text: The CRMC is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Trust's reliance on Fidelity and its Enterprise Cybersecurity organization, the CRMC relies on the cybersecurity expertise of Fidelity's CISO and members of the CISO's staff to assist in assessing and managing the Trust's material risks from cybersecurity threats. The CISO has over twenty years of experience in technology and information security and has served as Fidelity's CISO since May 2021.

companyName: Fidelity Wise Origin Bitcoin Fund

ticker: FBTC


text: Potential new vendors and existing vendors (which are reviewed periodically) that are known to have access to sensitive data or Company systems are subject to a risk assessment process including the review of independent security audits where available. Continuous monitoring of existing vendors occurs via an automated service that rates companies' publicly facing cybersecurity posture and identifies known vulnerabilities.

companyName: Employers Holdings, Inc.

ticker: EIG

secItem: Item 1C


text: Our Chief Information Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors CYBERSECURITY

companyName: TARGET CORP

ticker: TGT


text: Management's role and relevant experience in assessing and managing cybersecurity The NIST CSF is used to assess cybersecurity maturity. An initial baseline assessment has been used to inform our Cybersecurity Strategy and periodic assessments are used to update the NIST CSF scoring. These assessments are carried out by an independent third party to provide appropriate objectivity and challenge. In addition, we are progressing towards certification to the international information security management standard - ISO 27001 and the related standard ISO 27701 for privacy information management. Execution of our cybersecurity strategy is overseen by our Director of Information Security who is a qualified CSIM, CISA and a Fellow of the UK Chartered Institute of Information Security and has over 30 years of experience in cyber security. The Director of Information Security provides the CTO with periodic updates and also chairs the Cyber Security Risk Committee which provides a forum for senior management to discuss cyber risk management in greater detail.

companyName: Soho House & Co Inc.


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading tech solutions in startups to executing strategic initiatives in large enterprises.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: The Risk and Compliance Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our CSI Committee provides quarterly reports to the Risk and Compliance Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Risk and Compliance Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually. Additionally, the Risk and Compliance Committee of our board of directors reviews our cyber security risk profile on a regular basis. The Risk and Compliance Committee our board of directors provides a report of their activities to the full board of directors at board meetings.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: We rely on information systems to obtain, rapidly process, analyze, and manage data in order to effectively operate our business. We are committed to protecting our business information, intellectual property, customer, supplier and employee data and information systems from cybersecurity risks and maintain an active cybersecurity risk management program.

companyName: BROADWIND, INC.

ticker: BWEN


text: AMN's Privacy function, which reports up through our Chief Legal Officer, works collaboratively with the Information Security function and to create and review policies, standards and processes. In addition to updating the Audit Committee, the CIO and Senior Director, Information Security, and Privacy team provide regular updates to our Chief Executive Officer and other members of our senior management as appropriate.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer. This individual has over 29 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs (nationally and globally), as well as several relevant degrees and certifications, including a Bachelors and Master's Degree focusing in Computer Science, along with cybersecurity leadership, computer security, forensics, and technology certifications earned over the years. This management team member is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, this management team member reports to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Our Director of Cybersecurity is responsible for the strategic leadership and direction of the Company's information security organization. The individual currently serving as the Director of Cybersecurity has over twenty years of experience working in information technology. The Director of Cybersecurity receives cybersecurity alerts from the Company's third-party security operations center, and provides periodic updates to the Head of Information Technology who informs the Company's executive committee, which includes the Company's Chief Executive Officer, Chief Operating Officer and, Chief Financial Officer.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Risk Management & Strategy cyber threats have targeted the energy industry and raised our risk profile. As part of our overall risk management system, we regularly assesses our processes and practices for managing and mitigating cybersecurity risks and determine whether such risks are being effectively have implemented and invested in multiple technologies, controls, and procedures designed to protect our information systems and related infrastructure; identify, assess and remediate vulnerabilities; and monitor and mitigate the risk of data loss and other cybersecurity threats and intrusions.

companyName: Cyber App Solutions Corp.


text: For those situations where a cybersecurity threat or incident arises, whether internal to the Company or relating to one of its vendors, we have also organized an incident response team. The incident response team includes representatives from the information technology, operations, risk management, legal (including securities law counsel), privacy and finance departments, among others. In addition to meeting quarterly, the incident response team (or a subset of the team) gathers whenever there is a threatened or actual breach of the Company's information security (whether involving an external actor or an internal party) to determine the nature and extent of the threatened or actual breach and, if appropriate, the steps to take in response thereto to protect the Company's information security and mitigate any harm that has already occurred. The team is also responsible for ensuring the Company complies with legal and regulatory requirements (including notifying affected customers and regulators and making any filings required by the securities laws). The activities of our incident response team are reported to the Board's Enterprise Risk Management Committee. The Company also maintains a cyber insurance policy that provides cyber liability coverage.

companyName: RENASANT CORP

ticker: RNST


text: Cybersecurity is critical to advancing our overall objectives and enabling our digital efforts. As a company operating in the technology and software sectors, we face a wide variety of cybersecurity threats that range from common attacks such as ransomware and denial-of-service, to more advanced attacks. Our customers, suppliers and other partners face similar cybersecurity threats, and a cybersecurity incident impacting these entities could materially adversely affect our operations, performance and results. These cybersecurity threats and related risks make it imperative that we maintain focus on cybersecurity and systematic risks. Below is a discussion of our risk management and approach to governance as it relates to cybersecurity. For additional information on the impact of cyber risks, refer to Part I, Item 1A. " Risk Management and Strategy Cybersecurity

companyName: GAXOS.AI INC.

ticker: GXAI


text: A comprehensive Incident Response Plan has been developed and tested. The Plan contains information for employees to ensure they can recognize, investigate, communicate, prevent, and document an incident that threatens the confidentiality, integrity, or availability of information or systems. All incidents are reported to, and the Plan is reviewed and approved by, the Audit Committee of the Board of Directors.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: Overseeing Third-Party Risk The Company has processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Eradication—remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: AEP's CSO leads the cybersecurity and physical security teams which are responsible for the design, implementation and execution of AEP's security risk management strategy, which includes cybersecurity. AEP's cybersecurity team operates a 24/7 Cybersecurity Intelligence and Response Center responsible for monitoring the AEP System for cyber risks and threats. The cybersecurity team constantly scans the AEP System for cyber risks and threats. In addition, under the direction of the CSO, the cybersecurity team actively monitors best practices, performs penetration testing, leads response exercises and internal awareness campaigns and provides training and communication across the organization. AEP's security awareness training is mandatory for all employees and includes regular phish email testing to train employees to identify malicious emails that could put AEP at risk.

