text: Tim Langley-Hawthorne is our CIO and has served in this role since October 2021. Mr. Langley-Hawthorne has 11 years of experience in senior technology roles with cybersecurity responsibilities. Prior to joining the Company, Mr. Langley-Hawthorne served as the Chief Information Officer at Hitachi Vantara, a hi-tech subsidiary of Hitachi Ltd. Prior to Hitachi, Mr. Langley-Hawthorne held various executive technology and operations positions at Western Union, as well as various IT, consulting and commercial roles at Information Services Group, Electronic Data Systems, and IBM Australia. Mr. Langley-Hawthorne holds an Executive MBA from Pepperdine University and a Bachelor of Commerce degree from the University of Melbourne, Australia.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ


text: The Technology Committee of the Bancorp's Board of Directors takes primary responsibility for overseeing the Bancorp's information security programs at the Board level. The Technology Committee's primary purpose is to assist the Board of Directors in its oversight of plans and operations related to information technology, cybersecurity, data privacy and third-party technology strategy.

companyName: FIFTH THIRD BANCORP

ticker: FITB

secItem: Item 1C


text: Material Risks & Integrated Overall Risk Management one of the critical elements of our overall risk management program, our cybersecurity program is focused on the following key areas: Technical

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: Our cybersecurity leadership team consists of our Director and Chief Information Security Officer (our "CISO"), Vice President and Chief Information Officer and Senior Vice President of Shared Services. These individuals collectively provide the strategic oversight of our cybersecurity governance, cyber risk management and security operations and are responsible for maintaining our technology defense posture and program. They have decades of experience managing strategic technology operations, including the identification of cybersecurity risk and the defense of information technology assets from global threats. Our CISO's experience includes assessing risks, implementing governance programs, and responding to threats in oil and gas, electric and natural gas utilities and nuclear power generation companies. He maintains a Certified Information Security Manager certification from ISACA, secret clearance from the Department of Homeland Security and has played an active role in the development of various cybersecurity standards including the CSF.

companyName: Cheniere Energy, Inc.

ticker: LNG


text: Our Vice President of Information Technology (our VP of IT) has primary responsibility for monitoring, assessing and managing our material risks from cybersecurity threats. He oversees a dedicated information technology team that is responsible for managing enterprise-wide information security strategy, policy, standards, architecture and processes, and is regularly informed of, and monitors, the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. Our VP of IT has over 25 years of information technology experience, has earned a graduate degree in Cybersecurity and Information Assurance, and maintains relevant industry designations including Certified Information Systems Security Professional and Certified Information Security Manager certifications.

companyName: Natural Grocers by Vitamin Cottage, Inc.

ticker: NGVC


text: Our Board of Directors (Board) oversees the management of the risks inherent in the operation of the Company's business, principally through the Governance Committee. Our Governance Committee oversees our risk management efforts, with cybersecurity being an element of our comprehensive Enterprise Risk Management (ERM) strategy. Our executive officers report information to the Board through the Governance Committee regarding the risks that impact the organization, including cybersecurity risks, and any material events.

companyName: WIDEPOINT CORP

ticker: WYY


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board of Directors ' Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: TEJON RANCH CO

ticker: TRC


text: The Company's Board of Directors has assigned oversight of cybersecurity risk management to the Risk Oversight Committee. The Risk Oversight Committee regularly receives reports from management, including senior information technology ("IT") leadership, and third parties on cybersecurity matters. In addition, the Company's full Board of Directors receives reports addressing cybersecurity as part of the Company's overall enterprise risk management program and to the extent cybersecurity matters are addressed in regular business updates.

companyName: STURM RUGER & CO INC

ticker: RGR


text: Our Information Security Program outlines the process of protecting and securing our digital systems that contain and process information vital to our operations. Our cybersecurity management program is a subset of our larger Information Security Program. It provides protection of both client and bank information by preventing, detecting, and responding to cyber-attacks, managing vulnerable access points, practicing active governance, and adhering to risk and compliance regulations. Both programs are managed by our Chief Information Officer ("CIO") who reports directly to the Company's Chief Executive Officer ("CEO") and both are overseen by the Board's Information Technology ("IT") Committee and Audit Committee.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: The Director of Compliance, as identified below, provides regular reports to USCF's Board of Directors on developments to the information security and cybersecurity risks facing USL. Reports may include, among other things, an overview of the controls and procedures related to assessing, identifying, and managing risks related to cybersecurity threats, and management's evaluation of cybersecurity risks material to USL.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: In fiscal 2024, THOR did not identify any material cybersecurity threats, including as a result of any previous cybersecurity incident, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite the capabilities, processes, and other security measures we employ that we believe are designed to detect, reduce, and mitigate the risk of cybersecurity incidents, we may not be aware of all vulnerabilities or may not accurately assess the risks of incidents, and such preventive measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks. Moreover, we, our suppliers and our dealers have been the target of cybersecurity incidents in the past and may be subject to such incidents in the future. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: THOR INDUSTRIES INC

ticker: THO


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF, and the MITRE ATT&CK Framework. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and the MITRE ATT&CK as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: DZS INC.


text: o The team conducts periodic risk assessments, which includes penetration testing and vulnerability scanning, on the Company's Information Technology (IT) infrastructure, systems, and networks to identify potential vulnerabilities, weaknesses, and risks, and evaluates the potential impact of cybersecurity risks on the Company's operations, financials, and business.

companyName: IMAX CORP

ticker: IMAX


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust’s business, financial condition, results of operations, or cash flows. See “Risk Factors – Cybersecurity Risks.”

companyName: PermRock Royalty Trust

ticker: PRT


text: The Board has responsibility for the oversight of risk management at the Company, which includes our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic (at least semi-annual) reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association ("ISACA"), the Computing Technology Industry Association ("CTIA") and the International Information System Security Certification Consortium ("ISC2"). In addition, we require new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: These policies and controls procedures discussed in more detail below, are an integrated component of our enterprise risk management assessment processes. We routinely review and assess our business groups and systems to identify and prioritize areas of risk, including cybersecurity risk. The results of these assessments and progress against prioritized goals are presented to the board of directors each quarter.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions. These systems are either developed by us or licensed from or maintained by third-party providers. We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.

