

ticker: MATV


text: The Audit Committee of the Board of Directors oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats. The Audit Committee of the Board of Directors oversees our cybersecurity risk and regularly receives reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance.

companyName: ManpowerGroup Inc.

ticker: MAN


text: NBT has appointed the Senior Director of Information Security ("DISO") to oversee the implementation, coordination, and maintenance of the ISP. The DISO's responsibilities include:

companyName: NBT BANCORP INC

ticker: NBTB


text: Oversight of Cybersecurity Risks Our cybersecurity program is managed by Ares' dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Ares' CISO, who has a Master's degree in Cybersecurity from Brown University and over 25 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The Ares CISO reports cybersecurity updates to the Ares ERC. The Ares ERC is a committee that governs and oversees the Ares Enterprise Risk Program, including cybersecurity. The Ares ERC includes members of Ares' senior executive management, including its CEO, Co-Presidents, CFO, General Counsel, Global Chief Compliance Officer and Head of Enterprise Risk, who acts as chairperson of the Ares ERC. The Ares ERC, through regular consultation with the Ares internal cybersecurity team and representatives from our Advisor, assesses, discusses, and prioritizes Ares' approach to high-level risks, mitigating controls, and ongoing cybersecurity efforts.

companyName: Ares Real Estate Income Trust Inc.

ticker: ZARE


text: We have not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We maintain specific insurance coverage to mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' information technology and information systems, but there can be no assurance that coverage would be adequate in relation to any incurred losses.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: Encryption methods are used to protect sensitive financial information and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.

companyName: CSI Compressco LP


text: As of the date of this report, we are not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: GROOVE BOTANICALS INC.

ticker: GRVE


text: While our full Board has overall responsibility for risk oversight, it has delegated primary oversight of certain risks to its committees. Our Audit Committee monitors cybersecurity risks, and the steps our management has taken to monitor and control exposures. Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) brief the Audit Committee quarterly on cybersecurity risks, updates on the regulatory and cyber landscape and significant cybersecurity events, as needed. Our Audit Committee reports to our Board on cybersecurity matters quarterly, or more often as the need arises.

companyName: InnovAge Holding Corp.

ticker: INNV


text: The cybersecurity capabilities of third-party vendors providing services to NEE or FPL or accessing NEE's or FPL's systems or data are evaluated as part of the new vendor establishment process. NEE, including FPL, retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or FPL's contracts with third-party vendors accessing its systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.

companyName: FLORIDA POWER & LIGHT CO


text: While we do not believe that our business strategy, result of operations or financial condition have been materially adversely affected by any cybersecurity incidents, for further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Securities and an Investment in our Common Stock—Cybersecurity risks and cyber incidents may adversely affect our business or the business of our portfolio companies by causing a disruption to our operations or the operations of our portfolio companies, a compromise or corruption of our confidential information or the confidential information of our portfolio companies and/or damage to our business relationships or the business relationships of our portfolio companies, all of which could negatively impact the business, financial condition and operating results of us or our portfolio companies."

companyName: OFS Capital Corp

ticker: OFS


text: Integration into Overall Risk Management: Our cybersecurity risk assessment processes are fully integrated into the broader risk management framework. Cybersecurity is positioned as a core component of our risk management strategy, with direct reporting to our President and COO, who is guided by our MSP firm. The MSP firm provides strategic direction on policy, procedures and best practice. The synergy between cybersecurity and risk management ensures a resilient posture against emerging cyber threats.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: Risk Assessment and Identification: We conduct regular assessments to identify, evaluate, and prioritize potential cybersecurity threats and vulnerabilities. We utilize various methods like vulnerability scanning, threat intelligence feeds, and penetration testing.

companyName: Mega Matrix Corp.


text: The Company has established protocols for evaluating, identifying, and mitigating significant risks stemming from cybersecurity threats. These protocols are integrated into the Company's overarching risk management framework, including potential risks arising from the utilization of third-party service providers. Furthermore, the Company has instituted monitoring procedures to proactively address and minimize risks associated with data breaches or security breaches originating from external sources. Periodically, the Company may enlist the expertise of third-party consultants, legal advisors, and audit firms to assess and fortify its risk management systems, as well as to manage and resolve specific cybersecurity incidents, as deemed necessary.

companyName: BLUM HOLDINGS, INC.