companyName: AEP Transmission Company, LLC


text: Our Vendor Risk Management ("VRM") program assesses risks from cybersecurity threats associated with our use of third-party service providers. Under this program, we perform initial risk assessments prior to selecting and engaging third-party service providers as well as ongoing risk assessments in an effort to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. The VRM program is designed to evaluate the cybersecurity and data privacy risks associated with the use of third-party vendors that will be processing, storing, or handling Bandwidth employee, business or customer data. Based on this evaluation, the VRM program records a risk rating, advises on selection or implementation recommendations, and informs contractual terms with the applicable third-party, such as privacy, security, and data protection commitments. In addition to new vendor onboarding, the VRM program includes annual review of critical service providers, ongoing assessment of expanded use cases, and evaluation of potential third-party incidents. We monitor and evaluate reports of third-party cybersecurity threats to identify and mitigate potential risks to us from third-party incidents in our supply chain.

companyName: Bandwidth Inc.

ticker: BAND


text: In the ordinary course of our business, we collect and store data, including sensitive data such as our proprietary business information and that of our customers, suppliers and business partners, information related to potential ventures and transactions, and personal information related to our employees, customers and business partners. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to process the data necessary to conduct our business. In addition, the breadth and complexity of the technologies we use continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet. We are committed to protecting the confidentiality and integrity of, and access to, our operational and information technology as well as the other systems used to conduct our business.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity, information, or data security risks and threats to our Information Systems and operations. However, our Information Systems could be disrupted, degraded, destroyed, or manipulated intentionally or accidentally by our employees, third parties with authorized access, or cyber threat actors, which could negatively and adversely impact key business processes. The size and complexity of our Information Systems, as well as those of our third-party providers, make them potentially vulnerable to such service interruptions. Additionally, we and our third-party providers have experienced and expect to continue experiencing phishing attempts, network scanning attempts, and other unauthorized access attempts to our computers, Information Systems, networks, and devices. These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including, but not limited to, state and quasi-state actors, criminal groups, hackers, and others. Such attacks could result in the loss of confidentiality, integrity, and/or availability of our data and Information Systems.

companyName: Embecta Corp.

ticker: EMBC


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Associate Director, Infrastructure Operations works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.

companyName: Kronos Bio, Inc.


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who is directly responsible for establishing cybersecurity strategies and structures and managing ongoing cybersecurity risk management activities. Our CIO is part of the executive management team, and updates our CEO and executive management on a monthly, or even more frequent, basis on cybersecurity enhancement and the development and implementation of our roadmap.

companyName: SPAR Group, Inc.

ticker: SGRP


text: We use external third parties to perform annual security assessments such as penetration testing and vulnerability scans for both our internal network and critical online systems. We currently do not have any formal processes to oversee or identify cybersecurity risks associated with third-party service providers but our Director of Information Technology generally evaluates such risks.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: We recognize that cybersecurity threats represent a significant risk to our business operations, reputation, and financial performance. To manage these risks, we maintain a comprehensive cybersecurity risk management program designed to identify, assess, mitigate, and respond to potential cybersecurity incidents.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Third-Party Cyber Risk Management Our Third-Party Cyber Risk Management Plan ensures that due diligence is carried out on third parties prior to and during engagement. Prior to engagement, third parties are assessed using a questionnaire that covers all areas of security including cyber risk and external documentation is requested such as SOC2 T2, penetration testing, and ISO 27001 certification and scope. We include security and privacy clauses within our third party contracts where applicable, which cover the implementation of security controls and self reporting. During engagement, third parties are regularly reviewed, at least annually, to ensure that cyber risks are evaluated and assessed on a continual basis.

companyName: EGAIN Corp

ticker: EGAN


text: The Company maintains cybersecurity policies, standards, and procedures, which include cyber incident response plans. These policies and procedures are continually refined to adapt to changes in regulations, identify potential and emerging security risks, and develop mitigation strategies and protocols for those risks. Regular exercises, tests, incident simulations, and system assessments are conducted to discover and address potential vulnerabilities, and improve decision-making, prioritization, monitoring, and reporting. The Company also engages external parties, such as consultants, independent assessors, computer security firms, and risk management and governance experts, to enhance its cybersecurity oversight and to identify and mitigate risks from third-party service providers.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Our executives and IT management and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats. Our executives and IT management and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our executives and IT management and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity risk management is overseen by a senior IT executive with ten years of cybersecurity experience, which includes both Fortune 500 and large semiconductor companies, and thirty-five years of experience in various technology domains, such as IT Infrastructure, Cloud, Cybersecurity, and Application Development.

companyName: MAXLINEAR, INC

ticker: MXL


text: The board of directors (the "Board"), directly and through its Risk Committee and Cybersecurity and Technology Committee (the "Cybersecurity Committee"), oversees the Company's risk management strategy and cybersecurity, data privacy, and technology risks and provides oversight of ongoing investments in cybersecurity and technology. The Company's Chief Risk Officer ("CRO") provides regular reports to the Risk Committee regarding the Company's general risks, including risks relating to cybersecurity threats, and responses thereto. The Cybersecurity Committee oversees the Company's cybersecurity, customer privacy, and technology risks and monitors the Company's strategy and progress to achieve its planned cybersecurity objectives. The CRO and Global Chief Information Security and Privacy officer ("CISO") provide quarterly updates to the Cybersecurity Committee regarding cybersecurity, data privacy, and information technology strategy and programs. In addition, both the Risk Committee and Cybersecurity Committee meet as needed outside of the normal quarterly reporting cycle to discuss particular cybersecurity issues as required.

companyName: REINSURANCE GROUP OF AMERICA INC

ticker: RGA


text: Information Security Program Access to our information systems is managed through our Identity and Access Management process, which governs the appropriate level of access for each user on an ongoing basis. Wyndham performs a certification process bi-annually to ensure the accuracy and completeness of each user's access.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. In general, the audit committee of our board of directors oversees risk management activities designed and implemented by our management, and considers specific risks, including, for example, risks associated with our strategic plan, business operations, and capital structure. Our board of directors executes its oversight responsibility for risk management both directly and through delegating oversight of certain of these risks to its committees, and our board of directors has authorized our audit committee to oversee risks from cybersecurity threats.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Additionally, our commitment to security is evident in our security awareness training for all employees, dark web monitoring, and 24x7 threat monitoring.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The director of cybersecurity (CISO) has over 30 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management, as well as cybersecurity. The director of cybersecurity (CISO) has been involved in designing and evolving Dominion Energy's cyber risk management policies, practices and procedures. This individual has deep relationships with key external partners and is recognized within the industry and the U.S. as a leading cybersecurity expert.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers and customer-facing products and applications.