companyName: CONDUENT Inc

ticker: CNDT


text: Risk Management and Strategy We've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have engaged consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: The success of our business operations depends on the security, confidentiality, integrity and availability, of confidential and sensitive information. Such information includes personal information that we collect and process on our own and using systems and platforms provided by our vendors and other third parties on which we rely. Consequently, we maintain a data protection program, which includes physical, technical, and administrative safeguards, designed to identify, prevent, and mitigate the risks posed by cybersecurity threats, and to identify, analyze, address, mitigate and remediate any cybersecurity incidents that may happen in an efficient and timely manner. As part of our program: have implemented and maintain our policies, procedures and processes (PPP) related to the functioning of information technology within the company. The PPP are custom-tailored for the specific needs of the company – such as the nature and scale of the personal information that we collect and process – and incorporate controls and frameworks set forth by organizations such as the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO). Our internal Risk Management Committee, described below, reviews our PPP at least annually to assure continuing relevance and effectiveness.

companyName: Rumble Inc.

ticker: RUM


text: Federated Hermes' CIO has more than 30 years of technology experience. Prior to assuming his current role in 2016, Federated Hermes' CIO served in senior technology roles with a large U.S. financial institution for over a decade where he, among other things, served as chief information officer for the asset management and investments businesses and gained deep experience managing cybersecurity risks and threats. He holds a Bachelor of Science (BS) in Electrical Engineering from the University of Pittsburgh, a Master of Science (MS) in Engineering from Youngstown State University, and a Master of Business Administration (MBA) from Carnegie Mellon University.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: The management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by Vornado; and alerts and reports produced by security tools deployed in the IT environment. Our cybersecurity incident response plan governs our assessment and response upon the occurrence of a material cybersecurity incident, including the process for informing senior management and our Board of Directors.

companyName: ALEXANDERS INC

ticker: ALX


text: The Information Security Department also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, including briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: The AVROBIO Board has delegated oversight of the Company's cybersecurity risk management program to our Audit Committee, which generally oversees our enterprise risk management program. Our Audit Committee receives periodic updates on the cybersecurity risk management program, including our risk management practices, from our information technology representative. Our Audit Committee reports on cybersecurity risks and risk management to the full AVROBIO Board as appropriate.

companyName: Tectonic Therapeutic, Inc.

ticker: TECX


text: PNC's inherent information security risks, the maturity and completeness of the control environment, and measurements against our risk appetite are presented quarterly to the Technology Committee by the firm's Chief Technology Risk Officer. Overall risks across the Enterprise Risk Framework are then reported quarterly to the Risk Committee by the Chief Risk Officer.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC


text: Our Sr. Director of IT, who has a career of 24 years in IT, has in-depth working knowledge on IT systems and data security, and his experience is instrumental in developing and executing our cybersecurity strategies. Our Sr. Director of IT along with the IT team, oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee cybersecurity risk training program. However, the primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Risk Management Team. The diverse background and experience of o ur Risk Management Team members are instrumental in developing and executing our cybersecurity strategies and supplement the expertise of our Sr. Director of IT with their understanding of the needs of our business.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The Sustainability and Governance Committee oversees the Company's strategies and processes related to information security and technology risks, including cybersecurity. The Company's Chief Information Security Officer ("CISO"), and the Company's Chief Information Officer present a quarterly cybersecurity report to the Sustainability and Governance Committee and, at times, to the full Board of Directors. The reports include detailed updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, internal and third-party assessments of the Company's cybersecurity program maturity against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, incident preparedness and the current cybersecurity environment, including current trends or recent noteworthy incidents affecting other companies. The Company has created a cybersecurity incident response plan that requires management, including the Company's CISO, to take certain mitigating actions including notification to the Company's Disclosure Committee, upon the occurrence of certain types of incidents that may be material or pose significant risk to the Company, for management. The incident response plan also contains procedures requiring, upon the determination by management that the cybersecurity incident is material, notification to the Board of Directors' Sustainability and Governance Committee and Audit Committee.

companyName: MASONITE INTERNATIONAL CORP


text: The CISO has served in various roles in IT and information security for over 27 years, including serving as the Chief Information Security Officer of two large public companies. The CISO holds an undergraduate degree in computer science and a graduate degree in business and attained professional certification as a Certified Information System Security Professional ("CISSP"), Certified Information Security Manager ("CISM") and GIAC Certified Incident Handler ("GCIH"). The Company's CEO, CFO, Senior Vice President of Policy and Administration, and GC each hold degrees in their respective fields, and each has experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: LKQ CORP

ticker: LKQ


text: The Company's information security program currently includes the following security measures and controls, which are deployed as the Company deems applicable: • endpoint threat detection and response; • identity and access management; • privileged access management; • logging and monitoring involving the use of security information and event management; • multi-factor authentication; • firewalls and intrusion detection and prevention; • web application firewalls and bot security tools; and • vulnerability and patch management.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Specifically, the Enterprise Information Security Steering Committee typically meets at least four times per year, or with greater frequency as necessary, to: • review with management the Company's cybersecurity threat landscape, risks and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies, including the guidelines and policies established by the Company to assess, monitor and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, including cybersecurity incident response preparedness, communication plans and business continuity capabilities.

companyName: ROBERT HALF INC.

ticker: RHI


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate information security organization, led by our Chief Information Security Officer ("CISO"), develops and directs our information security strategy and policy, security engineering, operations and cyber threat detection and response.

companyName: Optimum Communications, Inc.

ticker: OPTU


text: The Audit Committee ("Audit Committee") of the Company's Board of Directors (the "Board") is actively involved in oversight of the Company's risk management program, and cybersecurity represents an integral component of the Company's overall approach to enterprise risk management ("ERM"). A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, the Company's information systems that may result in adverse effects on the confidentiality, integrity or availability of the Company's information systems or any information residing therein. The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the Center for Internet Security Cybersecurity Framework. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Management Oversight in Cybersecurity Governance FMC's senior management Operating Committee, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, David Kotch, Vice President and Chief Information Officer, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's Operating Committee. He serves as a member of the Chemical Information Technology Center's CIO organization and the CIO Executive Summit. Mr. Kotch also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.

companyName: FMC CORP

ticker: FMC


text: Since January 1, 2021 (the first date covered by the financial statements presented in this Form 10-K), we have not experienced any material cybersecurity incident.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: We have controls and procedures in place for prompt escalation of cybersecurity incidents and periodically evaluate and update contingency planning, including capability to recover in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We conduct penetration testing to test our defenses and monitor threat levels.

companyName: Airspan Networks Holdings Inc.


text: Our cybersecurity risk management program also seeks to manage cybersecurity risks associated with our use of third-party service providers through risk assessments and contractual obligations on such service providers.