ticker: BLMH


text: We use a risk management framework based on applicable laws and regulations and informed by industry standards and industry-recognized practices, for managing cybersecurity risks within our products and services, infrastructure, and corporate resources. To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, first- and third-party vulnerabilities, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. We also engage third-party security experts and consultants to assist with assessment and enhancement of our cybersecurity risk management processes, as well as benchmarking against industry practices. In addition, we maintain a privacy risk management program to assess privacy risks related to how we are collecting, using, sharing, and storing user data, which is subject to assessment by an independent, third-party privacy assessor. We have certified against, and demonstrated conformance to, the International Organization for Standardization's (" ISO ") information security management system audit using the 27701:2019 framework for the first time, and the 27001:2013, 27701:2019, and 27017:2015 frameworks. Successfully achieving these four certifications demonstrates our prioritization of security and privacy for both us and our customers and we believe shows that we have proper company-wide processes for managing operations, and maintaining people and information assets, information systems, and the associated processes that enable corporate operations. Our four ISO certifications add to the company's overall resiliency strategy and commitment to security for all customers, which includes other accreditations including SOC 2 Type II, compliance with HITRUST CSF v11.0.1., CSA STAR, IRAP, FedRAMP and StateRAMP. Regularly engage senior management on data privacy and security issues; Align policies, procedures, and technical controls to demonstrate our process and our commitment to our customers and users; Train each of our employees on all privacy and security expectations;

companyName: AvePoint, Inc.

ticker: AVPT


text: If a threat is detected, our system automatically notifies our internal information systems management ("ISM") team of all activities and ranks those activities based on their level of threat to the system and/or deviation of behavior from normal. Severe threats notify the ISM team via text message, regardless of hours of operation. In addition to the notification, the system will automatically take action to secure the system, up to and including blocking user accounts and access. The ISM team will then review the notification, assess the action that was taken against the actual threat, and then clear the condition or take further action.

companyName: Vivos Therapeutics, Inc.

ticker: VVOS


text: Our Vice President, Global Information Security has 27 years of experience in the cybersecurity industry, including previous experience in the U.S. Air Force, consulting, and 21 years with Owens Corning, and reports directly to our CIO.

companyName: Owens Corning

ticker: OC


text: Kodak has implemented various processes designed to assess, identify and manage risk from cybersecurity threats. Kodak's cybersecurity program follows the structure and objectives of the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework and is designed to satisfy multi-jurisdictional regulatory requirements. Key areas of Kodak's cybersecurity risk management processes and strategy currently include:

companyName: EASTMAN KODAK CO

ticker: KODK


text: Cyber Risk Management and Strategy We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems. For more information about the cybersecurity risks we face, see Item 1A, Risk Factors. To help manage these risks, we have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and treatment of cybersecurity risks. These assessments are aligned with industry standards and leading practices, and provide a comparison based on practices at comparable organizations and recommendations for management to consider. In addition to these external assessments, compliance readiness is assessed at a minimum annually by our CITO, in the form of penetration testing and vulnerability assessments. This program extends to a review of the cybersecurity measures in place at the properties that we own as well as our corporate headquarters, and selected senior managers also have participated in a tabletop exercise curated by our external security consultant to test and improve our incident response planning. We also maintain processes around third-party vendor risk management, such as the submission of vendor questionnaires to critical vendors and the inclusion of contractual security requirements as appropriate.

companyName: Paramount Group, Inc.

ticker: PGRE


text: The Company's cybersecurity risk management program is an integral part of its overall enterprise risk management efforts. The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices designed to safeguard the confidentiality, integrity, and availability of its information assets. Through this framework, the Company devotes appropriate resources to monitoring, identifying, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.

companyName: BLACKBERRY Ltd

ticker: BB


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs or other contractors, consultants or third parties upon which we rely, or your data are or were compromised, we could experience adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss or revenue or profits, and other adverse consequences."

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: We maintain an Incident Response Playbook that provides a set of guidelines for our stakeholders to follow when handling any data incident. This playbook describes how we assess incidents and how our security team shares information about such incidents with others at Lumen, including senior leadership and, if warranted, with some or all members of our Board of Directors. These escalation provisions, together with our disclosure controls and procedures, are designed to ensure that appropriate representatives throughout the Company are available to assess how to respond to such incidents and make any necessary public notifications.

companyName: Lumen Technologies, Inc.

ticker: LUMN


text: establishing and maintaining a comprehensive program to oversee and manager external connections and third-party relationships with access to the institution's technology assets and information; and an incident response program intended to enable us to mitigate the impact of, and recover from, any cyberattacks, and facilitate communication to internal and external stakeholders, experienced a single cybersecurity event in June of 2023 in which an unauthorized third party gained access to the email accounts of two of our employees. We notified the affected customers of the incident in early September 2023, and have taken steps to mitigate our and our customers' exposure to unauthorized activity. To date, we have incurred expenses of approximately $25,000 related to the cybersecurity incident.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: IT Manager reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks and provides an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. Any cybersecurity incidents at the Company are reported to the Audit Committee by the IT Manager.

companyName: GIFTIFY, INC.