companyName: Perception Capital Corp. IV


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats. Our risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Other key functions of the ISC are to align the overall security strategy with business objectives and to oversee the cataloging of cybersecurity risks and assessments. Additional review and oversight is provided by the Enterprise Risk Committee where cybersecurity risk is vetted against other risk categories. Management also maintains a Vendor Oversight Committee which governs the use of third-party vendors and assesses cybersecurity risk related to those vendors. The Enterprise Risk Committee and the Vendor Oversight Committee report their activities to the Audit Committee at least annually.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: Our cybersecurity program utilizes various risk mitigation techniques to manage cybersecurity risk, including network segmentation, deployment of enhanced detection tools, and monitoring compliance with security standards. We conduct cybersecurity risk assessments, penetration tests, purple team exercises, and data restoration testing through both internal subject matter experts and with the support of third parties to identify threats and vulnerabilities that could adversely impact our business operations. We also attempt to assess the cybersecurity risk profile of, and threats related to, our business partners, vendors and service providers through various methods including the use of attestations and certifications of their security practices. In the normal course, we engage assessors, consultants and other third parties to assist in various cyber-related matters. The underlying controls of our cybersecurity program utilize recognized practices and standards for cybersecurity and information technology security, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST Framework"). The risk-based approach of the NIST Framework enables us to design and implement cybersecurity programs that are specific to our network architectures, customer environments, and institutional resources.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: Our board of directors is responsible for oversight and risk management in genera. Our board of directors receives periodic updates from our management team regarding the overall state of our technology management strategy and any relevant risks from cybersecurity threats and cybersecurity incidents.

companyName: MAGELLAN COPPER & GOLD Corp

ticker: MAGE


text: Index to Financial Statements We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: We invest a considerable amount of resources in training, tools and other resources to manage risks from cybersecurity threats. Our cybersecurity program is led by an experienced team that creates cybersecurity policies and procedures and possesses expert knowledge related to controls and safeguards related to cybersecurity. Led by our CIO, our cybersecurity team is responsible for assessing and managing risks from cybersecurity threats. The CIO receives reports on cybersecurity threats from the cybersecurity team on an ongoing basis and in conjunction with the CSRO, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CIO and CSRO work closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: HORTON D R INC /DE/

ticker: DHI


text: External Assessments Our cybersecurity policies and procedures are periodically assessed by our external cybersecurity consultant. These assessments include a variety of activities including information security maturity assessments, penetration tests, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and its Nominating and Corporate Governance Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Xometry, Inc.

ticker: XMTR


text: See "Item 1A. Risk Factors — Risks Relating to Our Business — Technology breaches or failures, including those resulting from a malicious ransomware or cyber-attack on us or our business partners and service providers, could disrupt or otherwise negatively impact our business."

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: In addition, our intrusion detection systems identify patterns of behavior consistent with attack methods, as well as other anomalous behavior on our network. This technology acts autonomously to block activities deemed to be high risk. Our endpoint protection system is monitored twenty-four hours a day, seven days a week, by a third-party service provider who investigates every alert and remotely resolves issues such as removal of malware, blocking malicious activity, or by quarantining systems from the network if necessary.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Security is embedded into our culture, being promoted through security awareness materials, mandatory testing campaigns and the mandatory annual review and acknowledgement of corporate Security policies and standards.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: In addition, our board of directors will oversee any cybersecurity risk management framework and a dedicated committee of our board of directors or an officer appointed by our board of directors will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: Titan Environmental Solutions Inc.

ticker: TESI


text: Our cybersecurity risk management program includes risk assessments designed to help identify potentially material cybersecurity risks to our critical systems, information, products and services, as well as our broader enterprise information technology environment; an information technology security team principally responsible for managing our cybersecurity risk assessment processes, security controls and response to any cybersecurity events; the use of third party experts and service providers, where appropriate, to assess, test and otherwise assist with protecting our security environment; cybersecurity awareness training for our employees and further training for our incident response personnel and senior management; a cybersecurity incident response plan that includes procedures for assessing and coordinating our response to cybersecurity events; and a third-party risk management process for service providers, suppliers and vendors.

companyName: Avery Dennison Corp

ticker: AVY


text: We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity, and availability of our critical systems and information. While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors and senior management.

companyName: Jet.AI Inc.

ticker: JTAI


text: Our CISO, who reports to our CTO, leads the cybersecurity program, strategy, policy, standards and processes. Our CISO has over a decade of experience working in information technology and security and earned a Certified Information Security Manager (CISM) certification. Our CTO has over twenty-five years of experience working in engineering and technology. The CISO is supported by a cybersecurity team comprised of experienced information security professionals. The CISO provides the CTO with bi-weekly updates on security and compliance risks and initiatives. Each quarter, the CTO presents a cyber risk and incident review to GoHealth's internal Compliance Committee, comprised of cross-functional senior leadership members including C-suite level executives and personnel from the Legal, Compliance and Internal Audit teams.

companyName: GoHealth, Inc.

ticker: GOCO


text: For 2024, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or information technology systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, please see our risk factors titled "Our reputation and business may be harmed and we may be subject to legal claims if there is disruption to our information technology systems or loss, unlawful disclosure or misappropriation of, or unsanctioned access to, our customers', crewmembers', business partners' or our own information or other breaches of our information security" and "Data security compliance requirements could increase our costs, and any significant data breach could disrupt our operations and harm our reputation, business, results of operations and financial condition. "

companyName: JETBLUE AIRWAYS CORP

ticker: JBLU


text: Our Product and Enterprise Security team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Product and Enterprise Security regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cybersecurity incidents are escalated to our Vice President of Product and Enterprise Security, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.

companyName: ROKU, INC

ticker: ROKU


text: Blend maintains an incident response plan that is designed to contain and resolve any suspected security incident identified by the Company. This plan is tested at least annually. Our security operations team triages issues and invokes the incident response plan when necessary. This plan includes provisions for notifications of internal and external parties, including Blend leadership and the Audit Committee as required.

