text: Management's Role in Cybersecurity Risk Management Our management, including our Response Team, is responsible for assessing and managing material risks from cybersecurity threats. Our management continuously assess, meet and prioritize cybersecurity risks and actions taken to mitigate these risks. Members of our management possess relevant expertise in various disciplines that are key to effectively managing such risks. We leverage the resources of Monroe Capital, including the Head of Information Technology, who provides resources and expertise to assist us in our cybersecurity program. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting us, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of our Advisor.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer, and the Chief Executive Officer. The Company's information technology department and managed service partners work with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response plan includes reporting to the audit committee of the board of directors and the chair of the board of directors for certain cybersecurity incidents. The audit committee of the board of directors periodically receives summaries or presentations from the Vice President, Head of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them.

companyName: Vor Biopharma Inc.

ticker: VOR

secItem: Item 1C


text: Cybersecurity risk is considered a significant corporate risk by management. Our technology security team provides our management with a weekly cyber update that discusses cybersecurity threats impacting Oncor. Management of our cybersecurity risks begins at the individual employee level, with each employee having responsibility for operating in a cyber safe manner, and flows up to our board of directors, which has overall oversight over Oncor's corporate risk management efforts. The board of directors has delegated its risk management oversight to the Audit Committee, whose charter provides that it is responsible for discussing with management our major risk exposure, and the steps management takes to monitor and control such exposure, including our risk assessment and risk management process, guidelines, policies and practices.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Board of Directors has overall oversight responsibility with respect to our approach to risk management, including risks relating to cybersecurity. Although the Board of Directors has the ultimate responsibility for risk oversight, our management team, including our President and CEO, has operational responsibility for cybersecurity matters, including the day-to-day management of our cybersecurity risks, and oversees processes for the prevention, detection, mitigation and remediation of any cybersecurity incidents. While our management team does not have cybersecurity expertise, we coordinate with expert consultants to assess and manage risks. Our Board of Directors reviews cybersecurity threats and risk controls at quarterly meetings based on information provided by management and outside consultants.

companyName: IMMUCELL CORP /DE/

ticker: ICCC


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures and engaged third-party service providers to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein.

companyName: COMSTOCK RESOURCES INC

ticker: CRK


text: The Company has previously experienced significant cybersecurity incidents. Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: Our cybersecurity risk management program includes a control framework and operations that utilizes tools and processes designed to prevent, detect, and analyze current and emerging cybersecurity threats, and we maintain plans and strategies to address any cybersecurity threats and incidents. These tools and processes include, but are not limited to, periodic cybersecurity risk assessments and vulnerability analyses, as well as monitoring for critical risks from cybersecurity threats using automated tools. Personnel at all levels and departments are made aware of our cybersecurity policies through participation in cybersecurity risk awareness trainings during onboarding and on an annual basis thereafter.

companyName: Entrada Therapeutics, Inc.

ticker: TRDA


text: AFG's Audit Committee is responsible for the oversight of risks from cybersecurity threats. At least annually, the full Board of Directors receives and at least quarterly, the Audit Committee receives an overview from the Chief Information Security Officer ("CISO") or another senior member of the EISG of the Company's cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards predetermined risk-mitigation-related goals, incident response planning and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, materials including a cybersecurity scorecard and other information indicating current and emerging material cybersecurity threat risks and describing the Company's ability to mitigate those risks are provided. Members of the Board also regularly receive educational materials and engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to AFG's cybersecurity risk management and strategy programs.

companyName: AMERICAN FINANCIAL GROUP INC

ticker: AFG


text: Our Board is responsible for overseeing enterprise-wide risk management and is actively involved in the monitoring of risks that could affect us, including cybersecurity risks. Pursuant to its charter, one of the key responsibilities of the Audit Committee of our Board is oversight of our information and cybersecurity programs and it receives regular reports on cybersecurity, information technology and other related matters and risks. The Audit Committee regularly briefs the Board on matters relating to its information technology and cybersecurity risk oversight.

companyName: RENAISSANCERE HOLDINGS LTD

ticker: RNR


text: Management plays a critical role in cybersecurity risk assessment and management. The key roles and responsibilities are summarized as follows: i. Management Responsibilities Key management personnel, tasked with cybersecurity risk management, are equipped with expertise that encompasses extensive experience in cybersecurity, academic credentials, and professional certifications. Specific cybersecurity expertise and certifications held by management include bachelor's degrees in technology and network security, industry certifications (CompTIA A+, CompTIA Network+, CompTIA Security+, Microsoft Certified Professional, Cisco Certified Network Associate), and public sector (military) experience in network security. Management personnel hone their skills to meet new demands through continuing professional development. Additionally, all employees are subject to ongoing cybersecurity training.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: As part of its cybersecurity program, the Company deploys measures to deter, prevent, detect, respond to and mitigate cybersecurity threats, including firewalls, anti-malware, extended detection and response systems, identity and access controls, strong password controls, multi-factor authentication, software patching protocols, and physical security measures. The Company periodically assesses and tests the Company's policies, standards, processes, and practices that are designed to address cybersecurity (including artificial intelligence-related) threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, vulnerability scanning, and performing external penetration testing. The Company has a process to report material results of such testing and assessments to the Board, and periodically adjusts the Company's cybersecurity program based on these exercises. The Company engages third parties to oversee and conduct part of such testing, as well as perform external audits of security protocols and capabilities. The Company seeks to identify and oversee cybersecurity risks presented by third parties and their systems from a risk-based perspective by identifying critical vendors (defined based on capabilities provided and investments required) and reviewing software patching, upgrades and associated changes required to reduce risk. The Company also conducts cybersecurity training for employees, including mandatory training programs for system users. The Company's training programs require employees to complete a knowledge check prior to completion of the program. Completion of the Company's training programs is monitored by management.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: Our Corporate Compliance Officer is Lynn A. Feldman, the Company's Executive Vice President, Chief Legal Officer and Corporate Secretary. Ms. Feldman has over 20 years of experience leading the legal and risk management departments of public companies. Her areas of responsibility cover privacy, cybersecurity risk and data protection; governance, including with respect to cybersecurity; and global legal compliance and reporting. For additional information about Ms. Feldman's experience, please refer to the " Information About Our Executive Officers " section in this Annual Report on Form 10-K.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CISO holds industry-recognized cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) certification.

