text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Key individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report directly or indirectly to the Audit Committee on any appropriate items.

companyName: ACM Research, Inc.

ticker: ACMR


text: The Corporation uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Risk Management Committee has established risk management guidelines for third-party vendors. The Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Corporation's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Corporation may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Corporation shares with such providers.

companyName: PENNS WOODS BANCORP INC

secItem: Item 1C


text: The business continuity program is overseen by the Business and Operations Committee of the Board and includes business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Enterprise Risk Management Committee is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the Board.

companyName: Federal Home Loan Bank of Cincinnati


text: To date, risks from cybersecurity threats or incidents have not materially affected our company. However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions that we have taken and continue to take to reduce the risk of cybersecurity threats and incidents and protect our systems and information may not successfully protect against all cybersecurity threats and incidents. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.

companyName: Zivo Bioscience, Inc.

ticker: ZIVO


text: Cybersecurity Risk Management and Strategy ORIX USA has a Chief Information Officer (the "ORIX USA CIO"), who leads an information and cybersecurity team (the "ORIX USA information and cybersecurity team") responsible for managing information security at ORIX USA's asset management business, including its Cybersecurity strategy and program, which encompasses annual employee training about Cybersecurity risks and new employee onboarding about ORIX USA's security policies. The ORIX USA information and cybersecurity team's responsibilities cover three main areas: (i) operations and engineering, (ii) threat detection and response, and (iii) governance. The team comprises members with diverse and relevant skill sets and expertise. The ORIX USA CIO leads the cybersecurity team with over twenty years of experience at ORIX USA and prior experience as a principal with a large management consulting firm. This team has developed a program aligned with the NIST CSF framework, emphasizing training and development, with team members holding industry - recognized certifications complemented by industry - recognized third - party providers for threat and incident management.

companyName: BCTC V ASSIGNOR CORP


text: We have a unified and centrally-coordinated team, led by our Senior Vice President of Corporate Quality and IT, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Globus in close coordination with senior leadership and other teams across Globus. Reporting to our Senior Vice president of Corporate Quality and IT are a number of trained information security professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying and managing cybersecurity risks.

companyName: GLOBUS MEDICAL INC

ticker: GMED


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes are integrated into the Company's overall risk management systems. These processes also include overseeing and identifying risks from cybersecurity threats associated with the use of third-party service providers. The Company has established monitoring procedures in its effort to mitigate risks related to data breaches or other security incidents originating from third parties. The Company, from time-to-time, may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate.

companyName: Green Thumb Industries Inc.

ticker: GTBIF


text: Our security teams have established procedures for identifying, assessing, and managing, cybersecurity incidents. A cross-functional working group of security, privacy, and legal personnel review potentially significant incidents. If an incident could be deemed material, it is escalated, and we consult with outside counsel as appropriate.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Detection, Mitigation and Remediation The Bank has implemented automated systems designed to detect potential malware and anomalies, and notify management of threats. These systems include anti-virus/anti-malware, network log reporting, network-based intrusion detection and incident response systems, external firewall intrusion detection and prevention systems, endpoint protection, and data leakage protection. Anti-virus/anti-malware systems are designed to be updated as needed and definitions are distributed to Bank computers.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: As of the date of this 2024 Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, its business strategy, results of operations or financial condition; however, we cannot provide assurance that these threats will not result in such an impact in the future, as discussed in the risk factors entitled "Risks Related to Our Business" and "Risks Related to Our Intellectual Property and Technology" in Part I, Item 1A. of this 2024 Annual Report on Form 10-K. GoHealth, Inc.

companyName: GoHealth, Inc.

ticker: GOCO


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the Investment Company Act, our day-to-day operations are managed by the Investment Adviser, Administrator and our executive officers under the oversight of our Board of Directors. Our executive officers are senior professionals of the Investment Adviser. We obtain our cybersecurity program-related services as part of a larger set of services provided to the parent company of our Investment Adviser by JFG under written agreement. As such, we rely on JFG's information systems infrastructure and JFG's processes for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details JFG has provided to us regarding its cybersecurity program.

companyName: Senior Credit Investments, LLC


text: We do not have a dedicated security team, but our Chief Executive Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the Board. Our dedicated CEO has over 20 years of experience in managing and monitoring cybersecurity.

companyName: TPT GLOBAL TECH, INC.


text: The Senior Information Security Officer, Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program. The Director of IT and Director of Information Services report to the Chief Administrative Officer and are responsible for designing and maintaining the company's network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence. The Senior Information Security Officer (ISO) reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities. The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.

companyName: SIERRA BANCORP

ticker: BSRR


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, and personal information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein.

companyName: BIOVIE INC.

ticker: BIVI


text: The Cybersecurity Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Cybersecurity Committee meets regularly during the year and discusses cyber-related industry events, critical cyber incidents, alignment with our information security framework, threat assessment, security capabilities, response readiness and training efforts. A third-party cyber security firm also advises the Cybersecurity Committee on cybersecurity threats, trends in the industry, and best practices. This third party also evaluates and assesses our programs. The Cybersecurity Committee conducts an ongoing review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, planned actions in the event of a response or recovery situation, as well as a review of recent enhancements to the Company's security detection and response capabilities, and management's progress on its cybersecurity strategic roadmap. The Cybersecurity team also subscribes various threat intelligence services to evaluate our security strategy or defense mechanism against such threats.

companyName: HASBRO, INC.

ticker: HAS


text: We have established controls and procedures to escalate enterprise level issues, including cybersecurity matters, to the appropriate management levels within our organization and our Board of Directors, or members or committees thereof, as appropriate. Under our framework, cybersecurity issues, including those involving vulnerabilities introduced by our use of third-party software, are analyzed by subject matter experts, including a crisis committee as needed in accordance with our incident response plans, for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to our financial results, operations, and/or reputation are immediately reported by management to the Board of Directors, or individual members or committees thereof, as appropriate, in accordance with our established escalation framework. In addition, we have established procedures to help ensure that members of management responsible for overseeing the effectiveness of disclosure controls are informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made, as appropriate.