companyName: AMBARELLA INC

ticker: AMBA


text: The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has more than 20 years of professional IT management experience and maintains a Global Information Assurance Certification. The Director of IT reports to our Chief Accounting Officer, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our Chief Accounting Officer meets with the audit committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization. We also engage an external auditing firm with information security expertise to conduct regular auditing, testing, and review of our information technology risks, processes, and operations.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain of our management, including our Senior Director of Information Technology, who has over 25 years of work experience in various roles in information technology and cybersecurity, including in public companies in our industry, and our Chief Financial Officer, who has experience overseeing the information technology function and implementing and overseeing internal controls frameworks in our industry.

companyName: Longboard Pharmaceuticals, Inc.


text: As part of our information security program, we also have processes in place for management of cybersecurity risks associated with third-party handling of our confidential information, including in such third parties' provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and ongoing monitoring of such third parties, utilizing tools such as security ratings services and periodic reassessment questionnaires.

companyName: Alkermes plc.

ticker: ALKS


text: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee periodically on cybersecurity and other information technology risks and opportunities. Additionally, the Audit Committee, with guidance from the CIO, General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually. In the case of an information security incident or breach, the Director of Information Security and CIO will follow the Company's Incident Response Plan and follow communication protocols within the plan, which, depending on the severity of the incident, include escalation timelines and responsibilities that involve updating the Audit Committee and the Board of Directors, as applicable.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: Notwithstanding the foregoing efforts, there can be no assurance that the security measures we employ will prevent malicious or unauthorized access to our systems or information. No security program can entirely eliminate the risk of human error or malicious acts that are outside our reasonable control. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. See Item 1A. Risk Factors for additional details regarding cybersecurity risks.

companyName: Astra Space, Inc.


text: The Company maintains an information security program and governance framework that is designed to identify, assess, manage, mitigate, and respond to cybersecurity risks associated with its information systems and information assets. Additionally, we maintain a similar risk-based approach to our third-party vendor management program including identifying and overseeing cybersecurity risks they present.

companyName: Pioneer Bancorp, Inc./MD

ticker: PBFS


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Canterbury Park Holding Corp

ticker: CPHC


text: Our board of directors oversees our risk management program, including the management of cybersecurity threats as part of its general oversight function. Our Audit Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program and receives reports from management concerning our cybersecurity risk management program.

companyName: SOLENO THERAPEUTICS INC

ticker: SLNO


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Management has responsibility to manage risk and bring to the Board's attention the most material near-term and long-term risks to the Company. The Company's CISO leads management's assessment and management of cybersecurity risk. The CISO reports to the Company's Chief Digital, Data, Analytics & Technology Officer (the "CDDATO"), who reports directly to the Company's Chief Executive Officer. The CDDATO, CISO and the CPO, regularly review cybersecurity matters with management. The current CDDATO, CISO and CPO each has more than 10 years of experience managing risks or advising on cybersecurity issues.

companyName: CVS HEALTH Corp

ticker: CVS


text: Implementing MFA protections for our treasury customers by prohibiting their initiation of ACH transactions or wire transfers until they authenticate their identities using a security token that is generated and sent by our online-banking MFA system;

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: We regularly assess risks from cybersecurity and technology threats and monitor our systems for potential vulnerabilities and exploit attempts. We use a widely adopted risk quantification model to identify, measure, and prioritize cybersecurity and technology risks and develop related security controls and safeguards. We take a risk-based approach to regular reviews and tests of our information security program and also leverage tabletop and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning.

companyName: GRIID Infrastructure Inc.


text: Our internal audit function provides independent assessment and assurance on the overall operations of our cybersecurity and privacy programs and the supporting control frameworks. These processes support informed risk-based decision-making and prioritization of cybersecurity countermeasures and risk mitigation strategies. Our risk mitigation strategies include a broad variety of technical and operational measures, as well as annual cybersecurity and privacy training for all of our employees.

companyName: AvePoint, Inc.

ticker: AVPT


text: Cybersecurity risk management is a key component of our overarching risk management strategy. Given the susceptibility of our industry to cyber threats and attacks, we regularly encounter attempted attacks of varying types. Both the financial and personal data in our systems, coupled with the dynamic nature of our products and services, make us a potential target. We operate internationally with employees, contractors, vendors, developers, partners, and third parties, which complicates our risk exposures.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: We, Kronos and CompX each have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of the Contran CIO and senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT teams are responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to the CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC, as well as the Kronos and CompX CIDAC, performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.

companyName: NL INDUSTRIES INC

ticker: NL


text: The Board, in coordination with the Risk Committee and Technology Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews. The CRO reports to the Technology Committee and management committees information regarding cybersecurity incidents that meet established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board, Technology Committee and appropriate management committees review the Company's approach to cybersecurity risk management through reporting by the CISO. The Technology Committee and the Board approve the Information Security Program and all supporting Policies.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: To enhance our cybersecurity risk management, we leverage industry associations, third-party benchmarking, audits, threat intelligence feeds and other similar resources, which inform our cybersecurity efforts and help us determine how best to allocate resources. We utilize third-party service providers to assist us in assessing, enhancing, implementing, monitoring and testing our cybersecurity program, areas of cyber risk and cyber risk management.

companyName: Sylvamo Corp

ticker: SLVM


text: Cybersecurity is a crucial component of our risk management processes and of Cohen & Steers' enterprise risk management program. Like many companies, we, Cohen & Steers and our and our external providers have been subject to, and expect to continue to be subject to, a range of cybersecurity threats and risks. Cohen & Steers has invested significant resources into cybersecurity and risk management processes to adjust to the continuing evolution in cybersecurity and respond to related threats.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal computer systems, or those of our collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a significant disruption of our product development programs and can lead to adverse consequences, including but not limited to regulatory investigations or actions; litigation; fines and penalties; reputational harm; loss of revenue or profits; loss of customers or sales; disruption of our business operations."

companyName: Milestone Pharmaceuticals Inc.