ticker: GIFT


text: The Company maintains security programs that include physical, administrative and technical safeguards, and the Company maintains plans and procedures whose objective is to help the Company prevent and timely and effectively respond to cybersecurity threats or incidents. Through the Company's cybersecurity risk management process, the Company continuously monitors cybersecurity vulnerabilities and potential attack vectors to Company systems, and the Company evaluates the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. The Company continues to integrate the Company's cyber practice within the Company's Risk Oversight Committee, and Enterprise Risk Management program, both of which are overseen by the Company's Board of Directors and provide frameworks for identifying and tracking cyber-related business and compliance risks across the Organization. The Company periodically engages third-party consultants to assist us in assessing, enhancing, implementing, and monitoring the Company's cybersecurity risk management programs and responding to any incidents.

companyName: FIRST MID BANCSHARES, INC.

ticker: FMBH


text: The Information Security Committee, consisting of senior management and analysts from Information Security and Information Technology, monitors and assesses cyber threat intelligence, responds to cyber incidents at a technical level, and determines whether new controls are needed to address emerging risks or active cyber exploits. Key Risk Indicators for Information Security and Information Technology are reported to the Operations and Information Technology Steering Committees. Key risks and other relevant information are further summarized for the Board Risk and Audit Committees. The Board also receives a full report on the Information Security Program and its effectiveness annually. Other cyber related issues are brought to the attention of the Board as needed.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with the Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, the General Counsel, and the Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity, and nature of our operations.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Management -- Under the oversight of the audit committee of the Company's board of directors, the Senior Vice President of Information Technology, with over 20 years of experience in this field, is primarily responsible for the assessment and management of material cybersecurity risks and establishing and maintaining adequate and effective internal controls covering cybersecurity matters. The Company's Chief Financial Officer and Senior Vice President of Information Technology, are responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. See "Item 1. Risks Related to Information Systems Security - As the threat landscape is ever-changing, the Company must make continuous mitigation efforts, including risk-prioritized controls to protect against known and emerging threats; tools to provide automated monitoring and alerting; frequent employee training; and backup and recovery systems to restore systems and return to normal operations. However, there can be no assurance that the Company's ability to monitor for or mitigate cybersecurity risks will be fully effective, and the Company may fail to identify cybersecurity breaches or discover them in a timely way."

companyName: CREDITRISKMONITOR COM INC

ticker: CRMZ


text: Airship's cybersecurity and risk management program is intended to protect the confidentiality, integrity, and availability of our critical information systems and the data resided on them. Due to the nature of our business and our customers, we face various cybersecurity challenges and threats, including attempts to gain unauthorized access to our codebase, proprietary or confidential information, denial-of-service attacks, attacks from foreign nations, as well as threats to our identity and personnel. We have designed our IT systems and processes with the intention that our solutions should defend against the ever-evolving threat landscape while remaining agile to keep up with such threats.

companyName: Airship AI Holdings, Inc.

ticker: AISP


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: ServiceNow, Inc.

ticker: NOW


text: • Education and Awareness: BlackRock's employees and contractors are required to complete an annual information security training to equip them with effective tools to address cybersecurity threats, and to receive communications on BlackRock's evolving information security policies and procedures.

companyName: BlackRock TCP Capital Corp.

ticker: TCPC


text: Our Chief Legal Officer, with the assistance of and informed by our Head of IT, and our external consultants, is primarily responsible for overseeing our cybersecurity risk management framework, including assessing and managing our material risks from cybersecurity threats, as well as monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Legal Officer has experience as a senior legal, compliance and operations executive in highly regulated companies, including in roles with executive-level responsibility for overseeing data privacy and security compliance. Our Head of IT has experience overseeing the IT function, including cybersecurity, for private and public biotechnology.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team and IT consultants work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Our overall information security efforts are led by the Chief Information Security Officer ("CISO"). The CISO has substantial experience in cybersecurity, including knowledge, skills, certifications, and background in the field. The CISO holds several key certifications including Certified Information Systems Security Professional ("CISSP"), Certified Secure Software Lifecycle Professional ("CSSLP") and Certified Ethical Hacker ("CeH").

companyName: PERRIGO Co plc

ticker: PRGO


text: Our cybersecurity strategy focuses on continued strengthening of our security posture, improvement of security operational efficiencies, and preparedness for evolving business and technology needs including the detection, analysis, and response to known, anticipated or unexpected cybersecurity threats, management of material risks related to cybersecurity threats and resilience against cybersecurity incidents. We regularly assess potential threats and make investments seeking to reduce the risk of these threats against our critical information and assets by implementing a broad set of security measures, including comprehensive monitoring of our networks and systems, rapid detection and response, and threat management capabilities. For example, we scan our systems for vulnerabilities and annually engage external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our cybersecurity systems. The results of such assessments and reviews are reported to our Information Security Department and Audit Committee of the Board of Directors (the "Audit Committee"), and then we consider adjustments to our cybersecurity processes and practices as appropriate based on the information provided by the third-party assessments and reviews.