companyName: BOSTON SCIENTIFIC CORP

ticker: BSX


text: We believe our cybersecurity team, led by our CISO, has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats. Our CISO is a credentialed and industry-recognized security executive with over 20 years' experience in healthcare, government and the private sector implementing enterprise cybersecurity and privacy programs, building high performing teams, creating a risk-aware culture, managing cybersecurity incidents, and communicating cyber risks to boards of directors. He holds a Master degree in Computer Engineering and has obtained certifications, including Certified Information Security Manager and Certified Information Systems Security Professional. Prior to joining Burlington, the CISO served as the CISO at Hospital for Special Surgery for 6 years and as a CISO at NYC Health+Hospitals for 4 years. Our CISO reports to our CIO, who has more than 25 years of information technology leadership experience. Together our CIO and CISO have decades of leadership experience in information technology, cybersecurity and retail.

companyName: Burlington Stores, Inc.

ticker: BURL


text: Engage Third-parties on Risk Management Due to the complexity and evolving nature of cybersecurity threats, we engaged with a cybersecurity assessment firm as an external expert, to evaluate and test our risk management systems. This partnership enables us to leverage specialized knowledge and insights, of dedicated cybersecurity firms. Our collaborations with this third-party include regular system audits, threat assessments, 24-hour monitoring, and consultation on security enhancements.

companyName: SAB Biotherapeutics, Inc.

ticker: SABS


text: In an effort to deter and detect cyber threats, we periodically provide all full- and part-time employees with a data privacy, cybersecurity, and incident response training and compliance program, which covers timely and relevant topics, including phishing, malware, password security, confidential data protection, asset use and mobile security, and educates all employees on the importance of reporting all incidents immediately to the company's dedicated Incident Management Team. We also use technology-based tools to mitigate cybersecurity risks to bolster our employee based cybersecurity programs.

companyName: TechTarget Holdings Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, reviews of vendor's written security program and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: As of the date of this report, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our results of operations or financial condition.

companyName: American Clean Resources Group, Inc.

ticker: ACRG


text: Board, in coordination with the Adviser, oversees the Company's risk management program, including the management of cybersecurity threats. The Board receives regular updates and reports on developments in the cybersecurity space, including risk management practices, recent developments, vulnerability assessments, third-party and independent reviews, the threat environment, and information security issues encountered by the Company'. The Board also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Board and the Adviser discuss the Company's approach to overseeing cybersecurity threats.

companyName: Kayne DL 2021, Inc.


text: Employees are required to complete a cybersecurity training at least once a year specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings. We have a set of policies and procedures addressing information security concerns governed by the Written Information Security Program (WISP) framework, other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices. These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee. We currently maintain a System and Organization Controls ("SOC") Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the U.S. and U.K. Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 framework.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: When a potential incident is detected, the cybersecurity team validates it before escalating to the incident response team for triage. Significant incidents are escalated to executive management. Response actions such as allocating resources, setting priorities, creating action plans, and notifying external parties are directed by the Chief Executive Officer in coordination with the cross-functional working group. We also consult outside counsel on materiality assessments and disclosure decisions, with executive management making the final determinations.

companyName: Advanced Biomed Inc.

ticker: ADVB


text: A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage third-party experts, including cybersecurity consultants, to evaluate and support our risk management systems. We also rely on software support from third-party vendors to assist with evaluating, monitoring, and testing our information technology systems. These relationships enable us to leverage specialized knowledge and insights, to help ensure our cybersecurity strategies and processes remain effective. Our collaboration with these third parties includes regular audits, routine system monitoring, threat assessments, and consultation on potential security enhancements. We require third-party service providers with access to personal, confidential, or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Notwithstanding the vigorous approach we take to cybersecurity, we may not always be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. To date, we have not identified cybersecurity risks, threats, or incidents that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.

companyName: ICF International, Inc.

ticker: ICFI


text: o our Internal Audit Department, which monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment;

companyName: EASTMAN KODAK CO

ticker: KODK


text: We have established policies and processes for identifying, assessing, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. We design and are assessing our cybersecurity risk management program based on the ISO 27001:2022 standard, for which we received certification in 2024. We use the ISO 27001:2022 framework as a structure to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Merus N.V.


text: Incident Response Plans Visa's global cyber security incident response team provides monitoring of Visa networks and digital assets across three cyber fusion centers in the U.S., United Kingdom, and Singapore. In addition, Visa's threat intelligence and research teams monitor commercial and government intelligence sources for new and emerging threats. Our cybersecurity awareness team regularly publishes and shares information with Visa employees on emerging threats, such as deepfake and generative AI-powered social engineering schemes.

companyName: VISA INC.

ticker: V


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity incident that has materially impacted our business or operations, there can be no guarantee that we will not experience such a threat or incident in the future. A material cybersecurity threat or incident could adversely impact our operations, our sales or financial and administrative functions, or result in the compromise of personal or other confidential information of our employees, customers, or suppliers. For this reason, we maintain cybersecurity liability insurance to provide additional support, expertise, and resources to help ensure the integrity of our cybersecurity processes and to provide a level of financial protection in the event of cybersecurity incident related costs and losses.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: Cybersecurity risks, both internal and from third parties, are tracked regularly. We have established plans and procedures to guide us through an active threat or incident in order to return to normal business operations. We have developed a notification process to allow for real-time escalation of material cybersecurity incidents by and among members of our Corporate IT Security Team ("CIST").

companyName: MOOG INC.

ticker: MOG-A


text: Social Engineering: Social engineering tactics involve manipulating individuals into divulging confidential information or performing actions that compromise security, often through psychological manipulation or deception. International Seaways, Inc.

companyName: International Seaways, Inc.

ticker: INSW


text: Within management, the Group's Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats on a day-to-day basis and keep the senior executive officers informed on a regular basis of the identification, assessment, and management of cybersecurity risks and of any cybersecurity incidents. Such management personnel have prior experience and training in managing information systems and cybersecurity matters and participate in ongoing training programs.