ticker: MIST


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from IT leadership, which includes our Senior Vice President & Chief Administrative Officer and our Vice President of IT and CIO, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ARCH RESOURCES, INC.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are expected to be in compliance with our cybersecurity policies.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: Sami Siddiqui. Mr. Siddiqui was appointed President, Popeyes U.S. & Canada in September 2020. Prior to that Mr. Siddiqui served as President of Asia Pacific for RBI from February 2019 to September 2020 and as Chief Financial Officer for Burger King Corporation from October 2018 to February 2019. From September 2016 to September 2018, he was President of Tim Hortons and from April 2015 to September 2016, he was Executive Vice President, Finance for Tim Hortons. Mr. Siddiqui joined Burger King Corporation in 2013 and served various capacities within the Global Finance groups of Burger King Corporation prior to joining the Tim Hortons team.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: The Company's systems and processes have been, and will likely remain, subject to cyber threats and cyber-attacks and other intrusions. These threats and attacks are occurring with greater frequency and sophistication, and include malware and computer virus attacks, ransomware, unauthorized access, misuse, denial-of-service attacks, system failures and disruptions. While these cyber threats and attacks have not resulted in a material adverse effect on the Company, a future cyber incident involving breach of the Company's information systems or the information systems of a third-party vendor or services provider could adversely affect the Company's business strategy, results of operations or financial condition by exposing the Company to substantial costs and negative consequences, including the loss of funds, costs of investigation and remediation, lost revenues and reputational damage.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: We and others across our industry face a number of cybersecurity risks in connection with our business and operations. Although such risks have not materially affected our business strategy, results of operations, or financial condition to date, we have, from time to time, experienced threats to, and incidents in connection with, our information systems. Any security breach or event resulting in the unauthorized disclosure of our information or the information of our customers or the degradation of services provided by our critical business systems, whether by us directly or our third-party service providers, could adversely affect our business operations, sales, reputation with current and potential customers, associates, or vendors as well as other operational and financial impacts derived from investigations, litigation, the imposition of penalties, or other means. For more information about the cybersecurity risks we face, see the risk factors entitled "Information technology," "Cybersecurity" and "Regulatory Issues – Privacy Regulation" in discussed in Item 1A. Risk Factors.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: As part of our operational risk management strategy, led by our chief operating officer, we have implemented processes to assess, identify, and manage material risks facing the Company, including from cybersecurity threats. Components of this strategy includes the use of industry standard traffic monitoring tools, training users to detect, report, and prevent unusual behavior, and working with reputable service providers capable of ensuring their ability to operate with strategies equal to or better than our own. The implementation and management of these processes are integrated with the Company's overall operational risk management processes that seeks to limit our exposure to unnecessary risks across our operations. For cybersecurity threat management and mitigation, the Company engages with expert consultants and third party services providers for the design and implementation of these industry standard strategies to identify any potential threats or vulnerabilities in our system. We have developed a cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents.

companyName: Comstock Inc.

ticker: LODE


text: Enterprise Risk & Compliance Committee Our Enterprise Risk & Compliance Committee is comprised of a collective of senior management representatives and subject matter experts from across the Company. The Enterprise Risk & Compliance Committee is chaired by the Chief Financial Officer of the Company, with the Executive Vice President & General Counsel as the co-chair and comprises core members including the Transformation and Chief Information & Digital Officer, while the CSO serves in an advisory capacity. The purpose of the Enterprise Risk & Compliance Committee is to oversee and govern the Company's risk management, environmental, social, corporate governance, cybersecurity, and operational compliance activities, as well as provide a means of bringing risk issues to the attention of management. Specific to cybersecurity, the Transformation and Chief Information & Digital Officer and the CSO have the expertise to provide insights into the nature of cyber threats, the Company's readiness, and actions taken to mitigate such risks.

companyName: T-Mobile US, Inc.

ticker: TMUS


text: Responsibility for cybersecurity risk management is driven by Company leadership who are responsible for communicating the requirements for vigilance and compliance throughout the organization. The cybersecurity program is led by our Vice President of Information Technology, or VP of IT, who reports to the Chief Financial Officer and has over 25 years of experience building, implementing and managing information systems, including the development and deployment of risk mitigation strategies for such systems. The VP of IT is a member of and works in conjunction with other leaders of the Company's Cyber Governance Committee, which is responsible for oversight of the Company's cybersecurity program. The Cyber Governance Committee comprises cross-functional members of management, and in addition to the VP of IT, includes the Company's Chief Compliance Officer, Chief of Staff, VP, Corporate Counsel, and Chief Accounting Officer. Together, these individuals meet periodically to align cybersecurity and privacy strategy with business needs and risk appetite, monitor the execution of key cybersecurity initiatives, and serve as an escalation point for any related issues.

companyName: SpringWorks Therapeutics, Inc.


text: The SVP IT, or a delegate, informs the Cybersecurity Subcommittee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes. The Cybersecurity Subcommittee is also primarily responsible for advising the Disclosure Committee and the Company's CEO and Interim CFO and CAO regarding cybersecurity disclosures in public filings. The SVP IT, with the General Counsel in attendance, also notifies the Audit Committee chair of any material cybersecurity incidents.

companyName: TILT Holdings Inc.

ticker: TLLTF


text: The Audit Committee of the Board provides oversight of the Company's cyber security program. The Information Security Team keeps management informed about initiatives, threats, incidents, training, and best practices on an on-going basis via circulated memos or meetings. In addition to reporting through the Audit Committee and Enterprise Risk Management Program, the Board may periodically include cyber security as an independent agenda item and engages with the CIO and Information Security Team as well as external experts on cyber security matters.

companyName: Noble Corp plc

ticker: NE


text: Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stockholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Information Security Officer ("CISO"), Commvault's cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We procure security technologies, consistently work to mature our cybersecurity program, and partner with security service providers. We have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third parties to enhance monitoring and response capabilities and facilitate readiness activities including tabletop exercises and penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls through a risk assessment questionnaire and include security and privacy terms in contracts as appropriate.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: We evaluate and manage risks relating to cybersecurity as part of our overall enterprise risk management program. We perform an annual assessment across the Company to identify and review potential risks. Risks are prioritized based on threat models to improve cybersecurity throughout the Company. Our Board of Directors oversees our enterprise risk management program.