companyName: Blend Labs, Inc.

ticker: BLND


text: In addition, we also perform the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including internal validation and external audits, risk assessments, penetration tests, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including SOC2 reporting, SOX IT audits, and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Security Steering Committee and the Audit Committee. The Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and threat intelligence. The Company is unaware of any cybersecurity threats that have materially affected or are reasonably likely to impact it.

companyName: Matterport, Inc./DE


text: IT networks and related systems are critical to the operation of our business and essential to our ability to successfully perform day-to-day operations. We have implemented security measures and controls to mitigate risks to our IT networks and related systems, including the risks of disruption, release of confidential information, and corruption of data. This includes a variety of technological tools and systems, including both company-owned IT and technology services provided by outside parties to support our critical functions, and in particular, the following: External port penetration testing; violation report reviewed routinely for any abnormalities; employee training and testing on cyber risks; assessment, procedural review and testing in connection with cyber insurance renewals; and Routine server back-up.

companyName: Omega Flex, Inc.

ticker: OFLX


text: Our board of directors oversees our cybersecurity risk management as part of its general oversight function. We maintain security controls that are continuously reviewed to protect against emerging cyber threats. At the Company level, we employ third party consultants to lead our efforts developing, implementing and maintaining these security controls and monitoring and minimizing the risks related to cybersecurity threats. These consultants regularly report to senior management, who is responsible for keeping our board of directors apprised of all material developments. Our Vice President of Engineering is primarily responsible for the cybersecurity controls and risk mitigation with respect to the products and services we offer our customers and those in development, including satisfying the rigorous requirements needed to achieve FDA clearance when applicable. Our Vice President of Engineering reports directly to our CEO and provides senior management with periodic updates regarding cybersecurity matters concerning our products and services.

companyName: Corvex, Inc.

ticker: MOVE


text: Our Chief Information Security Officer and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our Chief Information Security Officer and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: MAXLINEAR, INC

ticker: MXL


text: Our Director of IT, along with other members of management are responsible for day-to-day cyber risk management activities, including proactively identifying, assessing, prioritizing, managing and mitigating enterprise cybersecurity risks.

companyName: DecisionPoint Systems, Inc.


text: As one of the elements of the Company's overall ERM program, the Company's cybersecurity program includes the following key areas: • Governance: As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which is regularly updated on cybersecurity matters by the Company's Chief Information Security Officer ("CISO"), other members of management, and relevant representatives from management's committees and the Company's Internal Audit function. • Collaborative Approach: The Company has implemented a comprehensive, multi-disciplinary approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments by internal and third-party experts, and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans pursuant to the NIST framework that fully address the Company's response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management: The Company has implemented a risk-based evaluation process to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory training and education for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: As a result, the Company has developed and maintains an Information Security Program ("ISP") and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program. The ISP establishes control requirements for addressing cybersecurity risks, defines stakeholder roles and responsibilities, and sets the foundation for the program's importance within the Company. We structure our ISP around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. In alignment with recommendations from NIST and other relevant industry guidelines, the Company maintains a layered cybersecurity strategy based on prevention, detection, and response/mitigation. Internal and third-party contracted technical and procedural controls include, among others, the following types: preventative (including firewalls, end-point detection and response, data loss prevention, access controls, internal/external penetration testing); detective (such as security monitoring and event management); and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. The Company administers phishing tests routinely and publishes articles and alerts on its intranet regarding common attack schemes for the employees' awareness. Information security training is also conducted annually as continuing education for all employees.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: We require appropriate third-party service providers to certify that they can implement and maintain appropriate security measures, consistent with all applicable laws, in connection with their work for us, and to promptly report any suspected breach of their security measures that may affect our Company. We oversee and identify risks from cybersecurity threats associated with our use of service providers through an onboarding vendor risk management program.

companyName: Identiv, Inc.

ticker: INVE


text: Risks from Material Cybersecurity Threats Although NTIC has taken steps to prevent and mitigate data security threats, there can be no assurance that its protective measures and those of its third party service providers will prevent or detect security breaches that could have a significant impact on NTIC's business, reputation, operating results and financial condition. NTIC maintains cyber liability insurance; however, this insurance may not be sufficient to cover the financial, legal, business or reputational losses that may result from an interruption or breach of NTIC's systems. As of the date of this filing, NTIC has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on NTIC's business strategy, results of operations or financial condition. Although NTIC has not experienced cybersecurity incidents that are individually, or in the aggregate, material, NTIC has experienced cyberattacks in the past, which NTIC believes have thus far been mitigated by preventative, detective, and responsive measures it has put in place. See the factors described in the " Part I. Item 1.A. Risk Factors " section of this Form 10-K for further detail about the cybersecurity risks NTIC faces. Maintaining a robust information security system is an ongoing priority for NTIC, and NTIC plans to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within NTIC and through its engagement of third-party service providers.

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Company's board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risks, and has not delegated oversight authority for cybersecurity risks to any committee. Our management, led by our Chief Executive Officer and Chief Financial Officer, is responsible for assessing cybersecurity risks and supervising relevant personnel with respect to our efforts and measures with the aim we have an appropriate cybersecurity strategy to assess and manage those risks, including responding to attacks or breaches. Our Chief Executive Officer and Chief Financial Officer meet periodically with the individuals charged with the day-to-day operations supervisory responsibilities including IT operations and infrastructure regarding cybersecurity to review and assess potential issues and any changes needed to be made related to our information technology system and cybersecurity measures. Cybersecurity awareness trainings are provided for all employees.

companyName: Sino Green Land Corp.

ticker: SGLA


text: The Company employs a third-party organization to conduct 24/7 monitoring of its global cybersecurity environment and to coordinate the investigation and remediation of alerts. A program for staging incident response drills is in place to prepare support teams in the event of a significant incident.

companyName: XPEL, Inc.

ticker: XPEL


text: The Audit Committee of our Board of Directors provides direct cybersecurity risk oversight. Our management provides timely disclosure and related updates to the Audit Committee regarding potential cybersecurity threats, incidents and general risks.

companyName: Rezolute, Inc.