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: Operational Information Technology and Information Security staff members, and third-party service providers utilize the direction and resources provided by the senior management team to develop procedures, standards, and guidelines to achieve the strategic goals defined by the Board of Directors. Operational and security health is reported monthly to Operating Risk and Executive Committees and the Board of Directors. Recommendations for improvements are shared between operational staff and the senior management team as part of a continuous improvement program for information security and cybersecurity.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We also have a cybersecurity specific risk assessment process, which helps identify residual risk from cybersecurity threats. Our risk assessments include the identification of reasonably foreseeable internal and external information security and cybersecurity risks, the likelihood that such events may occur and the impact or potential damage that could result from such risks. The assessments examine the adequacy of our policies, procedures, systems, and the safeguards in place to manage and mitigate the identified risks. The impact of these assessments is the refinement of existing safeguards and the implementation of new safeguards to improve our cybersecurity protections; reasonably address any identified gaps in existing safeguards; and ensure that we regularly monitor the effectiveness of those safeguards.

companyName: Talkspace, Inc.

ticker: TALK


text: We recognize the importance of maintaining the trust and confidence of our customers, clients, business partners and employees. Cybersecurity represents an important component of our overall approach to risk management. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials, employees and contractors, or Information Systems and Data.

companyName: Cidara Therapeutics, Inc.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibility for enterprise cybersecurity risks. The Audit Committee also considers enterprise cybersecurity risks in connection with its financial and compliance risk oversight role. The Chief Financial Officer regularly reports to the Board of Directors on the status of the Company's cybersecurity program and provides the Board of Directors with the annual assessment by a third party on the Company's cybersecurity program. Cybersecurity risks are also included with the Company's annual business risk assessment which is provided to the Board of Directors.

companyName: Vuzix Corp

ticker: VUZI


text: We have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats, and have integrated these processes into our overall risk management systems and practices. We routinely assess material risks from cybersecurity threats, including any potential unauthorized attack on, or use of, our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information stored therein.

companyName: Bally's Corp

ticker: BALY


text: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting software companies. All companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. We have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Paysign, Inc.

ticker: PAYS


text: In designing and evaluating our cybersecurity initiatives, we have adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0) as a guiding principle. It's important to clarify that our use of the NIST CSF 2.0 is for guidance purposes to frame our risk identification, assessment, and management processes and does not equate to compliance with any specific technical standards or requirements.

companyName: GridAI Technologies Corp.

ticker: GRDX


text: We will continue to mitigate risks by employing physical, administrative and technical measures including employee training, logical access controls, monitoring and testing, and maintenance of protective systems and contingency plans but remain potentially vulnerable to additional known or unknown cybersecurity threats and cannot be assured that the impact from such threats will not be material.

companyName: PROCYON CORP


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Third-Party Assessments - Coordinating, reviewing and analyzing third-party providers' assessments of the Cybersecurity Program. Internal Audit may also perform a periodic cybersecurity program audit that may be supported by external consulting firms. Third-Party Service Provider Reviews – Identifying and reviewing material risks from cybersecurity threats associated with certain third-party service providers.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: When we experience a cybersecurity incident, our Chief Information Security Officer or Chief Information Officer will inform our Senior Leadership and/or the Board of Directors, Computer Security Incident Response Team, which will then evaluate and assess the nature and materiality of the incident to the Company, in general, its information technology infrastructure and data integrity, and whether the cybersecurity incident should be reported to the Board of Directors in advance of or external to the next regular cybersecurity update. Once a cybersecurity incident is reported to the Board of Directors, the Board of Directors, with the input of the Chief Information Security Officer and Chief Information Officer, will determine how to address it.

companyName: Red Rock Resorts, Inc.

ticker: RRR


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition While Peabody has experienced cybersecurity incidents in the past, to date none have materially affected the Company's business strategy, results of operations or financial condition. Peabody continues to invest in the cybersecurity and resiliency of its networks and to enhance its internal controls and processes, which are designed to help protect its systems and infrastructure, and the information they contain. For more information regarding the risks the Company faces from cybersecurity threats, refer to Item 1A. "Risk Factors."

companyName: PEABODY ENERGY CORP

ticker: BTU


text: We are subject to an evolving threat landscape that could pose various risks to our business, and such risks are regularly evaluated and managed via our Cybersecurity and Privacy Programs by internal and external experts. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. For more information regarding risks related to cybersecurity matters, please see Part I, Item 1A, "Risk Factors—We depend on our information technology systems, and those of our third-party vendors, contractors and consultants, and any failure or significant disruptions of these systems, security breaches or loss of data could materially adversely affect our business, financial condition and results of operations."

companyName: GoodRx Holdings, Inc.

ticker: GDRX


text: A team comprised of IT personnel responsible for directing ( 1) our cybersecurity risk assessment processes; ( 2) our security controls; and ( 3) our response to cybersecurity incidents;

companyName: CYANOTECH CORP

ticker: CYAN


text: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA). Personnel from the MSSP hold several certifications, including but not limited to: Certified Information Systems Security Professional ("CISSP"); ITIL Foundations; Fortinet Certified Network Security Administration and Professional; Microsoft Certified IT Professional, Technology Specialist, Solutions Associate; and Citrix Certified Administrator/Citrix Presentation Server 4.0. The external risk advisory and accounting firms that we use to perform our audits and assessments described above utilize personnel qualified as one or more of the following to perform our audits and assessments: Certified Information Systems Auditor (CISA), CISSP, Certified Information Security Manager (CISM), and Certified Information Technology Professional (CITP).

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Risks from Cybersecurity Incidents The Partnership has not encountered, to its knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our business strategy, operations, or financial condition. There can be no assurance that such effects may not occur in the future.

companyName: Greystone Housing Impact Investors LP

ticker: GHI


text: Our and John Deere's cybersecurity program is designed to identify, protect, detect, respond to, and recover from cybersecurity threats and incidents with the goal of protecting the confidentiality, integrity, and availability of our critical systems and information. We use a risk-based, multi-layered information security strategy to assess, identify, and manage risks from cybersecurity threats. The Cybersecurity Team meets frequently to monitor, assess, and address cybersecurity threats and incidents. John Deere and we also work with third parties to assess the maturity of our cybersecurity program, leveraging the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF).

companyName: DEERE JOHN CAPITAL CORP


text: Notwithstanding our Cybersecurity Program as described above, we cannot anticipate, detect, repel or implement fully effective preventative measures against all cybersecurity threats, particularly because the techniques used are increasingly sophisticated and constantly evolving. Like many companies, we have encountered intrusions and attempts to gain unauthorized access to our IT systems or other attacks and incidents, and we have had third-party service providers who have encountered intrusions. However, during fiscal 2024, we did not identify any risks from cybersecurity threats that materially affected or are reasonably anticipated to materially affect our business strategy, results of operations or financial condition. For additional information about the cybersecurity risks we face, including how such risks could affect us in the future, see Part I, Item 1A, "Risk Factors" in this Annual Report, including the Risk Factors titled "Our business and operations could suffer in the event of security breaches of our IT systems, or other misappropriation of our technology, intellectual property or other proprietary or confidential information" and "Failures in our products, or in the products of our customers or licensees, including those resulting from security vulnerabilities, defects or errors, could harm our business."