companyName: Envista Holdings Corp

ticker: NVST


text: • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by certain third parties, including vendors, service providers, suppliers, operations parties, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. This includes a security process to conduct due diligence prior to engaging contractors and vendors and assess the security capabilities of subcontractors and vendors on a periodic basis. • Risk and Readiness Assessments. We engage in at least quarterly assessments and testing of the effectiveness of our cybersecurity risk management program and incident response protocols that are designed to identify and evaluate vulnerabilities and weaknesses, address cybersecurity threats and test our readiness to respond to cybersecurity incidents. These efforts include, but are not limited to, threat modeling, vulnerability scans, penetration testing, audits, and tabletop exercises. We regularly engage third parties to perform assessments on our cybersecurity measures, such as audits and independent reviews of our compliance with various security compliance standards, including those established by the American Institute of Certified Public Accountants, operating effectiveness and penetration tests. The results of such assessments are reported to management and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews. • Awareness and Training. We provide regular training for educating employees about corporate policies and procedures and information security designed to provide our employees with knowledge of best practices and effective tools for safeguarding our data and assets and reducing security risks based on the human threat vector. Our information security compliance training, data protection training, and code of conduct training is mandatory for all employees. • Governance. As discussed in more detail below under the heading, "Cybersecurity Governance," our board of directors' has delegated oversight of enterprise security risk management, including, but not limited to, cybersecurity risk management to the Security Committee. As part of our cybersecurity risk management procedures, senior members of management and the Security Committee are informed regarding security events based on established reporting thresholds, and are provided ongoing updates regarding any such meaningful threat or incident.

companyName: Palo Alto Networks Inc

ticker: PANW


text: We believe that mitigating cybersecurity risks is the responsibility of every employee. We take a preventative approach with respect to cybersecurity threats by building a resilient cybersecurity culture and strong IT infrastructure. Our processes for assessing, identifying, and managing material risks from cybersecurity threats include: • monitoring the threat landscape and taking measures to enhance our cybersecurity program to adapt to new and developing risks; • ongoing training, testing, and utilizing other forms of social engineering awareness and education for our employees; • using cybersecurity systems and tools to monitor endpoints and environment logs in a centralized security information and event management system with capabilities for reporting and alerting on known threats and anomalous behaviors; • assessing the cybersecurity practices and external ratings and assessments of certain of our third-party technology and data vendors and service providers, and maintaining preventative controls and monitoring systems related to these partners; • creating and testing various incident response plans to hypothetical cybersecurity attacks in order to quickly assess and respond to potential and actual threats; • utilizing third-party experts to perform penetration testing and scanning of our systems for vulnerabilities; • obtaining third-party security maturity assessments, benchmarking, and security effectiveness ratings of our cybersecurity program; and • maintaining a retainer for incident response services with a trusted cybersecurity partner in order to quickly respond, investigate, contain, and recover in the event of a cybersecurity incident.

companyName: SM Energy Co

ticker: SM


text: We have not identified risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected us. However, we face ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Any significant disruption to our service or unauthorized access to our systems could result in a loss of users and adversely affect our business, financial condition, and results of operations. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition, and results of operations. While Match Group maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For additional discussion of cybersecurity risks, see "Item 1A Risk factors—Risks relating to our business—We may not be able to protect our systems and infrastructure from cyberattacks and may be adversely affected by cyberattacks experienced by third parties."

companyName: Match Group, Inc.

ticker: MTCH


text: Fortress has implemented an information security governance policy governing cybersecurity risk, which is designed to facilitate the protection of sensitive or confidential business, client, investor and any employee information that it stores or processes, and the maintenance of critical services and systems. Fortress's cybersecurity program is managed by Fortress's Chief Information Security Officer and Fortress's Chief Technology Officer (together, "Fortress IT Management"), who report to Fortress's Chief Financial Officer. Fortress IT Management and their team are responsible for implementing Fortress's monitoring and alert response processes, vulnerability management, changes made to its critical systems, including software and network changes, and various other technological and administrative safeguards. These processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks, and Fortress's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Fortress's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Fortress's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: Chief Risk Officer The ERM structure is further bolstered by the support of a dedicated Chief Risk Officer, who provides specialized expertise and oversight in the broader domain of risk management.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Reporting to the Board of Directors The CIO regularly informs the CLO and CEO of all significant aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential significant risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Nominating and Corporate Governance Committee of the Board and, in certain cases, the Board itself, ensuring that they have comprehensive oversight and can provide guidance on any potentially material cybersecurity incident.

companyName: Array Technologies, Inc.

ticker: ARRY


text: We assess, identify and manage cybersecurity risks through a structured process. We rely on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to guide our approach; covering risk identification, analysis, prioritization and treatment. We continuously monitor and mitigate identified risks, particularly those deemed significant to the Company, including, but not limited to: operational risk (i.e., disruption of business operations); intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation and legal risk; and reputational risk, which are tracked through our enterprise risk management program.

companyName: KENNAMETAL INC

ticker: KMT


text: To date, we have not experienced any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition; however, like other companies in our industry, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' information technology systems and infrastructure. For more information, please see the section entitled "Risk Factors" in this Annual Report on Form 10-K.

companyName: Sagimet Biosciences Inc.

ticker: SGMT


text: We have established a Technology Steering Committee, or TSC, containing members of our senior management team to provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. The TSC convenes quarterly, and meetings include updates on cybersecurity matters provided by the cybersecurity leader.

companyName: Silk Road Medical Inc


text: • Third-Party Experts. In addition to our internal cybersecurity risk management practices, we engage third-party experts to provide independent, external assessments of our information systems and security controls. These assessments address various regulatory requirements, take into consideration internal- and external-facing information systems and include tabletop exercises and technical system reviews related to security preparedness and response capabilities. • Third-Party Service Providers. We rely on third-party service providers to support our business operations and help execute our digital, restaurant technology and enterprise technology initiatives. Our contract review and onboarding process includes assessing third-party cybersecurity risk management practices and conducting data protection impact assessments for personal data processing that may result in high risk to individuals. Annually, we also review certain third parties' information security practices for compliance with contractual and regulatory obligations. • Incident Response Plan. We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident analysis processes. The incident response plan designates an incident response team that is responsible for managing and executing response activities in coordination with subject matter experts and other stakeholders in the event of an incident. The incident response plan is supplemented by detailed incident management plans that outline the technical steps to be taken in response to certain types of incidents. We regularly conduct tabletop exercises and incident response plan testing to evaluate our incident response capabilities and readiness. • Annual Strategy Review. We annually review our cybersecurity risk management strategy to ensure it addresses changes in our business operations and the evolving cybersecurity threat landscape. This includes annual reviews of our incident response plan, as well as our information security, data classification and other Company policies and standards, reports to our Board of Directors and Board committees and detailed presentations to support the annual renewal of our system cyber insurance program. • Peer Involvement. We are active in the information security community, including as a core member of the Retail and Hospitality Information Sharing and Analysis Center ("RH-ISAC"), which represents more than 200 companies across retail and other consumer-facing industries. As a member of RH-ISAC, we benefit from real-time collaboration, industry specific benchmarking, threat intelligence reports and analysis, industry-relevant committees and working groups and numerous cybersecurity training, education and knowledge sharing opportunities. • Cybersecurity Insurance. We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents. There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future incidents.