companyName: FLEX LTD.

ticker: FLEX


text: We have both policies and procedures that align with the National Institute of Standards and Technology Cybersecurity Framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, encryption and access control, and employee training. Our CIO, together with our Global Security Committee, reviews emerging threats, controls, and procedures as part of assessing, identifying, and managing risks. Risks identified by our cybersecurity program are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed.

companyName: PILGRIMS PRIDE CORP

ticker: PPC


text: Our cybersecurity team regularly updates the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.

companyName: Pactiv Evergreen Inc.


text: Our cybersecurity risk program is structured according to the National Institute of Standards and Technology (NIST) Cybersecurity framework. This program includes multiple layers of security controls, including network segmentation, security monitoring, endpoint protect, and identity and access management. The Company annually engages third parties to advise and assess the Company's cybersecurity programs, including to engage in penetration testing. The results of these assessments are reported to the CISO and our CISO, in consultation with our CIO and General Counsel, use the findings to improve our practices, procedures, and technologies. A summary of our cybersecurity efforts is reported to the Audit Committee, which has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity, regularly. Our Board also receives periodic updates relating to information security and cybersecurity risks. We have also purchased cyber liability insurance to provide a level of financial protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover or be sufficient to cover all losses or claims that may result from a cybersecurity incident.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: As adopted by our businesses, which has been overseen by our corporate executive team, we have a cybersecurity incident response plan that outlines our policies and procedures to identify, respond to, and recover from cybersecurity threats and cybersecurity incidents. Our businesses are required to conduct regular exercises of their incident response plan as part of our program.

companyName: TransDigm Group INC

ticker: TDG


text: Board of Directors' Oversight and Management's Role Our Vice President, Information Technology oversees the Company's cybersecurity initiatives. The head of the IT Risk & Cyber Security delivers quarterly updates to senior leaders, discussing the effectiveness of our cybersecurity strategy and to communicate our program, health, performance, metrics, and roadmap. In addition, our Vice President, Information Technology is responsible for upward reporting of emerging cybersecurity incidents.

companyName: Enviva, LLC


text: We also maintain a Cyber Incident Response Team, which includes a board representative and an executive officer representative and is chaired by our Senior Vice President/ Operations & IT Manager. The Cyber Incident Response Team is charged with developing and implementing incident response and recovery plans to guide our employees, management and the Board in their response to a cybersecurity incident.

companyName: Bank7 Corp.

ticker: BSVN


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. We also have a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: Innventure engages third parties to perform various cybersecurity services and risk assessments. In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, Innventure performs diligence on third-party service providers that provide critical data.

companyName: Innventure, Inc.

ticker: INV


text: The Cybersecurity Committee receives regular reports from our Chief Information Officer (" CIO ") regarding any significant cybersecurity events, as well as any events with lesser impact potential. The CIO periodically reports to the Board of Directors regarding cybersecurity risks and our cybersecurity risk management program. Board members periodically receive presentations on cybersecurity topics from our CIO or external experts as part of the Board of Directors' continuing education on topics that impact public companies.

companyName: Penguin Solutions, Inc.

ticker: PENG


text: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology. We identify risks from various sources, including vulnerability scans, penetration tests, vendors risk assessments, product and services audits, internal compliance assessments and threat-hunting operations. We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: In the event of a cybersecurity incident, the CSO initiates our incident response plan that includes actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Our incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including reporting to the Cybersecurity Committee and the Board for certain cybersecurity incidents.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: Risks that could affect us are an integral part of the board of directors of our general partner and Audit Committee deliberations throughout the year. The board of directors of our general partner has oversight responsibility for assessing the primary risks facing us (including cybersecurity risks), the relative magnitude of these risks and management's plan for mitigating these risks, while the Audit Committee has been delegated the authority to oversee and periodically review the security of Cheniere's information technology systems and controls, including programs and defenses against cybersecurity threats. The Audit Committee discusses with management our cybersecurity risk exposures and the steps management has taken to mitigate such exposures, including our risk assessment and risk management policies. On a quarterly basis, Cheniere's cybersecurity leadership team updates the Audit Committee on the overall status of our cybersecurity program, key operational metrics, current assessments, cybersecurity issues or events and pertinent events related to cybersecurity.