companyName: QUALCOMM INC/DE

ticker: QCOM


text: Farmer Mac's risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of Farmer Mac's security controls. Prior cybersecurity incidents have not materially affected Farmer Mac's business strategy, results of operations, or financial condition. Farmer Mac does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect its business strategy, results of operations, or financial condition, although the occurrence of both intentional and unintentional incidents could cause a variety of adverse business impacts in the future. For more information on Farmer's Mac's cybersecurity risks see "Operational Risks" in "Risk Factors" in Part I, Item 1A of this report. Those disclosures are incorporated by reference in this section.

companyName: FEDERAL AGRICULTURAL MORTGAGE CORP

ticker: AGM


text: Cybersecurity risk management is led by our VP of Information Security and our SVP of Information Technology, who reports to our Chief Operating Officer, who are generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems and data. The VP of Information Security manages a team of cybersecurity professionals with broad experience, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, digital security and regulatory compliance.

companyName: SKECHERS USA INC


text: The Company recognizes the importance of maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our information security framework leverages information and guidance from external sources and is managed by an internal team, led by the Cybersecurity Manager. This team provides updates on the overall effectiveness of the cybersecurity framework, including information on cyber threats and incidents, to the Information Services leadership team consisting of the Executive Vice President ("EVP") - Global Business & Information Services, Vice President ("VP") Information Services, and Senior Director of Information Technology Operations and Governance. We take a multi-layered, risk-based approach to our security controls to prevent, detect, and respond to cybersecurity threats. Our capabilities, processes, and security measures include, and are not limited to: • reactive endpoint protection to detect and prevent virus and malware threats; • network perimeter firewalls, including malware prevention; • e-mail scanning to prevent spam and phishing campaigns; • vulnerability scanning and remediation of vulnerabilities based on priority; • logical access controls, including multi-factor authentication; • incident response procedures; and • disaster recovery protocols.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: In addition, our cybersecurity framework is meticulously crafted to anticipate and address threats before they can cause harm. We are vigilant in monitoring the ever-changing threat landscape, drawing on intelligence from a multitude of sources to remain at the forefront of potential vulnerabilities. Our Security Operations Center (SOC) is operational 24/7, utilizing cutting-edge threat detection tools that meet SOCII requirements, guaranteeing an immediate response capability. We implement stringent access control policies to ensure that only authorized individuals can interact with sensitive client data. Our Identity and Access Management (IAM) systems conform to ISO/IEC 27001 standards, offering secure authentication processes that encompass multi-factor authentication (MFA) and role-based access controls (RBAC). These safeguards are essential in preserving the integrity and confidentiality of client information. By employing Randtronics remote encryption technology, we provide top-tier security for client data, whether it's in use or at rest. This leading-edge encryption solution surpasses industry benchmarks, delivering robust protection without compromising system performance. We regularly evaluate and refine our encryption protocols to thwart new cryptographic challenges. A third party-organization conducts frequent security audits to maintain unwavering compliance with legal and regulatory mandates such as GDPR, HIPAA, and CCPA. These audits are a cornerstone of our cyber risk management program, embracing established best practices and standards in cybersecurity and information technology. Our comprehensive policies cover various aspects including information security, access on/offboarding, and account management, directing the protective measures our management team implements to shield IT assets, data, and services from threats and vulnerabilities.

companyName: OLENOX INDUSTRIES INC.

ticker: OLOX


text: Our Board oversees the risks involved in our operations as part of its general oversight function, integrating risk management into the Company's compliance policies and procedures. With respect to cybersecurity, the Board has the ultimate oversight responsibility, with the Audit Committee and HSE & Technical Committee of the Board each having certain responsibilities relating to risk management of cybersecurity.

companyName: UR-ENERGY INC

ticker: URG


text: Information relating to risks from cybersecurity threats is included in this report in Item 1A under the caption " Cybersecurity breaches or other failures in our information technology systems could disrupt our business." Our cybersecurity risk management program is designed to evaluate material threats and vulnerabilities throughout the organization and their potential impact on our operations, data, and stakeholders. Our program is reviewed and updated regularly to address emerging risks, following the NIST Cybersecurity Framework, NIST Risk Management Framework, and CIS Top 18 Security Controls.

companyName: UFP INDUSTRIES INC

ticker: UFPI


text: the periodic use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; cybersecurity awareness training; and a cybersecurity incident response plan to respond to cybersecurity incidents.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: Christos Ruci, the Company's CIO, is the member of the Company's management team primarily responsible for assessing, monitoring and managing the Company cybersecurity program. Mr. Ruci has over 20 years of experience in the field of technology and security including extensive experience as an enterprise CIO, as well as consulting experience advising organizations on their technology and risk profiles. The Company believes Mr. Ruci's in-depth knowledge and experience are instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system. This means that if any business unit's systems are compromised, there is significantly less risk that another business unit will be impacted by that event. This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.

companyName: AMPHENOL CORP /DE/

ticker: APH


text: The Chief Information Officer is regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. As discussed above, our information systems are routinely reviewed for compliance with information security policies and standards. Outcomes of reviews and audits are reported to the Director of IT Security, Vice President of IT and Information Security, and the Chief Information Officer. Relevant information about security nonconformities, incidents, and events are reported to the working group described below and to the Board of Directors. As discussed above, the Chief Information Officer and Vice President of IT and Information Security report to the audit committee and the Board of Directors on cybersecurity matters at least quarterly.

companyName: Paycom Software, Inc.

ticker: PAYC


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program addresses cybersecurity risks to the corporate information technology ("IT") environment including systems, hardware, software, data, people, and processes.

companyName: Arena Group Holdings, Inc.

ticker: AREN


text: In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Risks Related to our Business" in this Annual Report on Form 10-k.

companyName: OLYMPIC STEEL INC

ticker: ZEUS


text: We have a Security Operations Center operating in multiple regions that provides daily monitoring of our global cybersecurity environment and coordinates real-time investigation and remediation of alerts. Identifying and assessing cybersecurity risks related to our business, operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT/OT security, governance, risk and compliance reviews. To deter, detect and respond to cybersecurity incidents, we conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and consultants, and conduct tabletop exercises to simulate responses to cybersecurity incidents. We also conduct and require our workforce to complete ongoing cybersecurity awareness education and training. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the company, and form detection, mitigation and remediation strategies.

companyName: TIDEWATER INC

ticker: TDW


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Head of Security, Privacy Officer, Chief Operations Officer, Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Our Head of Security is a senior information security professional with more than 20 years of experience implementing and leading security programs. Our Head of Security holds an undergraduate degree in computer science, has a Six Sigma certification in Total Quality Management and is a Certified Information Systems Security Professional ("CISSP").