companyName: APTARGROUP, INC.

ticker: ATR


text: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. At the management level, our IT security team regularly monitors, alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard which covers cyber operational controls along with internal and external threats. Annual risk and cyber maturity assessments are conducted by independent third parties. Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape. These tests and assessments are useful tools for maintaining a cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. We seek to engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, conducting security assessments and conducting periodic reassessments during their engagement. Our IT security team conducts an annual review of third parties with a specific focus on any sensitive data shared with third parties. System and Organization Controls (SOC) reports are reviewed along with complementary user entity controls. If a third-party vendor is not able to provide a SOC 2 report, we take additional steps to assess their cybersecurity preparedness. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: CINTAS CORP

ticker: CTAS


text: The Company's business segments and support teams also work closely with cybersecurity and enterprise risk management to monitor and manage third-party risks. Managing third-party risks includes maintaining a close and effective working relationship with the information technology procurement, accounting, and legal teams. In addition to identifying risks as part of the third-party selection process, we continuously monitor our third parties using products and services that provide us insight into their attack surface, threats that can impact us through them, and real-world security posture.

companyName: NELNET INC

ticker: NNI


text: In addition, we have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. We also have business processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Through the Master Services Agreement with Harley-Davidson, we take measures to regularly update and improve our cybersecurity program, including conducting assessments, performing penetration testing and scanning of our systems for vulnerabilities using external third-party tools and techniques to test security controls, auditing applicable data policies, and monitoring emerging laws and regulations related to information security. We design our program based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework. However, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. In addition, we periodically engage third-party advisors to assess the effectiveness of our cybersecurity program, policies and practices. We rely on Harley-Davidson to regularly consult with external advisors and cybersecurity providers regarding opportunities and enhancements to strengthen our policies and practices.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: Material Cybersecurity Risks, Threats & Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we have not experienced any material cybersecurity threats or incidents as of the date of this Report, our cybersecurity program might not be able to prevent or mitigate future successful attacks, threats or incidents.

companyName: Xylem Inc.

ticker: XYL


text: We have a Privacy and Security Executive Taskforce ("Taskforce") consisting of executive-level leaders that meets periodically to, among other things, review global trends in privacy, security, and compliance, identify key projects and resource needs, and review operational privacy and security statistics and metrics. Additionally, our Chief Technology Officer ("CTO") is a member of the Taskforce and manages and oversees a team (the "IT Security Team") that is responsible for leading company-wide cybersecurity efforts. The IT Security Team works with various business units and departments, including legal, product development, and operations, to help set standards, policies, and processes. The IT Security Team also collaborates closely with the CISO of Informa and his team to, among other things, align strategy, assessments, and tooling. Our CTO along with key members of his IT Security Team have worked in the information security field for many years and are actively involved in our cybersecurity efforts. We also periodically perform tests on aspects of the operations of our cybersecurity program and the supporting control framework and report the results of these audits in reports to our Audit Committee.

companyName: TechTarget, Inc.

ticker: TTGT


text: The Board's oversight of cybersecurity risk management is led by the Audit Committee of the Board, which regularly interacts with our Chief Compliance Officer, our Executive Director of IT, and other members of management.

companyName: Passage BIO, Inc.

ticker: PASG


text: Management of the Company, including the CCO and the Company's Disclosure Committee, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of GC Advisors.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our ISO, who has over 20 years of experience in information security. Our ISO oversees a global team of information security professionals consisting of multiple full time equivalent employees in multiple countries.

companyName: DYNAVAX TECHNOLOGIES CORP

ticker: DVAX


text: Information Technology are committed to using technology to improve our competitive position. We depend on a variety of information systems and technologies (including cloud technologies) to manage the operations of our growing customer base. Our core business systems consist mostly of purchased and licensed software programs that integrate together and with our web-based radio automation systems.

companyName: Transglobal Management Group, Inc.

ticker: TMGI


text: As part of the Company's approach to cyber risk management, the Company performs internal audits of internal processes and controls relating to cybersecurity. Every year, the Company engages third-party experts to conduct cyber penetration testing. Based on their findings and recommendations, the Company makes the appropriate updates to its cybersecurity software.

companyName: NATIONAL PRESTO INDUSTRIES INC

ticker: NPK


text: Company recognizes the importance of cybersecurity in safeguarding sensitive information, maintaining operational resilience, and protecting stakeholders' interests. The Company currently manages cybersecurity risks by utilizing basic security protocols, such as network monitoring and access controls. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to the best of their ability to ensure that such potential cybersecurity risk exposures are monitored, putting in place reasonably appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity program is under the direction of our CFO. Any significant Cyber incidents that they become aware of are reported to the board of directors.

companyName: Golden Star Resource Corp.

ticker: GLNS