companyName: Cheniere Energy Partners, L.P.

ticker: CQP


text: Our Board of Directors exercises oversight of the most significant cybersecurity risks, and for our processes to identify, prioritize, assess, manage, and mitigate those risks, through the review of Information Security reports presented by the Executive Vice President of Global IT and eDiscovery Operations, who has over 20 years of industry experience, and the Vice President and Chief Information Security Officer, who has over 20 years of industry experience and holds a wide array of industry certifications. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. When and where applicable, the Board of Directors provides input regarding the ISMS in response to the information security reports and as part of their corporate oversight responsibilities. The Board of Directors' input is leveraged by Senior Information Security leadership as they evaluate and develop plans for continuous improvements of our ISMS to address an evolving landscape of cybersecurity threats. The execution of the Information Security Management System is the responsibility of our Senior Information leadership and the Information Security team.

companyName: KLDiscovery Inc.


text: Our cybersecurity risk management is integrated into our overall risk management system through our internal business risk management process. Our business risk management group works closely with our ICSP group to regularly assess and identify possible material risks from cybersecurity threats, including, but not limited to, financial, operations, reputational and regulatory impact to the Company, as well as impacts on our employees and customers. Their risk assessment results are reported to the Executive Risk Committee on a quarterly basis. The Executive Risk Committee, which is comprised of our executive officers, meets quarterly to identify and assess short-, medium- and long-term risks, and to ensure adequate mitigation strategies are implemented. During these meetings, the Executive Risk Committee reviews significant and emerging risks, including cybersecurity risks, and assesses the Company's plans to mitigate or otherwise manage and monitor those risks.

companyName: Otter Tail Corp

ticker: OTTR


text: As we utilize third-party service providers for important aspects related to the collection, storage and transmission of sensitive data, we require a risk based vendor management process to ensure the safety of our sensitive data that they store or process. We conduct a formal vendor management process on all third-party service providers that provide services that utilize or create sensitive information, which includes initial and yearly risk assessments performed by experienced third party risk management personnel, annual vendor assessments of performance including onsite review of security programs for vendors that handle sensitive customer data, and entering into Business Associate Agreements with an Information Security Addendum and Data Use Agreements in contracts for vendors that process sensitive Sharecare information that define security requirements, incident reporting, corrective action management and handling of data.

companyName: Sharecare, Inc.


text: The CISO has over 27 years of experience with information technology management, information security, compliance, audit, and process improvement. Our Information Security Analysts have a combined 23 years of experience with information security, information technology servers and information technology networks. The CISO and Information Security Analysts are active members of the following management level committees at the Bank: Information Technology Steering Committee and the Change Control Committee.

companyName: CHEMUNG FINANCIAL CORP

ticker: CHMG


text: Our Global Leadership Team is responsible for the execution of CRH's strategy and governance, including implementation and review of our ERM framework, which has identified cybersecurity as a core risk for CRH. CRH has established the role of CISO to provide technical leadership on a day-to-day basis in assessing and managing the Company's material cybersecurity risks and liaising with the chief information officers of CRH's Divisions. Our CISO has 25 years of experience working in IT, including more than a decade spent in prior technical and senior management roles related to cybersecurity. The divisional chief information officers have in excess of 20 years of experience, on average, in IT-related and cybersecurity-related roles and, together with the CISO, hold a variety of recognized and specialized credentials related to cybersecurity and IT.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: We engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing and assessments. We have a process to assess certain major third-party vendors and service providers, including through a review of responses to compliance questionnaires and contractual requirements, as appropriate.

companyName: Cabaletta Bio, Inc.

ticker: CABA


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our Information Security, Network Administration, Compliance and Legal teams regarding matters of cybersecurity.

companyName: Usio, Inc.

ticker: USIO


text: We acknowledge the potential material impact that cybersecurity threats and incidents can have on our operations, financial condition, and reputation. While we did not experience any significant cybersecurity incidents during the reporting period, we recognize that such incidents could include: Disruption of our operations, potentially leading to revenue loss;

companyName: URBAN ONE, INC.

ticker: UONE


text: Our management team, including our CIO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO has over three decades of IT experience in life sciences organizations. Her cybersecurity work includes the development and implementation of cybersecurity policies, platforms, and robust end-user training curriculums. Our CIO and IT Information Security Group work together to monitor and r eport cybersecurity trends and threats to management. Additionally, we work with an external IT partner and external cybersecurity counsel to assess, identify, and manage risks from cybersecurity threats. The IT Information Security Group undertakes table-top business disruption, disaster recovery and related response strategies, and plans on a periodic basis, and aims to review, and if appropriate update, applicable policies and procedures annually.

companyName: Seres Therapeutics, Inc.

ticker: MCRB


text: • TRAINING: All Outset employees are assigned HIPAA and information security training as part of the new employee onboarding process and refresher training is assigned annually. Our IT team also conducts continuous automated phishing simulation campaigns, which can trigger additional training for employees on how to recognize social engineering attempts (e.g., phishing, smishing, etc.). We track employee performance on phishing exercises to help us monitor the awareness of our employees and inform future training priorities. For employees whose jobs require access to sensitive data, including PHI, additional security training may be required.

companyName: Outset Medical, Inc.