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: As part of the Company's overall risk management, the Company has adopted processes designed to assess, identify and manage material risks from cybersecurity threats. Our program has been designed and evaluated based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use NIST CSF as a guide to identify, assess, and manage cybersecurity risks relevant to our business. The cybersecurity risk management program includes, among other things, processes to manage risks associated with third party service providers, regular review and testing of the Company's cybersecurity practices through audits, internal assessments and tabletop exercises, and mandatory annual cybersecurity awareness training for all employees. In addition, the Company has adopted an incident response plan establishing the processes for responding to any cybersecurity incident. The Company periodically engages third party cybersecurity firms to perform maturity assessments of our cybersecurity risk management program, the results of which are reported to the Board.

companyName: IES Holdings, Inc.

ticker: IESC


text: To identify, assess and manage cybersecurity risks, we maintain an IT security/cybersecurity program (Cybersecurity Program) that is informed in part by international frameworks as well as our specific security requirements and cybersecurity risk profile. We have implemented policies, procedures, processes and administrative, physical and technical controls designed to protect, defend and mitigate effects to us from cybersecurity threats and incidents. For example, we provide recurring employee cybersecurity training to help our employees better understand cybersecurity threats, our policies, actions and approach to managing this type of risk and how they can help increase our security posture.


text: We engage assessors, consultants, auditors, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: PACIFIC BIOSCIENCES OF CALIFORNIA, INC.

ticker: PACB


text: • The CEO of Duke Energy has over 20 years of experience in the utilities industry, and has gained cybersecurity experience as CEO of one of America's largest utility companies, and through service on the board of the Edison Electric Institute, the Institute of Nuclear Power Operations, the World Association of Nuclear Operators, and past service on the Department of Homeland Security Advisory Council. • The EVP and Chief Financial Officer of Duke Energy (CFO) previously served as the Company's Chief Transformation and Administrative Officer and led the Company's business transformation through digital innovation, new ways of working and process redesign. In this role, the CFO gained an in-depth understanding of the Company's cybersecurity procedures and key threats, and was responsible for the enterprise business services and technology team, including the information and technology organization. • The EVP, Chief Generation Officer and Enterprise Operational Excellence of Duke Energy has gained cybersecurity experience through being responsible for the safe, efficient and reliable operation of Duke Energy's fleet of nuclear, natural gas, hydro, solar and coal units.

companyName: PROGRESS ENERGY INC


text: Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture. Pursuant to its charter, the Audit Committee of our Board of Directors is responsible for reviewing management's cybersecurity incident reporting process, methodology and tools. In addition, the Audit Committee is responsible for reviewing management's materiality assessments of cybersecurity incidents identified as significant by management.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Management has determined that no cybersecurity incidents that we have experienced to date have resulted in, or are reasonably likely to result in, a material impact to its financial condition, results of operations, or business strategy. For additional information on risks from cybersecurity threats and potential related impacts on the Company, please see Item 1A – Risk Factors.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We are subject to cyber-security risks, including risks related to customer, employee, vendor, and other company data" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: SMITH & WESSON BRANDS, INC.

ticker: SWBI


text: Markel Group is a holding company comprised of a diverse group of businesses and investments. Our specialty insurance business, which operates under the name Markel, sits at the core of our company. Markel Group also owns controlling interests in businesses that operate in a variety of other industries. We refer to this group of businesses as Markel Ventures. Each of our businesses is independently managed with respect to their information security and data protection programs.

companyName: MARKEL GROUP INC.

ticker: MKL


text: The Adviser employs a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors. This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.

companyName: BGO Industrial Real Estate Income Trust, Inc.


text: No risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, our business strategy, results of operations or financial condition. However, we can provide no assurance that we will not experience any material cybersecurity threats or incidents in the future. See "Item 1.A. Risk Factors — Cybersecurity failures and data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential, personal or other sensitive information and/or damage to our business relationships or reputation, any of which could negatively impact our business, financial condition and operating results."

companyName: BROOKFIELD REAL ESTATE INCOME TRUST INC.


text: Our cybersecurity program also addresses risks associated with third-party service providers who may access or integrate with our systems and data. Our processes include having such third parties complete a cybersecurity questionnaire, agree to appropriate contractual obligations and provide annual evidence of their compliance where applicable.

companyName: Life Time Group Holdings, Inc.

ticker: LTH


text: The internal body with executive oversight of our cybersecurity program is our Privacy and Information Security Steering Committee ("PISSC"), which applies a multidisciplinary framework to cybersecurity risks and risk assessment by integrating information security, privacy and human resources expertise, oversight and reporting. The PISSC is made up of our Privacy Officer, Chief Operations Officer (who is also acting as head of our security team), Chief Financial Officer, General Counsel and Chief People Officer and meets on a quarterly basis. Julie Rubinstein, who serves as our Chief Operations Officer, is leading our security team on an interim basis and is supported by a fractional chief information security officer.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, and violation of data privacy or security laws.

companyName: Toughbuilt Industries, Inc


text: Our information technology team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IT personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal IT environment.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: We rely heavily on information technology systems to operate and manage all key aspects of our business. We also process substantial volumes of confidential business information and sensitive consumer and employee personal information, which if impacted by cyber threats could result in financial and reputational harms and regulatory sanction. We have developed and implemented, and update on an ongoing basis, a risk-based information security program designed to identify, assess and manage material risks from cybersecurity threats.

companyName: BEST BUY CO INC

ticker: BBY


text: The Company collaborates with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks.

companyName: Revance Therapeutics, Inc.


text: We have implemented a third-party risk program to oversee and manage information security and privacy risks associated with third-party relationships. The program includes the assessment of third parties that provide key services or will access, store, process, or transmit sensitive information during initial onboarding and throughout the lifecycle of the relationship, and management of applicable contractual requirements relating to confidentiality, integrity, availability and privacy obligations, including timely notification of incidents. Third-party services related to advice, assessments, auditing, testing and support related to cybersecurity and information technology processes and services, where appropriate, are also subject to the third-party risk program.