companyName: Wendy's Co

ticker: WEN


text: To date, we have not experienced any material cybersecurity incidents, and there has been no known unauthorized access to our systems. We will continue to monitor our cybersecurity risk profile and take appropriate actions to safeguard our data and systems.

companyName: C & C TOURS, INC.


text: Our Board of Directors administers a risk oversight function through its Audit Committee, and is supported by our ERM team, including on matters related to cybersecurity risks. This management reporting is designed to give our Board of Directors visibility over our operations and activities to adequately identify key risks, including among other things, cybersecurity risks, and understand management's risk mitigation strategies.

companyName: HERBALIFE LTD.

ticker: HLF


text: We recognize the critical importance of maintaining the trust and confidence of physicians, patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by NIST and other applicable industry standards, as well as the HIPAA Security Rule and other recognized frameworks. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: EXAGEN INC.

ticker: XGN


text: Our customers' and partners' trust is crucial to our business; as such, a cybersecurity incident impacting the confidentiality, integrity, or availability of LiveRamp's systems or the data we process may have a significant impact on our strategy, operations, and financials. Direct impacts may include fees, penalties, or loss of customer revenue. Furthermore, a material cybersecurity incident could harm our business and reputation and diminish our competitive position.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: The Company considers its material cybersecurity-related risks, as described in more detail below and at Item 1A. Risk Factors, and applies various frameworks to establish controls that are reasonably designed to identify, protect, detect, respond to, and recover from significant cybersecurity incidents. The Company also tests its cybersecurity program to assess whether enhancements to cybersecurity measures are appropriate, such as additional detection and prevention capabilities. These tests may include the use of internal or third-party external risk assessments, and penetration testing. The Company also conducts periodic cybersecurity assessments, as appropriate, pursuant to its annual risk assessment process. Third party resources may also be used for these assessments.

companyName: CSX CORP

ticker: CSX


text: HEI's cybersecurity governance is primarily integrated within Hawaiian Electric's cybersecurity governance plan and processes. HEI's Board of Directors and CWG are tasked with overseeing risks from cybersecurity threats through routine quarterly, or as needed, updates and periodic deep-dive sessions. These updates cover cybersecurity incidents, as well as overall cybersecurity risk reduction program maturity, emerging and current cybersecurity risks, and the cybersecurity threat landscape.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: We have also developed a cybersecurity risk management process for our third-party vendors. This process aims to assess the cybersecurity maturity of vendors who have access to our data or systems through an evaluation of the vendor's cybersecurity risk profile. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition; however, like other companies in our industry, we and our third-party vendors have from time to time experienced threats that could affect our information or systems. For more information about the cybersecurity risks we face, see Item 1A "Risk Factors."

companyName: SWK Holdings Corp

ticker: SWKH


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with an IT consultant who reports to our Interim CEO/Chief Financial Officer, to manage the risk assessment and mitigation process.

companyName: Hepion Pharmaceuticals, Inc.

ticker: HEPA


text: Cybersecurity related risks are one of the key risks contemplated by our Enterprise Risk Management ("ERM") Framework. The ERM Framework informs our strategic planning activities through a collaborative risk management environment that proactively identifies and prioritizes our strategic, preventable, and external risks (including new or changing regulations). The ERM Framework enables a clear understanding of the top risks and the exposure they have to our performance and strategic decisions. The ERM Framework is reviewed annually as part of a risk assessment that is presented to our Board.

companyName: Kenvue Inc.

ticker: KVUE


text: As part of our overall risk management system, IT management monitors and tests our safeguards and trains our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies and risks through communication and trainings.

companyName: RxSight, Inc.

ticker: RXST


text: The Company utilizes existing employees and contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We conduct cybersecurity assessments using third-party service providers, and we require them to promptly notify the Company of any cybersecurity risks, threats or incidents that might impact us.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: The CIO and CISO, who oversee our information security program, are well qualified to oversee and manage risks posed by potential cybersecurity threats. Our CIO has over 25 years of experience serving Fortune 500 companies in the area of information technology, including nearly 20 years in mortgage and financial services, with roles ranging from overseeing application development and delivery to enhance risk management capability and improve operational efficiency to information technology strategy, architecture, delivery, and management. Similarly, our CISO has over 25 years of experience working for financial services companies in information technology, including roles overseeing e-commerce, technical infrastructure management and architecture, and 20 years overseeing information security programs.

companyName: Essent Group Ltd.

ticker: ESNT


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "We have in the past and may continue to experience privacy and data security breaches or incidents" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: DROPBOX, INC.

ticker: DBX


text: Zurn Elkay's management and Board recognize the importance of robust oversight of cybersecurity risk, information security, and technology risk in maintaining the trust and confidence of our customers, partners, employees, and stockholders. The Audit Committee, on behalf of the Board, oversees the Company's material financial and other risk exposures, including risks related to cybersecurity. Our Board has extensive cybersecurity experience, including two members of the Audit Committee who have received a certificate in cybersecurity oversight from the Carnegie Mellon University Software Engineering Institute. Cybersecurity risk also is monitored, assessed and managed as part of the Company's integrated Enterprise Risk Management program on an ongoing basis. A cybersecurity governance council, comprised of executive leaders, meets at least quarterly to review the Company's cybersecurity program and its effectiveness. This cybersecurity governance council receives updates and reports from the Company's global cybersecurity team (discussed below) on the cybersecurity program and its effectiveness relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. The Chief Information Officer (CIO) provides periodic updates to the Audit Committee on any material initiatives and key updates on the cybersecurity program and its effectiveness, including any material threats. The CIO also provides an annual update regarding information security to the full Board. The CIO has more than 35 years of information technology experience, including approximately 17 years serving as a CIO.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS


text: Our cybersecurity risk management program is part of our enterprise-wide risk management practices. Based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework, the program utilizes policies, processes, and technologies to assess, identify, and manage the cybersecurity threats that we face. Specifically, we use these policies, processes and technologies to identify internal and external threats, establish access control, data privacy and security measures, detect unauthorized activity, and respond to and recover from, incidents. For example, we leverage external experts and our internal threat and risk teams to assess potential threats, retain external consultants to conduct penetration tests and health checks on our information systems, conduct cyber security and awareness training to help team members identify and manage common categories of cybersecurity threats, utilize multiple protective and detective tools to identify active threats and have a 24/7 Security Operations Center to manage incident response.