ticker: OM


text: We face a number of risks including the growing threat of cybersecurity attacks. Despite our implementation of security measures to combat the threats of cybersecurity attacks, any system failure, accident or security breach could result in disruptions to our operations. To the extent that any disruption, cybersecurity attack or other security breach results in a loss or damage to our data or inappropriate disclosure of confidential information, our business could be harmed. In addition, we may be required to incur significant costs to protect against damaged caused by these disruptions or security breaches in the future.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: The Company's management team is responsible for the day-to-day management of cybersecurity risks faced by the Company. In addition, our Board, as a whole and through its Audit Committee, is responsible for the oversight of cybersecurity risks. In that role, the Board and Audit Committee are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, Board and Audit Committee receive periodic updates on the Company's Information Security Program, cybersecurity policies and practices, ongoing efforts to improve security, as well as the Company's efforts to prevent, detect, mitigate, and remediate significant cybersecurity incidents.

companyName: Bridgewater Bancshares Inc

ticker: BWB


text: We have adopted the National Institute of Standards and Technology - Cybersecurity Framework (NIST-CSF) to guide our risk assessment and management and promote a company-wide cybersecurity risk management culture. Our cybersecurity team works closely with our information technology (IT) department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: NERDWALLET, INC.

ticker: NRDS


text: The Board of Directors is ultimately responsible for our Information Security Program, and it has delegated to the Audit Committee primary oversight responsibility for this program. The Audit Committee periodically reviews the program and information security, cybersecurity, and technology risks. At least quarterly, the Audit Committee reviews and discusses with management and our senior information officers the Information Security Program, including the structure and function of the program and any enhancements made to the program as a result of third-party reviews or an identified security risk. The Audit Committee regularly briefs the Board on these discussions. In addition, our Incident Response Policy outlines procedures pursuant to which cybersecurity incidents or risks are escalated within the Company, and, as applicable, timely reported to the Audit Committee and Board.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: With more than two decades of cybersecurity and information security experience, our CISO leads our cybersecurity risk management team and holds certifications including CISSP, CISA, CISM, and CRISC. Leveraging their cybersecurity experience, knowledge of our company and leadership, our CISO plays an important role in both the strategic development and tactical execution of our cybersecurity risk management program. Our CISO reports to the Chief Information Officer ("CIO") and regularly consults with our Chief Legal Officer ("CLO") and other members of the legal team, as well as outside cybersecurity counsel, for strategic and operational input on risk management and compliance with applicable cybersecurity laws and regulations.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. Such briefs include updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: REMARK HOLDINGS, INC.

ticker: MARK


text: The IT Provider reports to the President and upper level management of the Affiliated Group as part of the risk management process in which IT Provider management identifies significant risks through discussions with Affiliated Group management and develops responses and mitigating actions to address such risks.

companyName: KAANAPALI LAND LLC

ticker: KANP


text: Cybersecurity Risk Oversight Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same. In particular, our CISO oversees information security compliance, as described above. The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity. The Information Security Program is approved on an annual basis. Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: We engage third party professionals to assess our cybersecurity program and to perform audits of portions of our cybersecurity control environment based on risk or where necessary to ensure regulatory compliance. In addition, our internal audit function regularly meets with the cybersecurity team and is implementing a program to periodically test the control framework and operation of our cybersecurity incident response plan. The results of these tests will be presented directly to the Audit Committee of the Board of Directors.

companyName: FRANKLIN COVEY CO

ticker: FC


text: In addition, the Board, both as a whole and through its Risk Committee (the "Risk Committee"), is responsible for the oversight of risk management, including cybersecurity risks. In that role, the Board and the Risk Committee, with support from the Company's cybersecurity advisors, are responsible for ensuring that the risk management processes designed and implemented by management are adequate and functioning as designed. To carry out those duties, both the Board and the Risk Committee receive quarterly reports from the Company's management team regarding cybersecurity risks and the Company's efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

companyName: ALERUS FINANCIAL CORP

ticker: ALRS


text: The Audit Committee of the Board of Directors oversees the Fund's cybersecurity risk exposures and the steps taken by management to monitor and mitigate identified risks. The Chief Compliance Officer briefs the Audit Committee on the effectiveness of the cyber risk management program at least on a quarterly basis. In addition, cybersecurity risks and cyber incidents, if any, are reviewed by the Fund's Board of Directors at least annually as part of the risk mapping exercise, or as warranted in the event of material incidents.

companyName: Venture Lending & Leasing IX, Inc.


text: The Board considers cybersecurity risks in business strategy by getting updates on cybersecurity risk assessment. It assesses the experience of management personnel responsible for preventing, mitigating, detecting, and remediating any cyber incidents, including the VP of Information Technology as well as third-party providers. The Company has not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition.

companyName: ORTHOPEDIATRICS CORP

ticker: KIDS


text: In accordance with our data security incident response plan, management is required to promptly update and discuss with the Audit Committee any material or potentially material cybersecurity incidents and provide an update to the Board upon determination that an incident is material. Management regularly updates the Audit Committee regarding incidents with lesser impact potential.

companyName: LANDS' END, INC.

ticker: LE


text: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factor entitled "Increased global cybersecurity threats and more sophisticated, targeted computer crime could pose a risk to our operations" in Part I, Item 1A of this report.

companyName: APTARGROUP, INC.