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2023, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors – Risks Related to Information Technology and Cybersecurity" for more information on the Company's cybersecurity-related risks. Governance.

companyName: SONOCO PRODUCTS CO

ticker: SON


text: Cybersecurity is an important and integrated part of the Company's enterprise risk management function that identifies, monitors, and mitigates business, operational, and legal risks.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: GoHealth engages with a range of additional third-party cybersecurity service providers, assessors and auditors to evaluate and enhance the effectiveness of its cybersecurity program. Services provided by these third parties include endpoint and network monitoring, vulnerability scanning, penetration testing and security and compliance posture assessments. To mitigate risks associated with third-party sources, the Company requires third parties with access to personal, confidential or proprietary information to implement and maintain cybersecurity practices consistent with applicable legal standards and industry best practices and to enter into business associate agreements containing contractual provisions with respect to the handling of such information. GoHealth also conducts risk-based information security assessments of these third parties prior to engaging with them.

companyName: GoHealth, Inc.

ticker: GOCO


text: In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include: • Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches. • Ensuring that changes to security configurations are documented, approved, and tested. • Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs. • Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities. • Conducting subsequent penetration testing and vulnerability assessments, as warranted. • Reviewing performance with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Company.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: Additionally, we rely on the Investment Manager to utilize third parties to conduct periodic cybersecurity assessments, including assessments impacting the Company, and the Investment Manager's internal audit function includes certain cyber risk audits as part of any overall risk audit. We rely on the Investment Manager to review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate and as may be relevant to the Company. The Investment Manager's cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. Our cybersecurity programs are built on operations and compliance foundations. Operations focus on continuous detection, prevention, measurement, analysis, and response to cybersecurity alerts and incidents and on emerging threats. Compliance establishes oversight of our cybersecurity programs by creating risk-based controls to protect the integrity, confidentiality, accessibility, and availability of company data stored, processed, or transferred. Our cybersecurity program is integrated within our overall risk management processes.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We rely on information technology and data to operate our business and develop, market, and deliver our therapies to our customers. We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third party hosted services, communications systems, hardware, lab equipment, software, and our critical data includes confidential, personal, proprietary, and sensitive data (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business. Our general risk management strategy is designed to manage identified material risks, which would include material cybersecurity risks.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: We regularly review our Incident Response Plans to ensure readiness if and when an incident does occur. In the event of a cybersecurity incident, if a system does become non-operational, we maintain disaster recovery capabilities to return to normal operation in a timely manner.

companyName: FARMER BROTHERS CO

ticker: FARM


text: Engage Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity insurers, assessors, consultants and auditors in evaluating and assessing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments and consultation on security enhancements.

companyName: Orion Group Holdings Inc

ticker: ORN


text: We leverage certain third-party providers to support our security event monitoring. In addition, certain third parties support our vendor security due diligence process. We may retain assessors, consultants, auditors, etc. to assist in the development/creation/monitoring of those processes for assessing, identifying, and managing cybersecurity incident risk.

companyName: Federal Home Loan Bank of Indianapolis


text: We regularly engage outside consultants and experts to assist us regarding our cybersecurity program. Engagements include an annual NIST Cybersecurity Framework assessment to ensure a reasonable cybersecurity program and retained leading external cybersecurity Incident Response (IR) experts.

companyName: BLACKBAUD INC

ticker: BLKB


text: We assess, identify and manage the material risks from cybersecurity threats relevant to our businesses through robust programs, including enterprise risk management ("ERM"), our risk assessment process ("RAP") and our cybersecurity program. To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.

companyName: Vontier Corp

ticker: VNT


text: Notification to relevant stakeholders, including officers, board members, investors and customers where appropriate, in compliance with legal and regulatory requirements. Cooperation with law enforcement and regulatory bodies as needed. Post-incident analysis and measures to prevent future occurrences.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. In determining the level of response, we have identified four general classification levels for incidents. Incident and risk event levels each vary from no (or low) risk to high risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., FDIC, FinCEN, SEC), authorities (e.g., F.B.I., Department of Justice), customers, third parties or internal personnel.

companyName: CapStar Financial Holdings, Inc.


text: Annually, employees receive cybersecurity training, and we provide additional targeted cybersecurity awareness and education activities throughout the year. In partnership with external consultants, we periodically conduct "tabletop" exercises with management, our Board and members of our Information Security, Information Technology, and Privacy teams during which we simulate real-life cybersecurity incident scenarios to assess our preparedness, test our incident response plan and highlight potential areas for improvement. Audits of our cybersecurity risk management processes are conducted periodically in order to test the effectiveness of controls designed to prevent and respond to cyberattacks at different levels within Gap Inc. In addition, we maintain cybersecurity risk insurance.

companyName: GAP INC

ticker: GAP


text: OPKO Health, Inc. ("OPKO" or the "Company") is committed to the highest standards of cybersecurity, adhering to the SEC's definitions for 'Cybersecurity Incident,' 'Cybersecurity Threat,' and 'Information Systems.' Our focus is on safeguarding our digital infrastructure and sensitive data against unauthorized access and threats.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: We maintain a comprehensive, risk-based, third-party risk management process to identify, assess and manage cybersecurity risks associated with third-party service providers. Third-party service providers undergo thorough pre-engagement due diligence, including security and privacy assessments. All service providers are required to enter into contracts containing security and data processing terms no less stringent than those employed by us in safeguarding our own data. Any third-party service providers with access to confidential or sensitive data are subject to ongoing oversight activities, including assessments and audits, throughout the lifetime of the engagement.

companyName: Atmus Filtration Technologies Inc.

ticker: ATMU


text: PSE maintains a comprehensive business continuity plan that includes the identification, assessment and management of risks arising from various avenues, including cyber. Business continuity includes action plans to respond to and remedy information technology (IT) outages, attacks, and other cyber threats, which are maintained between two specific plans, the IT disaster recovery plan and the cybersecurity incident response plan (CSIRP). The CSIRP specifies guidance for various cyber related risks to ensure business continuity and timely reporting of incidents to various governing bodies, including the SEC. The CSIRP is a perpetually updated plan that is managed by the Chief Information Security Officer (CISO) and Chief Information Officer (CIO). PSE's CIO has served in various roles in IT and IT security for over 15 years, including serving as Chief Operating Officer or Chief Information Officer primarily in the financial services industry. Further, the CIO holds an undergraduate degree in computer science. PSE's CISO has over 15 years of experience managing IT security across different industries and companies. Additionally, the CISO holds an undergraduate degree and has been a Certified Information Systems Security Professional for over 15 years.