ticker: RZLT


text: The Cybersecurity Department uses a system based on the critical security controls set forth by the Center for Internet Security, Inc. (CIS) as a benchmark and framework for its cybersecurity defenses, and has implemented cybersecurity policies and controls designed using the CIS controls framework. The Cybersecurity Department regularly implements updates and changes to its cybersecurity program to remain current and adapt to emerging cybersecurity risks; audits the cybersecurity program typically every three years; conducts targeted vulnerability testing; and assigns pertinent Company personnel as owners for governance and compliance. The Cybersecurity Department also provides cybersecurity training to Company employees.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: All employees and contractors are required to receive annual cybersecurity awareness training. New hires also receive training in response to drills and simulated attacks. We perform cybersecurity quarterly exercises to test the effectiveness of our training and discuss "lessons learned" with management to enhance user awareness and increase users' responses.

companyName: CSI Compressco LP


text: We have a cybersecurity program that focuses on implementing risk-based controls, technologies, and other processes. We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology ("NIST"), the Cybersecurity and Infrastructure Security Agency ("CISA"), and other applicable industry standards. To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape. Our cybersecurity program conforms with ISO/IEC 27001:2022 and our most recent recertification was in 2024.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Our overall information security efforts are led by the CFO and Senior Information Technology Executives. These leaders have substantial experience in cybersecurity including knowledge, skills, certifications, and background in cybersecurity.

companyName: PERRIGO Co plc

ticker: PRGO


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between the director of IT, our Adviser and Administrator and the ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE CAPITAL CORP

ticker: GLAD


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit & Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program as part of our overall enterprise risk management program.

companyName: CADIZ INC

ticker: CDZI


text: Members of our Audit Committee and Board of Directors are also encouraged to regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Members of our Audit Committee and Board of Directors continue to receive updates around the cybersecurity threat landscape and ongoing best practices as a means of continuing education in the area. Material cybersecurity threat risks are also considered during separate board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity has over 10 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: The CISO and CRO play a pivotal role in informing the Board of all cybersecurity risks. These positions provide comprehensive updates to the Enterprise Risk Committee of the Board, at least quarterly. The briefings combine a range of updates, including the cybersecurity program, emerging risks, status of operational changes, status of regulatory compliance, and risk reporting.

companyName: Dime Community Bancshares, Inc. /NY/

ticker: DCOM


text: Our Senior Director, Information Technology, in conjunction with a third party service provider, under the direction of our Chief Financial Officer, or CFO, help management identify, assess and manage our cybersecurity threats and risks. With the assistance of our Senior Director, Information Technology and third-party service provider, we identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, automated tools for ransomware and virus protection, identity verification tools aimed at ensuring authorized environment access, and ongoing vulnerability assessments.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: The Company is not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: flooidCX Corp.


text: We engage a third-party to conduct a cybersecurity risk assessment on an annual basis, which is informed by the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have established a process for our IT security team to track and quantify known IT security risks and our remediation efforts through a cybersecurity risk register. The IT security team meets periodically to review and update the cybersecurity risk register based on feedback across the organization and the findings contained in our NIST-informed annual cybersecurity risk assessment. The IT security team reports on findings on at least an annual basis to the executive leadership team and the board of directors.

companyName: Amylyx Pharmaceuticals, Inc.

ticker: AMLX


text: The Company maintains a dedicated internal cybersecurity team that is supported by internal and external software, third-party experts, and threat intelligence resources. Members of our cybersecurity team provide cybersecurity reports to our Board, SLT, and cross-functional leaders and teams. The internal cybersecurity team is responsible for implementing our cybersecurity strategy including policies, standards, architecture, and processes including our processes for identifying cybersecurity risks and threats and recommending mitigating actions to strengthen cybersecurity resilience. In addition, our internal cybersecurity team is responsible for managing detection, mitigation, and remediation of all cybersecurity incidents.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts from time to time, including cybersecurity assessors, risk management professionals, and other consultants, in evaluating and testing our risk management systems. We also engage third-party services on an ongoing basis to conduct independent audits of our risk management systems. These engagements enable us to leverage specialized knowledge and insights and assist the Company with its goal of maintaining cybersecurity strategies and processes that are consistent with industry best practices. Our collaboration with these third-parties includes table top exercises, penetration testing and other cyber-support services.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: We have no employees. Our business is externally managed by the Advisor, an affiliate of Lightstone. We are dependent on the Advisor and affiliates of Lightstone (collectively, the "Advisor and its affiliates") for performing a full range of services that are essential to us, including asset management, property management (excluding our hospitality properties, each of which are managed by an unrelated third party property manager) and acquisition, disposition and financing activities, and other general administrative responsibilities; such as tax, accounting, legal, information technology ("IT") and investor relations services. As an externally managed REIT, our risk management function, including cybersecurity, is governed by the cybersecurity policies and procedures of the Advisor and its affiliates, which determine and implement appropriate risk management processes and strategies as it relates to cybersecurity for both us and the other entities they advise, own and/or manage, and we rely on them for assessing, identifying and managing material risks to our business from cybersecurity threats.

companyName: Lightstone Value Plus REIT V, Inc.


text: The IT/IS Committee provides oversight, from a risk perspective, of information systems security. As referenced above, the CIO and ISO provide information security updates to the IT/IS Committee at each IT/IS Committee meeting. Additional information security training for the committee is provided through targeted training overseen by the ISO. In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company. The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Board of Directors. At least annually, the ISO coordinates tabletop testing events where senior management participate in a coordinated response exercise to disastrous scenarios that could happen to the Company. Cybersecurity metrics are reported to the IT/IS Committee on a monthly basis.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Cybersecurity and information privacy are important parts of our overall approach to risk management. We have documented cybersecurity policies and procedures to identify, assess and manage risks from cybersecurity threats. We believe our cybersecurity policies and procedures are reasonably designed to materially protect the security of both our data and the data in our custody. To protect our information systems, we employ various security tools supporting protection, detection and response capabilities, including anti-malware and security applications, and periodic risk analyses. We maintain a cybersecurity incident response plan to help ensure a timely, consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: Greenbrook TMS Inc.


text: Our Chief Financial Officer and key personnel provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the Board on such reports.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Our Board is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The Board receives regular reports and updates on cybersecurity matters from our management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the Board reviews and discusses with management our policies and programs with respect to cybersecurity threats.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: Information regarding cybersecurity risks is communicated through various channels, including direct discussions between key leaders and Company management, and reports to the Board of Directors and its committees. The Board of Directors regularly receives updates from our compliance officer and senior IT leadership on the status of our cybersecurity measures and any significant developments.

companyName: Outdoor Holding Co

ticker: POWW


text: Through our policies, plans, guidelines, processes and other communications, any material cybersecurity incident would have been reported to our executive officers, as well as to the Audit Committee and/or the Board of the Company, and to the Trustees of EQC LT.