ticker: ATR


text: Our Information Technology team, under the direction of the Chief Executive Officer, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. They have many years of experience in various technology-related functions including security, auditing, compliance and systems. Our executive officers are briefed regularly on information security, including discussion of processes such as those listed above to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: Fathom Digital Manufacturing Corp


text: We have implemented two risk management groups, the Enterprise Risk Management Committee, and the Cybersecurity Steering Committee. These committees meet quarterly. They are responsible for the overall governance of our cyber management. The implementation of the Cyber polices and strategy is the responsibility of the Chief Information Officer and the Director of Cyber Security. The CIO reports to the Chief Administrative Officer and the Director of Cyber Security reports to the CIO. We also have a team of full-time cybersecurity specialists who hold various industry technology accreditations. The CIO has more than 35 years in Senior IT Leadership positions, and the Director of Cyber Security has more than 30 years IT experience overall, 15 of which are in leadership roles.

companyName: AMETEK INC/

ticker: AME


text: Further, as of part of the Company's overall information security program, the Company conducts a security awareness program, which includes training that reinforces the Company's security management policies, standards, and practices, as well as the expectation that employees comply with these policies, standards and practices. The Company's security awareness program engages personnel through mandatory periodic training on identifying potential cybersecurity risks and protecting the Company's resources and information. The Company also annually engages third parties (as well as its internal audit department) to audit the Company's information security programs. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and ongoing monitoring.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: We do not believe that our Company, including our business strategy, results of operations, or financial condition, have been materially affected by any cybersecurity incidents for the reporting period covered by this Annual Report on Form 10-K. For further discussion of the risks we face from cybersecurity threats, including those that could materially affect us, refer to "Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "We face risks associated with security breaches through cyber-attacks, cyber intrusions or otherwise, as well as other significant disruptions of our IT networks and related systems."

companyName: City Office REIT, Inc.


text: The Company maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management system and disclosure committee. The program addresses the corporate information technology environment, third-party service providers and customer-facing products and applications.

companyName: Perception Capital Corp. IV


text: While our Board and Audit Committee oversees cybersecurity risk, senior management is responsible for actively managing cybersecurity risk, including overseeing and executing the risk management strategies discussed above. Senior management reports to the Board semi-annually on our enterprise risk management processes, ensuring transparency and accountability.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: We also consider cybersecurity, along with other risks to us, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the enterprise level, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition.

companyName: SONIDA SENIOR LIVING, INC.

ticker: SNDA


text: Third-party service providers are managed through an established third-party risk management program. This includes processes to identify and assess cyber risk associated with the third-party service following a phased lifecycle including due diligence and selection, ongoing oversight and monitoring, and termination and exit planning. Third Party service providers are also required to notify the Company through established channels of any cyber incidents that may impact services or customers. Risks identified through any of these programs are managed through an enterprise risk and issue management process.

companyName: Santander Holdings USA, Inc.


text: Our Board of Directors is primarily responsible for overseeing and governing our cybersecurity risk management program. The Audit Committee of our Board of Directors is responsible for overseeing management's processes for identifying and mitigating risks that affect our operations, including cybersecurity risks. Procedures for assessing, identifying and managing cybersecurity-related risks are incorporated into our overall risk management framework. Senior leadership regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Audit Committee is apprised of cybersecurity incidents deemed to pose a critical risk to our information technology ("IT") assets or business. We rely upon in-house and third- party cybersecurity vendors to monitor our IT systems and assets and have a governance structure and processes to assess, identify, manage, and report cybersecurity risks.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: We recognize the critical importance of maintaining the trust and confidence of business partners, such as CROs and CMOs, clinical trial investigators, patients and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: Management oversees our enterprise risk management process. Under the supervision and with the participation of our management, including our Principal Executive Officer and Principal Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. Management receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks presented, a detailed description of the actions we have taken to mitigate these risks and an analysis of cybersecurity threats and incidents across the industry. Management reviews the results of the enterprise risk assessment in detail on a regular basis.

companyName: Copper Property CTL Pass Through Trust

ticker: CPPTL


text: Our CISO, who heads our CDT team and is accountable for the Company's cybersecurity risk management program, joined the Company's information systems organization in 2016, is a Certified Information Systems Security Professional and is certified in risk and information systems control. Previously, our CISO served in both leadership and operational positions as a cybersecurity professional in the U.S. government and was a cybersecurity consultant, providing a wide range of cybersecurity services to various U.S. government agencies and departments. Our CISO is overseen by our CIO, who has 27 years of experience in information systems (including over 14 years at the Company and more than 6 years as a senior technology executive outside of Amgen), and holds a Computer Information Systems B.S. and an Information Technology Management MBA. Our Executive Vice President and Chief Technology Officer (CTO) leads our ATMOS function and oversees our CIO.

companyName: AMGEN INC

ticker: AMGN


text: We have insurance coverage in place for certain potential liabilities and costs relating to cybersecurity risks, data security incidents and/or network security breaches, but this insurance is limited in amount, subject to a deductible, and may not be adequate to cover us for all costs arising from these incidents.