companyName: PUGET ENERGY INC /WA


text: Management Committee Oversight The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, IT Governance, and Cybersecurity. These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity. Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution. The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats. Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions. All Information Security activity is led by the Chief Information Security Officer, which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board. The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications. Management provides cybersecurity statistics and details to the board monthly.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: Board Oversight and Management's Role Our Board considers cybersecurity risk as part of its risk oversight function and has assigned oversight of cybersecurity risk management to the Audit Committee. The Audit Committee regularly receives reports from our management, including the SC (defined below) and our senior IT leadership, and third parties on cybersecurity matters. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. In addition, the Board receives reports addressing cybersecurity as part of our overall enterprise risk management program and to the extent cybersecurity matters are addressed therein, in regular business updates.

companyName: Nine Energy Service, Inc.


text: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a risk management process for service providers, suppliers, and vendors that aligns to our compliance requirements.

companyName: DIGITAL REALTY TRUST, INC.

ticker: DLR


text: Our Board recognizes the importance of understanding, evaluating and managing risk and its impact on the financial health of our company and has the ultimate oversight responsibility for the risk management process. The Board's role in risk oversight is consistent with our leadership structure, with our CEO and other members of senior management having responsibility for assessing and managing our risk exposure, and the Board and its committees providing oversight in connection with those efforts. The Board exercises these responsibilities regularly as part of its meetings and also through the Board's standing committees, each of which examines various components of enterprise risk as part of their responsibilities.

companyName: DIAMOND OFFSHORE DRILLING, INC.


text: We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or that are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches may materially affect our business strategy, results of operations or financial condition. For additional discussion of potential risks regarding cybersecurity, please see the information contained in Risk Related to Business Interruptions and Cybersecurity Incidents in Part 1A of this Form 10-K.

companyName: Air Transport Services Group, Inc.


text: For cybersecurity matters deemed material to the Company, senior management will communicate such matters directly to the Audit Committee to enable members of the Audit Committee to offer comprehensive oversight and guidance on crucial cybersecurity matters.

companyName: Enpro Inc.

ticker: NPO


text: All of our employees, consultants and contractors are encouraged to exercise professional judgement in using computing devices and network resources connected to the Cyberspace, and are strictly prohibited from certain acts enumerated in our Cybersecurity Policy including, among other things, access for non-business purposes, disabling our security features and requirement, exporting information or technologies without consent and password sharing.

companyName: U.S. GoldMining Inc.

ticker: USGO


text: During the fiscal year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report.

companyName: OLD MARKET CAPITAL Corp

ticker: OMCC


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See Item 1A “Risk Factors – Business and Operational Risks – The Trustee may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.”

companyName: PERMIAN BASIN ROYALTY TRUST

ticker: PBT


text: Third-party cybersecurity consultants are periodically retained by the Company to conduct targeted security control assessments, and to review the Company's security policies, standards, procedures, and controls, when applicable. Annual third-party penetration testing is used to simulate cyber-attacks and to identify potential vulnerabilities. The Company subscribes to paid third-party threat intelligence services that provide real-time information on emerging threats. The Company engages security platform partners to provide advisory services related to security technologies and practices.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: Incident Management We have implemented security procedures and measures in order to protect our information from theft, loss, damage or interruption from a number of potential sources or events. LSB maintains and tests an incident response plan that outlines steps for the containment, investigation of, response to and recovery from cybersecurity incidents. The plan also includes information pertaining to roles, responsibilities, and reporting process. This plan is a part of our formal, enterprise-wide crisis management process, which outlines a communication plan with executive leadership as well as guidelines for communication with the Board. During 2024, we did not experience a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we make extensive efforts to maintain the security and integrity of our information systems and technology operations, these systems are subject to the cyber risk of incident or disruption, and there can be no assurance that our security safeguards, and those of our third-party providers, will prevent incidents to our or our third-party providers' systems that could adversely affect our business. For a discussion of these risks, see "Item 1A. Risk Factors—General Risk Factors."

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: A dedicated Information Security Committee oversees our cybersecurity strategy, with executive leadership providing strategic direction. The Information Security Committee reports up to our Operational Risk Committee comprised of Executive Management and subsequently reports up to the Board Audit Committee.

companyName: First Savings Financial Group, Inc.

ticker: FSFG


text: To protect the confidentiality, integrity, and availability of our critical systems and information, our enterprise risk management framework considers cybersecurity risk alongside other company risks, as part of our overall risk assessment process. We leverage an industry leading framework, the National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. We assess our maturity against that framework in partnership with an independent firm on at least an annual basis.

companyName: TORO CO

ticker: TTC


text: In addition, the Company has established procedures to ensure that management responsible for overseeing the effectiveness of disclosure controls is informed in a timely manner of known cybersecurity risks and incidents that may materially impact the Company's operations and that timely public disclosure is made as appropriate. The Company's Cybersecurity System is led by the Chief Executive Officer ("CEO") in collaboration with other third-party cybersecurity service providers which in turn assist in monitoring our exposure from significant information technology suppliers, significant software as a service providers and major vendors with access to our information technology systems. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming. The Company does not maintain cyber insurance coverage at this time.

companyName: OneMeta Inc.

ticker: ONEI


text: As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our executive officers under the oversight of our Board of Trustees. Our executive officers are senior professionals of Onex Credit and each of the Adviser and Administrator is a subsidiary of Onex Corp. As such, we are reliant on Onex Corp. for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Onex Corp. has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Onex Direct Lending BDC Fund


text: DTE Energy engages third-party service providers to assist with managing various aspects of its business. These service providers are subject to due diligence reviews of their information security programs prior to onboarding. DTE Energy also contractually requires service providers with access to its information technology (IT) systems, sensitive business data, or personal information to implement and maintain appropriate security controls and restricts their ability to use such data for purposes other than to provide services to DTE Energy, except as required by law. Third-party service providers are also contractually required to notify DTE Energy promptly of cyber incidents that may affect any systems or data. DTE Energy collaborates with its service providers to help determine whether their information security protocols are sufficient and monitors their compliance with DTE Energy security requirements; however, DTE Energy may not have the ability in all cases to effectively oversee the implementation of these control measures.