companyName: EQC Liquidating Trust


text: Our information security function is led by our Vice President, Cybersecurity (our Information Security Team), and is supported by our Chief Technology Officer, our Chief Legal, Privacy and Compliance Officer and legal department, our Chief Information Officer, and our cybersecurity incident management team. Our Information Security Team is tasked with identifying, assessing and managing our cybersecurity threats and risks. It identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including: the use of manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting risk assessments, coordinating with law enforcement concerning threats, conducting internal and external audits and threat assessments for internal and external threats, obtaining third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, and tabletop incident response exercises.

companyName: TANDEM DIABETES CARE INC

ticker: TNDM


text: Our Chief Technology Officer is responsible for overseeing cybersecurity and reports to the Board of Directors twice a year on our cybersecurity tactical responses and strategic roadmap. The entire Board of Directors reviews significant cybersecurity risks and works with the Audit Committee to address these issues.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: Managing Material Cybersecurity Risks As a part of our overall risk management strategy, IT Risk conducts risk assessments on the technology environment as well as application systems implemented to support the various business functions of Hilltop based on the Gramm-Leach-Bliley Act guidance. Risks are identified from the Enterprise Risk Management and Internal Audit assessments of IT and Information Security. IT then quantifies the incidents and risks that have been identified and reports to the Operations & Strategy Committee, which is comprised of executives from across the enterprise representing disciplines including compliance, regulatory, information technology, risk, finance and operations, if they meet certain thresholds. The necessary controls are identified to address the risk and this control evaluation contributes to the assessment of the residual risk value. In 2023, additional assessments were completed utilizing the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool for the enterprise.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: The Security Advisory team is chaired by our vice president of cybersecurity and physical security who has more than twenty years of relevant experience in the field of cyber and physical security. In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers. Our vice president of cybersecurity and physical security reports to our executive vice president and chief enterprise services officer, responsible for cybersecurity, information technology, enterprise optimization and innovation, among other responsibilities. Before joining ONEOK, our executive vice president and chief enterprise services officer held information technology positions of increasing responsibility.

companyName: ONEOK INC /NEW/

ticker: OKE


text: Goldman Sachs' process for managing cybersecurity risk includes the critical components of its risk management framework, as well as the following: • Training and education, to enable Goldman Sachs employees to recognize information and cybersecurity concerns and respond accordingly; • Identity and access management, including entitlement management and production access; • Application and software security, including software change management, open source software, and backup and restoration; • Infrastructure security, including monitoring our network for known vulnerabilities and signs of unauthorized attempts to access our data and systems; • Mobile security, through the use of mobile applications; • Data security, including cryptography and encryption, database security, data erasure and media disposal; • Cloud computing, including governance and security of cloud applications, and software-as-a-service data; • Onboarding protocols; • Technology operations, including change management, incident management, capacity and resilience; and • Third-party risk management, including vendor management and governance, and cybersecurity and business resiliency diligence in vendor assessments.

companyName: Goldman Sachs BDC, Inc.

ticker: GSBD


text: Century recognizes the importance of developing, implementing, and maintaining appropriate cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Board is actively involved in oversight of Century's risk management program, and cybersecurity represents an important component of Century's overall approach to enterprise risk management ("ERM"). Century's cybersecurity policies, standards, processes and practices are based on recognized security frameworks and applicable industry standards. In general, Century seeks to address cybersecurity risks through a comprehensive approach that is focused on preserving the confidentiality, security and availability of the information that Century generates, collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: The Company has also implemented processes for overseeing and identifying risks from cybersecurity threats associated with its use of third-party service providers. For example, the Company has implemented the following: • Vendor onboarding processes including a Privacy Impact Assessment and a Cyber Security and Compliance Questionnaire; and • Enrollment of each vendor in a third-party risk monitoring tool that alerts the CISO's team should that vendor's security posture change.

companyName: CARTERS INC

ticker: CRI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President, Corporate Operations and Legal and our Director of Information Technology. Our Senior Vice President, Corporate Operations and Legal has oversight of cybersecurity and risk management, has management and oversight experience, and reports to the Chief Executive Officer. Our Director of Information Technology has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our Senior Vice President, Corporate Operations and Legal.

companyName: Kronos Bio, Inc.


text: Preparation and Prevention We utilize a variety of tools, processes, software, and hardware that are managed and monitored by our IT resources and third-party vendors, as applicable, to prevent and prepare for cybersecurity threats. We conduct regular internal and external security audits and vulnerability assessments to reduce the risk of a cybersecurity incident and we implement business continuity, contingency, and recovery plans to mitigate the impact of an incident. As part of these efforts, we engage a third party to conduct penetration testing and an external review of our vulnerabilities. We continue to strengthen access management mechanisms including broad adoption of multi-factor authentication, geolocation-based blocking, and network segmentation. To support our preparedness, we perform tabletop exercises at least once a year to test our CSIRP.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk assessment and management system incorporates risks from cybersecurity threats alongside other risks to the Company. We also have a management level risk management council that supports our processes to assess and manage cybersecurity and other risks. Our information security team oversees and implements security controls designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data, including protected health and personal information. These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication. We provide annual security awareness training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address. The security of the National Vision network is monitored by a Security Operations Center ("SOC"), which works with our information security team with the aim of preventing realization of attacks by threat actors. We also maintain an incident response plan which, among other things, is designed to mitigate the impact of an incident, assist in restoring normal business operations, comply with applicable regulatory obligations arising from an incident and prevent similar future incidents. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers. Our Chief Technology Officer ("CTO") collaborates with our information security and legal teams to conduct periodic table-top exercises and testing of our data security and incident response procedures. Periodically, we engage specialized third parties to conduct exercises that stress test our data security systems and practice company-wide response tactics. We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies and measures in collaboration with our IT vendor that are designed to address cybersecurity threats and incidents. Our IT vendor with oversight from our Chief Executive Officer, Mr. Lee, is currently responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. Our IT vendor has over 25 years of experience in information security and possesses the requisite expertise and experience expected of such an individual given our company's risk profile.

companyName: Emmaus Life Sciences, Inc.