companyName: Inogen Inc

ticker: INGN


text: We engage third party experts to monitor for and identify cyber threats. Both management and the third party provider receive alerts regarding cyber threats. The third party provider has the ability to act on our behalf to respond to any threats it identifies. We also use, among other things, endpoint monitoring, anti-virus software, multi-factor authentication, and data encryption to assist with managing cyber risks and identifying cyber threats. In addition, we engage a cybersecurity consultant to regularly assess cyber risks and threats and provide recommendations and plans to mitigate those risks.

companyName: CENTERSPACE

ticker: CSR


text: Cybersecurity risk oversight is a focus area of our Risk Management Committee and the full Board of Directors. The Risk Management Committee's charter requires it to assist the Board of Directors in identifying and evaluating risks inherent in our business and to oversee and review the significant policies, procedures, and practices employed to manage risks. The Risk Management Committee receives a quarterly cybersecurity update from the Chief Administrative Officer, which is shared with the full Board of Directors. The Board of Directors discusses cybersecurity matters and risks on a quarterly basis or more frequently, as needed, at the recommendation of the Risk Management Committee.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, and access controls. We also employ multi-factor authentication and a managed endpoint detection and response solution for malware. These measures are evaluated and improved through vulnerability assessments and penetration testing completed by third party experts, as well as cybersecurity threat intelligence.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Board of Trustees Oversight Our Board of Trustees oversees various risks that the Company may face from time to time. While the full Board of Trustees has primary responsibility for risk oversight, it has delegated to the Audit Committee the responsibility for overseeing the Company's enterprise risk management and risk mitigation policies and programs, including matters related to privacy and cybersecurity. The Audit Committee reviews the Company's cybersecurity risks and the effectiveness of its cybersecurity program every quarter, including current threat levels and ongoing program enhancements. Reports on these topics are provided to the Audit Committee by the Vice President, Chief Information Security Officer ("CISO") and the Vice President, Internal Audit and Enterprise Risk Management on a quarterly basis. In addition, when appropriate, cybersecurity risks and incidents will be reported to the Board of Trustees by the Company's Chief Financial Officer.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. Should a cyber incident occur, we have in place the Insulet Cybersecurity Incident Response Procedure ("CIRP"), which is designed to enable us to respond efficiently to any incidents. Pursuant to the CIRP, cybersecurity incidents are reviewed and rated by our CISO and his team. A cybersecurity incident rated at predefined risk levels will be escalated to CTO, the Chief Compliance Officer, and the General Counsel and assessed for materiality and disclosure to the CEO and the Board. Our internal Disclosure Committee would review any planned public disclosures or filings. CIRP provides the organizational and operational structure to respond to incidents that may affect the confidentiality, integrity or availability of our information systems.

companyName: INSULET CORP

ticker: PODD


text: Our Board of Directors is responsible for the oversight of risks from cybersecurity threats. Our Chief Information Officer provides our Board of Directors quarterly reports that summarize material cybersecurity threats and the countermeasures taken to mitigate the associated risks. These reports address a variety of topics including updates on strategic cyber initiatives, industry trends, threat vulnerability assessments, and efforts to prevent, detect, and respond to internal and external critical threats. From time to time, our Board of Directors also engages third-party consultants to provide further education about cybersecurity risks.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Audit Committee has been designated with oversight responsibility for cybersecurity risks and our Chief Financial Officer is responsible for managing our efforts in this area. Neither the Chief Financial Officer nor any member of the Audit Committee has relevant expertise in cybersecurity. Rather, the Company retains an outside technical expert to support our information technology systems including addressing cybersecurity risks.

companyName: enVVeno Medical Corp

ticker: NVNO


text: Our board of directors oversees our cybersecurity risk management program through the Audit Committee. Our management team, including our Senior Vice President of Operations, provides periodic updates on cybersecurity matters to the Audit Committee, which relays them to the board of directors as needed. Our Senior Vice President of Operations has primary responsibility for assessing and managing cybersecurity risks and leading our overall cybersecurity posture, including the engagement of external third parties to assist us. Our Senior Vice President of Operations has 10 years of experience in the field of information systems and cybersecurity.

companyName: INFINITY NATURAL RESOURCES, INC.

ticker: INR


text: In the event of a cybersecurity incident, we have established incident response plans and protocols to minimize the impact and facilitate swift recovery. The Company's Audit Committee oversees cybersecurity risk. The Audit Committee is promptly notified by Information Technology leadership of any potentially serious incidents including details and recommendations on the detection, mitigation, and remediation of the same. During the calendar year 2024, there have been no known reported cybersecurity incidents that have materially affected our believe in transparency and open communication, promptly informing affected parties and relevant authorities as required by law. Together, we remain vigilant, adaptive, and resilient in the face of evolving cyber threats, safeguarding the trust and confidence of those we serve.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: The Cooperative's Board of Directors believes a strong cybersecurity strategy is vital to protect our business operations, sustain our control environment and honor our data protection obligations. The Board has delegated to its Finance & Audit Committee the responsibility for monitoring the effectiveness of the Cooperative's internal cybersecurity practices. The Executive Vice President manages the Cooperative's cybersecurity-related risks, communicates with suppliers and other third party providers regarding cybersecurity threats, incidents, plans and responses, and reports to the Finance & Audit Committee and/or the entire Board regarding such cybersecurity threats, incidents, plans and responses on at least a semi-annual basis, and more often as needed.