companyName: CENTENE CORP

ticker: CNC


text: The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. See "Risk Factors - Risks Related to the Company's Business and Strategy" in Part I, Item 1A of this Annual Report.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: The Company recognizes the critical importance of cybersecurity in safeguarding its operations, assets, and various stakeholders and acknowledges that such risks are becoming more complex and frequent. As part of its enterprise-level risk management assessment process, the Company has implemented a cybersecurity program to identify, mitigate, and respond to risks associated with cyber threats and to protect the confidentiality, integrity and availability of Company computer systems.

companyName: LINDSAY CORP

ticker: LNN


text: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape. Our Audit and Risk Committee provides regular updates to the board of directors on such reports. In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities. Management is required to notify the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.

companyName: QUALYS, INC.

ticker: QLYS


text: The primary goal of CFC's cybersecurity operations is to prevent, identify, mitigate and respond on a timely basis to cybersecurity threats in order to reduce operational risk and business impact. Our strategy encompasses technology, process and people. The technology components are designed to provide multiple layers of system security, controls and monitors for our infrastructure, data and applications. Our security infrastructure and resources are focused on the monitoring of threats and the defense of our external and internal networks, endpoints, data resources and identity management.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: The Company maintains a cyber risk program as a part of its enterprise risk management program that is designed to identify, assess, mitigate and manage cyber risks. The Company's Vice President of Information Technology is responsible for managing the Company's cyber risk program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising third parties assisting in these efforts. The Company's Vice President of Information Technology has two decades of experience in the Information Technology industry, with a strong emphasis on cybersecurity whose professional experience is distinguished by a Bachelor's degree in Network Operation and Security and enriched by practical, hands on experience in the field. The Vice President's long standing career in Information Technology reflects a deep seated expertise in safeguarding digital infrastructures in today's dynamic cyber environment.

companyName: Gaming & Leisure Properties, Inc.

ticker: GLPI


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our security measures, or those of our CROs, CDMOs, collaborators, contractors, consultants or other third parties upon whom we rely, are or were compromised or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, we could experience a material adverse impact."

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: We maintain a comprehensive technology and cybersecurity program to ensure our systems are effective and prepared for information security risks, utilizing regular oversight of our programs through security monitoring and alerting for internal and external threats to ensure the confidentiality, integrity, and availability of our information assets. We regularly perform evaluations and testing of our security program, information technology infrastructure, information security management systems, and third-party service providers we use in our operatio ns.

companyName: JBT MAREL Corp

ticker: JBTM


text: Our cybersecurity program includes, among others: a cybersecurity education program with on-going employee activities, which include frequent phishing simulation and testing and annual training; access management and access controls with periodic reviews;

companyName: SMITH MIDLAND CORP

ticker: SMID


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: EVERSPIN TECHNOLOGIES INC.

ticker: MRAM


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including as applicable to our environments, systems, and data. These third-party service providers may include, but are not limited to, cybersecurity consultants, cybersecurity software providers, cybersecurity assessment firms, and forensic investigators.

companyName: Asana, Inc.

ticker: ASAN


text: Federated Hermes' board of directors has ultimate oversight responsibility for cybersecurity risks and threats. Federated Hermes' Audit Committee assists its board of directors in monitoring cybersecurity risks and threats. Federated Hermes' board of directors and Audit Committee receive reports on cybersecurity matters on a periodic (generally quarterly) basis (and more frequently when circumstances warrant) as part of risk management oversight responsibilities. For instance, in 2024, Federated Hermes' Chief Information Officer (CIO) reported to Federated Hermes' board of directors one time and its Audit Committee three times regarding cybersecurity risks and threats. The Audit Committee also receives reports from Federated Hermes' internal auditors, legal counsel and other responsible officers regarding cybersecurity topics and trends. The Federated Hermes Chief Risk Officer (CRO) also reports directly to the Compliance Committee of Federated Hermes' board of directors on a quarterly basis and Federated Hermes' full board of directors as appropriate on significant enterprise risks, including cybersecurity risks.

companyName: FEDERATED HERMES, INC.

ticker: FHI


text: Our ability to attract and retain customers, efficiently operate our businesses, execute our DRIVE transformation, including Network 2.0, and compete effectively increasingly depends in part upon the sophistication, security, and reliability of our technology network, including our ability to provide features of service that are important to our customers, to protect our confidential business information and the information provided by our customers, and to maintain customer confidence in our ability to protect our systems and to provide services consistent with their expectations.

companyName: FEDEX CORP

ticker: FDX


text: The Audit Committee of our Board of Directors is tasked with oversight of the Company network and data security efforts and is responsible for the Company's policies and practices with respect to cybersecurity and enterprise risk management. We have a dedicated Cybersecurity Engineer in our Information Technology department who reports directly to the CIO. Our Cybersecurity Engineer is primarily responsible for continuously evaluating our security efforts and coordinating with our CIO and other management employees as necessary. The CIO meets with our Audit Committee regularly to update the Audit Committee on any new or identified cybersecurity threats, the Company's cybersecurity efforts and plans for the upcoming quarters. Our Audit Committee also meets regularly with senior management, including our CIO, to receive updates and about the Company's cybersecurity initiatives.

companyName: COGENT COMMUNICATIONS HOLDINGS, INC.

ticker: CCOI


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our senior vice president, finance and accounting. Our senior vice president, finance and accounting has extensive operational and leadership experience overseeing accounting and finance functions at various organizations, including oversight of critical accounting and finance IT systems. Our senior IT consultant has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.

companyName: LeonaBio, Inc.

ticker: LONA


text: The Company's information technology resources are managed by the Information Technology Department, which is responsible for the first line of defense – identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the Chief Information Officer (CIO), who reports to the Company's President and CEO. The present CIO has been employed by the Company in the information technology area for two and a half years and was previously the CISO at the Company for two years. The present CIO has over thirty-five years of IT experience, twelve of that in banking. The CIO holds a current Certified Information Systems Security Professional (CISSP) designation.