ticker: EMMA


text: Our cybersecurity processes include: • Basic security awareness online training for personnel with company email, on an annual basis; • Phishing tests for personnel with company email, on not less than an annual basis; • Reviews of certain third-party vendors' information security programs (as discussed below); • Consultation with external advisors regarding opportunities and enhancements to strengthen our practices and policies, on an ad hoc basis; • Electronic monitoring of the majority of our technology environments to identify cybersecurity events; • Periodic assessments of existing technology hardware configurations, patches, security and lifecycle; • Periodic assessments, in consultation with software providers, of existing software versions, configurations, patches and updates; and • Periodic assessments of data management and handling, including data use and access reviews. Certain information technology general controls are reviewed and tested as part of our internal control over financial reporting.

companyName: Cronos Group Inc.

ticker: CRON


text: MGIC's Information Risk Management (IRM) team is responsible for safeguarding the organization's information assets, data, and technology infrastructure from security threats and vulnerabilities. The IRM team's primary focus is the protection of the confidentiality, integrity, and availability of sensitive information and compliance with relevant laws, regulations, and industry standards. The IRM team is overseen by the Company's Chief Information Security Officer (CISO).

companyName: MGIC INVESTMENT CORP

ticker: MTG


text: While to date, we have not experienced cybersecurity events that were individually, or in the aggregate, material, we have developed a cyber-incident response playbook that sets forth our process for responding in the event of certain defined cyber incidents. Under our response protocols, following identification of such an incident, our CIO or other members of the IT team would notify our executive team, which then would notify the Chairman of our Board of Trustees and assemble an Incident Management Team, comprised of certain defined management team members and external consultants, who collectively would assess and monitor the situation and manage internal and external communications.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: 8x8 invests in comprehensive training and awareness programs to educate employees about cybersecurity best practices and their roles in safeguarding company assets. By promoting a culture of cybersecurity awareness, 8x8 strengthens its overall security posture and reduces the risk of human error leading to cybersecurity incidents.

companyName: 8X8 INC /DE/

ticker: EGHT


text: We follow a documented risk management procedure that involves creating and monitoring remediation plans with the aim of mitigating our exposure to cybersecurity risks. Our Active Defense and Response Team ("ADRT") is designed to monitor and detect threats to our customers, platform, and our corporate environment, and provides a regular security briefing to the ISSC on relevant threat items. This information is used to escalate items to the appropriate threat level as necessary. ADRT members also regularly test the incident response capability of our information systems, using tests and exercises to determine their effectiveness.

companyName: SMARTSHEET INC


text: We believe that we have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, as well as controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee as part of its review of our ERM framework. The Audit Committee receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Information Officer and our Chief Information Security Officer at least twice per year with additional updates as requested by the Chair of the Audit Committee. In 2024, the Audit Committee received updates on information security matters at two of its regular meetings. In addition, our Chief Information Officer, our Chief Information Security Officer, other members of our information technology leadership team provided a general overview of information technology matters, including cybersecurity, in a special session with all members of our Board of Directors. In addition to information provided in these meetings, members of our Board also have access to internal and external education on cybersecurity risks. The Board also benefits from the expertise of one of our members who has significant experience in management of cybersecurity companies.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.

companyName: AVISTA CORP

ticker: AVA


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, t hat have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors- Information Systems, Cybersecurity, Data Management, and Privacy Risks".

companyName: KOHLS Corp

ticker: KSS


text: The Company's Board of Trustees recognizes the critical importance of maintaining the trust and confidence of the Company's customers, business partners, employees and other stakeholders. The Board, in coordination with the Audit Committee, is actively involved in the oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cyber risk management program is fully integrated into the Company's broader ERM program and includes cybersecurity policies, standards, processes and practices that are based on recognized frameworks and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, company-wide cyber risk program that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EPR PROPERTIES

ticker: EPR


text: We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers) to assess how cybersecurity threats could impact our business. We assess the likelihood that such threats could result in a material impact to our information assets, operations, ability to provide our goods and services, our core business functions, customer acquisition and retention, personnel, reputation and identified critical business objectives.

companyName: Cardlytics, Inc.

ticker: CDLX


text: The Information Security business unit regularly evaluates the Company's cybersecurity risk profile and reports to the Board of Directors (the "Board"). In the event that a significant cybersecurity incident is identified, the Company engages a third-party cybersecurity incident response consultant, as needed, to provide an independent evaluation of the incident.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: We seek to reduce cybersecurity risks through a variety of cybersecurity risk management activities that are designed to identify, assess, manage and mitigate cybersecurity threats.

companyName: Trio Petroleum Corp

ticker: TPET


text: Our information security and enterprise risk management function, led by our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO"), helps identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's information security risk register. The information security function helps to identify, assess, and mitigate risks from cybersecurity threats by monitoring and evaluating the relevant threat environment and the Company's security risk posture using various methods including, for example deploying manual and automated tools in certain environments and systems, subscribing to reports and services that identify certain cybersecurity threats, analyzing reports of certain cybersecurity threats and actors, conducting manual and automated scans of certain environments, evaluating our industry's risk profile, evaluating certain threats reported to us, coordinating with law enforcement concerning certain threats, conducting internal audits and threat assessments in certain environments and systems, conducting vulnerability assessments in certain environments and systems, and engaging third parties to assist with tabletop incident response exercises.

companyName: Sprinklr, Inc.

ticker: CXM


text: The Company implements a comprehensive Information Security Program ("Program") to safeguard data confidentiality, integrity, and availability. The Program leverages recognized frameworks like National Institute of Standards and Technology (or NIST) and Federal Financial Institutions Examinations Council ("FFEIC") to identify, prevent, and mitigate cybersecurity threats. Regular assessments and updates ensure the Program's effectiveness in managing and reducing risk.

companyName: California BanCorp \ CA

ticker: BCAL


text: management and strategy have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data (Information Systems and Data).

companyName: GENELUX Corp

ticker: GNLX


text: Our cybersecurity risk management program includes, but is not limited to, the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • systems for protecting information technology systems and monitoring for suspicious events, such as threat protection, firewall and anti-virus software; • cybersecurity awareness training of our employees and contractors, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, software, and vendors who access our data and/or systems.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Our audit committee, typically in joint session with the full board of directors, meets quarterly with our Senior Director of Cybersecurity and receives reports regarding our systems and data security. These cybersecurity reports to the audit committee include various information, such as updates on the cybersecurity threat landscape, risk assessments, mitigation plans, notable incidents, the status of projects to strengthen our information security systems, engagement of third parties (e.g., consultants and auditors) and third-party tools, and our employee-training programs.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: We use various tools and processes to accomplish these objectives, including policies and procedures, risk assessments, and testing. Further, we require our employees to participate in cybersecurity risk awareness trainings and phishing exercises.