companyName: Golden Growers Cooperative

ticker: GGROU


text: The IT Director meets with the Chief Financial Officer, the Chief Compliance Officer, and the General Counsel periodically to monitor and review the outcomes of our cybersecurity program and to discuss and decide matters related to cybersecurity treatment strategy (including mitigations). The IT Director and the Chief Financial Officer provide periodic reports to the audit committee on cybersecurity risk management, and, quarterly, the Chief Financial Officer updates the audit committee of any material changes in the Company's cybersecurity framework or cybersecurity activity. The audit committee is responsible for reviewing and overseeing our risk management process, including risks from cybersecurity threats, pursuant to the audit committee charter. Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. In its risk oversight role, our board of directors has the responsibility to confirm that the risk management processes designed and implemented by management are appropriate and functioning as designed.

companyName: Esperion Therapeutics, Inc.

ticker: ESPR


text: We have contracted with various service providers (vendors) who provide a broad range of services, including core banking, communications, collaboration and infrastructure services. We have established a vendor management policy to establish the principles, framework, and guidance for the effective review, engagement, monitoring, and oversight of vendors to ensure that we adequately manage operational, strategic, reputational, and other related risks inherent in outsourcing of services or operations. We manage the cybersecurity risks posed by our use of third-party service providers by conducting periodic risk assessments.

companyName: SANDY SPRING BANCORP INC


text: Our Senior Vice President of Human Resources and Administration, who reports directly to our interim Chief Executive Officer, is responsible for overseeing the assessment and management of cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have no identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Data breaches and cyber-attacks can compromise our intellectual property or other sensitive information and cause significant damage to our business."

companyName: Assertio Holdings, Inc.

ticker: ASRT


text: Our Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Information Security Officer ("CISO"), via our Audit & Risk Committee, which is assigned oversight of cybersecurity risks. Our Audit & Risk Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: Based on our assessment process, we implement and maintain various technical, physical and organizational measures, processes, standards, and policies designed to manage and mitigate such risks and potential material impacts to our Information Assets. The various risk management and reduction measures we implement for certain areas of our environment and systems include: maintaining policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; conducting internal and external audits designed to assess our exposure to certain cybersecurity threats, compliance with internal risk mitigation procedures, and effectiveness of relevant controls; conducting background checks on certain of our and our third parties' personnel; adopting network security controls in certain environments and systems; segregating certain data; adopting physical and electronic access controls and; asset management procedures monitoring certain systems; implementing a vendor risk management program; training staff on security; conducting red/blue team exercises; maintaining cyber insurance; maintaining a dedicated information security staff; and using a third-party managed security operations center. We seek to prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as exposure of customer data, interruption of services, ransomware, intrusion of networks, and data exfiltration or exposure.

companyName: Grindr Inc.

ticker: GRND


text: Our management team stays informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel, threat intelligence and other information obtained from public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: NATURAL RESOURCE PARTNERS LP

ticker: NRP


text: Our CISO and Cybersecurity Manager implement processes around security monitoring and vulnerability testing. We also have in place an incident response plan, which incorporates four overarching and interconnected stages: (1) preparation for a cybersecurity incident, (2) detection and analysis of a security incident, (3) containment, eradication and recovery, and (4) post-incident analysis. The plan specifies that security events and data incidents should be evaluated, ranked by severity and prioritized for response and remediation. Our procedures include an evaluation of incidents to determine materiality as well as operational, business and privacy impact. Our team of cybersecurity and information security professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.

companyName: iTeos Therapeutics, Inc.


text: Our Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, threats, risks and mitigation. Our Audit Committee also receives information regarding certain cybersecurity risks that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: Through Horizon's enterprise risk management framework and reporting functions, the Board, its Committees and Management assess and manage cybersecurity risks created by cybersecurity threats. Horizon's Vice President, Information Security and Audit Information Security officer ("Information Security Officer") provides an annual Information Security Program report to the Board and as needed when cybersecurity risk is elevated. Horizon's Senior Vice President, Senior Technology Officer is a member of the Cyber Security Committee and reports on cyber security risks at each meeting a minimum of three times a year. The Senior Vice President, Senior Technology Officer reports to the Executive Vice President, Senior Operations Officer, who also is a member of the Cyber Security Committee. For independence, the Information Security Officer reports to Horizon's Senior Vice President, HORIZON BANCORP, INC.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management processes. These processes include identifying and assessing risks from cybersecurity threats associated with the use of third-party service providers, if any. The response to any cybersecurity incident detected or reported is led by our Computer Security Incident Response Team, or the CSIRT, to assess the nature and magnitude of event and classify severity in accordance with our internal policies and procedures. Depending on the severity of the incident, appropriate level of management members, including our Chief Executive Officer, Chief Financial Officer, external legal counsel, and certain members of the finance and investor relations organizations, will be notified and take appropriate actions. In addition, the Information Technology, or IT, team provides periodic reports to the Chief Executive Officer and other members of our senior management, as appropriate, and provides periodic reports to the Audit Committee of the Board of Directors as needed. These reports include updates on our cyber risks and threats as well as the status of previously identified and/or reported cybersecurity incidents, if any. We also actively engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: IOVANCE BIOTHERAPEUTICS, INC.

ticker: IOVA


text: The Board of Directors has oversight into the most significant risks facing us and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee of the Board of Directors (the "Audit Committee") has been designated to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management. The Board of Directors also receives periodic updates from management and the Audit Committee on cybersecurity risks. Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs.