companyName: AMERISERV FINANCIAL INC /PA/

ticker: ASRV


text: We are aware of the various risks and threats that the Company faces in relation to cybersecurity. These risks include external threats such as hacking, malware and phishing attacks, which can compromise the security of our systems and data. Additionally, we recognize the potential for internal risks, such as employee negligence or malicious activities, which can also pose significant cybersecurity threats. We continuously monitor and assess these risks to ensure the effectiveness of our cybersecurity measures. We regularly monitor our IT services to safeguard data and to help improve and stabilize our network and systems. We periodically audit our existing network and systems and make upgrades as needed. In addition to protective systems and measures, we believe that ongoing employee awareness and training play a critical role in data security. Training includes Security Awareness Proficiency Assessment ("SAPA") in pertinent knowledge areas such as internet use, email security, social media and mobile devices. Our SAPA scores are higher than the construction industry average, and we believe this demonstrates our commitment to cybersecurity awareness.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Contractually, we require the ISP to annually provide a third-party report on its systems and on the suitability of the design and operating effectiveness of its controls relevant to information and cyber security. In addition to the ongoing dialogue and technology interaction between our Director of IT and our ISP, any significant findings in these reports are shared with us, including our Board of Directors and other officers, to enhance ongoing monitoring and assessment of our information technology and cybersecurity risk management.

companyName: GLADSTONE COMMERCIAL CORP

ticker: GOOD


text: The management team includes our Vice President and General Manager of the HPP segment, who has developed cybersecurity software at the Company. In addition, he has been the Chief Technical Officer and served in various roles at several cybersecurity companies over his 40 year career. He holds a Bachelor of Science in Business and Engineering as well as a Masters of Science in Finance. Also on the team is the Vice President of Managed Services at the TS segment, who has over twenty years of technology experience including the monitoring and management of other organization's security systems.

companyName: CSP INC /MA/

ticker: CSPI


text: Our Board of Directors oversees AIR's risk management process, including cybersecurity risks. The Audit Committee oversees AIR's enterprise risk assessment. The Audit Committee meetings include discussions of specific risk areas, including, among others, those relating to cybersecurity. AIR's Senior Vice President of Technology reports, typically on a quarterly basis, to the Audit Committee on AIR's cybersecurity profile risk assessment and technology environment and the broader technology landscape. The Audit Committee also independently engages consultants to conduct cybersecurity assessments and, preparedness analyses, and to provide the Board with ongoing training concerning cybersecurity risk governance.

companyName: Apartment Income REIT Corp.


text: Risks from Cybersecurity Threats While we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial conditions, we do expend significant resources (including cyber insurance costs) to address the ongoing risks from cybersecurity threats. We believe these risks could be material in light of the sensitive data that we collect, process and store in the operation of our business. See "Risk Factors" above.

companyName: Repay Holdings Corp

ticker: RPAY


text: For additional information regarding our cybersecurity risks, see "Item 1.A. Risk Factors—Other General Risks—We face risks associated with system failures through security breaches or cyber-attacks, as well as other significant disruptions of our information technology ("IT") networks and related systems" above.

companyName: STAG Industrial, Inc.

ticker: STAG


text: Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: We have developed and implemented a cybersecurity risk management program intended to preserve the confidentiality, integrity and availability of Peloton's systems and information, including our Members' data, APIs and web and mobile applications. Our cybersecurity program is guided by industry standards developed by the National Institute of Standards and Technology ("NIST"). We seek to address cybersecurity risks through a comprehensive, cross-functional approach that focuses on protecting the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program is also integrated with Peloton's broader enterprise risk management program, through which we manage business, cybersecurity, information technology, privacy, legal, and geopolitical risks, among others.

companyName: PELOTON INTERACTIVE, INC.

ticker: PTON


text: We enlist third-party service providers to support us in conducting information security reviews of our infrastructure, and the evaluation of our company policies. These providers furnish comprehensive reports that delineate potential risks, categorized by criticality and associated level of effort. Subsequently, the Company will undertake a meticulous examination of the internal risk register to potentially recalibrate the likelihood of identified risks, taking into consideration the vulnerabilities unearthed by the third-party assessment. Depending on the type of services required, the sensitivity of the relevant IT systems and data, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents in the past three fiscal years, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information about our cybersecurity related risks, see Part 1, Item 1A, Risk Factors under the risks titled "Breaches of our information systems could have a material adverse effect on our business and results of operations" and "If our information technology systems are disrupted, or if we fail to successfully implement, manage and integrate our information technology and reporting systems, our business, results of operations and financial condition could be harmed."

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. We may nevertheless be unsuccessful in the future in preventing or mitigating a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. At December 31, 2023, management has assessed known cybersecurity incidents for potential materiality and disclosure using formal documented processes and has determined that there have been no material cybersecurity incidents, individually or in aggregate.

companyName: S&T BANCORP INC

ticker: STBA


text: We have a structured process to identify and oversee material cybersecurity risks. We maintain a robust set of cybersecurity policies that set the standards and expectations for our associates, contractors and vendors to follow. We report cybersecurity metrics quarterly to our technology leadership, including our CIO and CISO, and our Enterprise Risk Management team. We have an Executive Risk Council, comprised of executive leadership across the business, which is briefed quarterly on the latest cybersecurity threats impacting our business, and the progress of recent and ongoing cybersecurity program efforts, incidents and risk assessments. The Executive Risk Council provides input as needed to strengthen our cybersecurity controls and risk management.

companyName: Victoria's Secret & Co.

ticker: VSCO


text: • Incident Response and Recovery Planning: The Company has established and maintains systematic incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis. • Third-Party Risk Management: The Company maintains a systematic, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: The Company provides regular, mandatory cybersecurity training for all personnel as a means to equip the Company's workforce with effective tools to recognize, address and communicate potential or actual threats to the Company's cybersecurity systems. Moreover, these trainings also allow Company personnel to remain up-to-date with evolving information security policies, standards, processes and best practices.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and review our PCI compliance.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: The Company maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact on our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: NOBILITY HOMES INC

ticker: NOBH


text: Our cybersecurity risk management and strategy processes are managed by the head of our Information Technology department, and our IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices.

companyName: Varex Imaging Corp

ticker: VREX


text: We maintain a 24 x 7 operations center which serves as a central location for the reporting of cybersecurity matters, provides monitoring of our global cybersecurity environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.

companyName: CATERPILLAR INC

ticker: CAT


text: The Committee receives annual reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Neumora Therapeutics, Inc.

ticker: NMRA


text: We recognize the importance of developing, implementing and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity and availability of our data.

companyName: KinderCare Learning Companies, Inc.

ticker: KLC


text: The Board is responsible for the oversight of risks, including from cybersecurity threats. At least annually, the Vista CISO provides the Board with an overview of Vista's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, and the Incident Response Plan, as well as the steps taken to respond to such risks. Material cybersecurity threat risks are also considered during Board meeting discussions of matters such as enterprise risk management, operational budgeting, business continuity planning, brand management and other relevant matters.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.