companyName: DTE Electric Co


text: Our VP of IT/IS is a Certified Information Security Manager (CISM) and has more than 9 years of experience implementing cybersecurity at technology companies. Our VP of IT/IS, together with our internal IT security committee, is primarily responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Fabrinet

ticker: FN


text: We have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Catalyst Crew Technologies Corp.

ticker: CCTC


text: We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to IA, "Risk Factors", in the annual report on Form 10–K.

companyName: Free Flow USA, Inc.

ticker: FFLO


text: As a leader in business process solutions, we leverage cloud computing, AI, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.

companyName: CONDUENT Inc

ticker: CNDT


text: Cybersecurity Incidents We have not experienced any material cybersecurity incidents nor have we identified risks from known threats that could likely materially impacted our operations or financial results.

companyName: NATURAL GAS SERVICES GROUP INC

ticker: NGS


text: The VPBO, in coordination with the SLT, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the Company's information technology partner, these teams monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Company's SLT and Audit Committee, when appropriate.

companyName: Longeveron Inc.

ticker: LGVN


text: We maintain a cyber risk management program which includes processes for identifying, assessing, and managing risks for all of our information technology ("IT") systems, services and applications, including cybersecurity threats. Our program aligns with industry standards, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the IMO guidelines.

companyName: Excelerate Energy, Inc.

ticker: EE


text: We have a process designed to address cybersecurity threats at third parties, including service providers, that handle, possess, process and store our information.

companyName: MATERION Corp

ticker: MTRN


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and we do not believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial statements. However, the risk of cybersecurity threats could be significant if the cyber-attack disrupts the Company's critical operations, service or financial systems. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," We are dependent on information technology systems, which are subject to certain risks, including cybersecurity risks and data leakage risks associated with implementation and integration" above.

companyName: enCore Energy Corp.

ticker: EU


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our risk management strategy begins with identifying areas of risk through risk assessment and an annual review of our practices and policies against the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. This framework encompasses six major focus areas and 106 subcategories. The results of each assessment are thoroughly analyzed to strengthen our security posture and maintain a comprehensive cybersecurity program.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: Risks from cybersecurity threats, including any previous cybersecurity events, have not materially affected us or our business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach that J.P. Morgan takes to address cybersecurity risk, J.P. Morgan may not be successful in preventing or mitigating a future cybersecurity incident that could have a material adverse effect on us, the Adviser, J.P. Morgan or its affiliates or its business strategy, results of operations or financial condition.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Despite our ongoing efforts to continuously improve our ability to prevent and minimize the impact of future cyber incidents, we cannot assure you that we or any third party with whom we do business will not be the subject of future threats or incidents. While the February 2023 cyberattack and our remediation efforts did not have, and other cyberattacks experienced by third parties with whom we do business have not had, a material adverse impact on our consolidated financial position, results of operations or liquidity, we cannot assure you that in response to a future cyberattack we or any third party with whom we do business will be able to restore our respective systems so quickly and with minimal disruption to our or their business operations and without our incurring material costs or loss of net sales. In addition, the mishandling or inappropriate disclosure of non public sensitive or protected information could also lead to the loss of intellectual property, negatively impact planned corporate transactions or damage our reputation and brand image. Misuse, leakage or falsification of legally protected information could also result in a violation of data privacy laws and regulations and have a negative impact on our reputation, business, financial condition and results of operations.

companyName: B&G Foods, Inc.

ticker: BGS


text: The IT Director, along with members of management, inform the Audit Committee on cybersecurity risks by providing periodic updates regarding (i) Status of ongoing cybersecurity initiatives and strategies, (ii) The overall state of the Company's security program and potential exposure to risks, and (iii) Incident reports and learning from any cybersecurity events. Further, the IT Director maintains an open dialog regarding any significant developments in cybersecurity risks, ensuring the Audit Committee's oversight is proactive and responsive. In addition to periodic updates to the Audit Committee, the IT Director, in his capacity, regularly informs the Chief Executive Officer ("CEO") and the Chief Financial Officer ("CFO") regarding matters related to cybersecurity risks and incidents. This ensures the highest level of management are informed of potential risks associated with cybersecurity that could have a material and adverse effect on the Company.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Our Board of Directors holds the ultimate responsibility for overseeing risks to the Company. To support this governance, a Steering Committee, composed of members of management, including our Director of IT and certain members of the Board, assists with the specific focus on cybersecurity risks. Management provides the Board with comprehensive cybersecurity updates at least annually.

companyName: DecisionPoint Systems, Inc.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program, in conjunction with the Company's enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology ("IT") environment including systems, hardware, software, data, people, and processes.

companyName: Skye Bioscience, Inc.

ticker: SKYE


text: Our management team has established a cybersecurity crisis management team, led by our CIO and CISO, that includes other members of management depending on the origin, severity and other factors related to any cybersecurity incident identified. The cybersecurity crisis management team is responsible for communication of significant incidents to the Audit Committee and provides updates to the Audit Committee through incident resolution. Materiality of incidents are evaluated and determined by our cyber incident disclosure committee that includes certain cybersecurity crisis management team members and which may receive input from relevant stakeholders.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Incident Management The Company maintains and tests a cybersecurity incident response plan that outlines steps for the containment, investigation of, response to and recovery from cyber events. The plan also includes information pertaining to roles and responsibilities, escalation, third-party support, documentation, reporting, and law enforcement engagement. Escalation is designed to raise awareness of events that may require disclosure to help ensure assessments are performed without unreasonable delay. In alignment with our plan, we maintain playbooks that outline processes for responding to certain incidents commonly observed in the insurance industry. In addition, we have implemented a formal crisis management process, which outlines an incident response communication plan with executive leadership as well as criteria for communication with the chair of the Audit Committee and the Lead Director of the Board.

companyName: GLOBE LIFE INC.

ticker: GL


text: Governance and Oversight of Cybersecurity Risks GECM's cybersecurity program is managed by the IT Committee. The members of the IT Committee collectively have years of experience helping to oversee the information technology infrastructure and processes at GECM and other asset managers. The IT Committee is responsible for supervising and interfacing with providers to implement GECM's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards.

companyName: Great Elm Capital Corp.

ticker: GECC


text: The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program's resilience and instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: • H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and • Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.

companyName: Bausch & Lomb Corp

ticker: BLCO