companyName: Candel Therapeutics, Inc.

ticker: CADL


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal information technology environment.

companyName: NEVRO CORP


text: The Company recognizes the security of our banking operations is essential to protecting our customers, maintaining our reputation, and preserving the value of the Company. The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Enterprise Risk Management Program establishes policies and procedures for assessing the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program: Federal Financial Institutions Examination Council Cybersecurity Assessment Tools and GLB Act and regulations. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Company's Board is involved in overseeing our risk management processes and policies that may be implemented from time to time.

companyName: Actinium Pharmaceuticals, Inc.

ticker: ATNM


text: Additionally, we have specific policies and practices governing third-party security risks, including our third-party risk management (TPRM) program. Under this program, we gather information from relevant third parties to assess potential risks associated with their security controls.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, emerging threat landscape and new cyber risks, and provide updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Virpax Pharmaceuticals, Inc.

ticker: VRPX


text: Based on industry baselines and discussions throughout our membership in various global InfoSec communities, we believe that these preventative actions provide adequate measures of protection against information security breaches/incidents and reduce our cybersecurity risks. Given the evolving nature of InfoSec incidents, we regularly engage with our peers on threat intelligence and collaborate with organizations both in our industry and across industries to share best practices.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Senior management, including the Chief Executive Officer and Chief Financial Officer, are responsible for implementation of our risk management controls, including controls in connection with risks from cybersecurity threats.

companyName: Akari Therapeutics Plc

ticker: AKTX


text: Risk management, oversight and response Cyber risk management is an ongoing iterative process that requires continuous identification, assessment and management of possible cyber threats and has become a vital part of Registrant's overall risk management efforts. Registrant's cybersecurity team assesses ongoing cybersecurity threats and vulnerabilities to prioritize and implement mitigation factors and defense to help contain and combat identified risks.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: Regenerative Medical Technology Group Inc.

ticker: RMTG


text: Incidents and Risks Nuvve Holding Corp. has not experienced a material cybersecurity incident. Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology, Intellectual Property, and Infrastructure" identified in the "Risk Factors" section of Part 1 of Item 1A herein.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Executive buy in and support is a must for the success of any cybersecurity program. Crexendo C-suite executives and the Board of Directors have the primary responsibility of overseeing organizational cybersecurity and data privacy/security risk management.

companyName: Crexendo, Inc.

ticker: CXDO


text: The BancShares information security program continues to operate under heightened awareness due to industry threats and recent acquisitions. For more information regarding the risks we face from cybersecurity threats, refer to Item 1A. Risk Factors. Thus far, there have been no cybersecurity incidents that we have determined to have materially affected or to be reasonably likely to materially affect us, including with respect to our business, results of operations, or financial condition. The focus continues to be on monitoring the threat landscape and integration of entities.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Depending on the environment and system, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data including, for example: incident response plans and policies; vulnerability management policy; disaster recovery and business continuity plans; risk assessments; encryption of certain data; network security controls and data segregation for certain systems; access controls; physical security controls; asset management, tracking, and disposal; systems monitoring for certain systems; employee training; penetration testing of certain environments and cybersecurity insurance.

companyName: RAPT Therapeutics, Inc.

ticker: RAPT


text: To evaluate the progress of its activities, our ATMOS function uses various industry and regulatory frameworks as guides to assess the state of the Company's cybersecurity program maturity and controls, including our organizational, people, physical and technological controls. The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen's Cybersecurity & Digital Trust Governance Council (which includes leaders from CDT, Worldwide Compliance and Business Ethics, Regulatory Affairs, Operations, R&D, Global Commercial Operations, Corporate Audit, Law and Business Development functions).

companyName: AMGEN INC

ticker: AMGN


text: We design and assess our cybersecurity risk management program based on published frameworks, including the National Institute of Standards and Technology and routinely evaluate our program for ongoing adherence to those frameworks.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Conducting detailed threat assessments for both internal and external threats form a crucial part of our security strategy. Additionally, we leverage external intelligence feeds, integrating diverse sources of information to strengthen our overall cybersecurity posture. These concerted efforts are designed to achieve a comprehensive, dynamic, and proactive approach to managing and mitigating cybersecurity risks.

companyName: Cidara Therapeutics, Inc.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and addresses both the corporate information technology ("IT") environment and customer-facing products. The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We conduct an annual assessment of our practices and standards against the NIST CSF.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: nCino has implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage material risks. Our approach includes (i) nCino's Enterprise Risk Management Program, as managed by the Internal Audit & Enterprise Risk Management Department and overseen by the Audit Committee of the Board; (ii) cybersecurity risk and threat assessments; (iii) vulnerability management programs designed to identify hardware and software vulnerabilities; (iv) variety of tools designed to monitor our networks and systems for suspicious activity; and (v) incident response plans and trainings. The Enterprise Risk Management Program includes a cybersecurity risk management process and a formal Information Security Management System ("ISMS") as foundational components of the program covering cybersecurity. Within this process, we routinely assess risks that could affect the organization's ability to meet its business objectives and provide reliable services to our customers. nCino's Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks. nCino's CISO brings over 25 years of experience in security and risk management to the Company, reporting to executive leadership, cybersecurity-focused committees, and nCino's Board of Directors.

companyName: nCino, Inc.

ticker: NCNO


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats. These penetration tests are conducted at a random interval and target our infrastructure and certain of the products we deliver to our customers.

companyName: TEXTRON INC

ticker: TXT


text: Our information security team promptly informs our Incident Response Team of potentially material cybersecurity incidents, including with respect to our third-party service providers. The Chief Information Officer briefs our Co-Chief Executive Officers and reports to the Audit Committee of our Board (the "Audit Committee"). The Audit Committee, in turn and if necessary, briefs the Board on, among other matters, our cyber risks and threats, the status of projects to strengthen our information security systems (such as employee cybersecurity training), an assessment of the information security program, and the emerging threat landscape. The Cybersecurity and Compliance Steering Committee, comprised of senior members of management, has convened and is scheduled to convene on a quarterly basis to review all matters related to strengthening our cybersecurity posture and providing governance.

companyName: Monster Beverage Corp

ticker: MNST


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors-If we experience a significant breach of data security or disruption in our information systems, our business could be adversely affected." in this annual report on Form 10-K.

companyName: PRECIGEN, INC.

ticker: PGEN