companyName: Enlightify Inc.

ticker: ENFY


text: Cybersecurity is an important part of our risk management and an area of focus for our Board and management. Our Board of Directors is responsible for the risk oversight of the Company, including cybersecurity risks. The Board receives updates on a quarterly basis from senior management, including leaders from our Information Technology and Security, Risk Management. Finance, and Legal teams and our Chief Information Officer regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee of the Company's Board of Directors oversees, among other things, the adequacy and effectiveness of the Company's internal controls, including internal controls designed to assess, identify, and manage material risks from cybersecurity threats. The Board of Directors, as a whole and at the Audit Committee level, oversee the most significant risks facing the Company and our processes to identify, prioritize, assess, manage and mitigate those risks.

companyName: Lovesac Co

ticker: LOVE


text: Identify and assess cybersecurity risks through a variety of methods, including audits to information security standards, threat testing, and vulnerability scanning. Prioritize risks based on their potential severity, likelihood, and detectability.

companyName: NVE CORP /NEW/

ticker: NVEC


text: The identification, detection, prevention and remediation of known or potential IT security vulnerabilities, including those arising from third-party hackers, hardware or software, is extremely costly and time consuming. The Company does not have the manpower, expertise or financial resources to effectively identify, detect, prevent or remediate cybersecurity risks. No assurance or guarantee whatsoever can be given that the Company will not be damaged by the exploitation of its cybersecurity vulnerabilities.

companyName: LSEB Creative Corp.

ticker: LSEB


text: The Company protects its network and information assets with industry-tested security products and processes. Our teams actively monitor company networks and systems to detect suspicious or malicious events. The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments. The Company also conducts vulnerability scans, and contracts with third-party vendors to perform penetration tests against the Company's network. In addition, the Company's Cyber Defense Center team monitors threat intelligence sources to anticipate and research evolving threats, investigates their potential impact to financial services companies, examines the Company's controls to detect and defend against those threats, and proactively adjusts the Company's defenses against those threats. The Company also engages expert cyber consultants, as necessary and appropriate.

companyName: HANCOCK WHITNEY CORP

ticker: HWC


text: The CISO has an incident response plan designed to address potential cybersecurity incidents and notify appropriate leadership while determining the material impact through a cyber sub-committee of management's Disclosure Committee. The plan also includes implementing long-term strategies for recovery and prevention of future incidents.

companyName: Chemours Co

ticker: CC


text: Our CIO and CISO are principally responsible for assessing and managing our material risks from cybersecurity threats, reporting to our CCO. They lead efforts to prevent, identify, detect, mitigate, and remediate material cybersecurity risks and incidents through various means, including by receiving alerts and reports produced by security tools deployed in our IT systems. Together, our CIO and CISO have decades of experience in cybersecurity and in retail, including leadership experience in cybersecurity risk management, incident response and recovery, compliance, governance, IT systems and technology, and overall cyber defense methodologies.

companyName: ROSS STORES, INC.

ticker: ROST


text: While the Evergy Companies have a cybersecurity program designed to protect and preserve the integrity of their information systems, the Evergy Companies also maintain cybersecurity insurance to manage financial statement risk resulting from specific cyber attacks. Although the Evergy Companies maintain cybersecurity insurance, there can be no guarantee that the Evergy Companies' insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid in a timely manner.

companyName: Evergy, Inc.

ticker: EVRG


text: We utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage outside partners to gain intelligence on threats. We take input from industry activities, third party assessments and internal simulations and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections.

companyName: HARROW, INC.

ticker: HROW


text: Alignment's cybersecurity organization is led by David MacLeod, our Chief Information Security Officer, who is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and reports to Robert Scavo, our Chief Information Officer, as well as to the Audit Committee. Mr. MacLeod has served as our CISO since December 2022, has over 26 years of diverse leadership experience in the healthcare information space (including over 20 years as a certified information systems security professional and chief information security officer) and holds advanced degrees in information technology management and computer science.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis. The ERM process's annual risk assessment is presented to the Board of Directors.

companyName: Clearwater Paper Corp

ticker: CLW


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions and provide certain security-related services, such as outsourced business critical functions, professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions; as well as third parties that assist us to identify, assess and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity software providers, penetration testing firms and other vendors that help to identify, assess or manage cybersecurity risks. For certain vendors, our vendor management process includes evaluating the cybersecurity practices of such provider and contractually imposing obligations on the provider related to the services they provide and/or the information they process.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: We monitor and manage our cybersecurity risk and threat exposure through prioritized remediation efforts. Any cybersecurity risk or threat that requires corrective action is managed by our security and compliance team together with certain business partners and IT specialists, as deemed necessary. Potential solutions are assessed in alignment with risk, business and cybersecurity priorities and our controls and security architecture. Plans to remediate cybersecurity risks are approved and monitored regularly for completion.

companyName: Antero Midstream Corp

ticker: AM


text: Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: BIOXYTRAN, INC

ticker: BIXT


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our IT Security, external advisors, and legal teams. These individuals are informed about, and monitor the identification, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above.

companyName: Grove Collaborative Holdings, Inc.

ticker: GROV


text: Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal information technology ("IT") audits, and IT security reviews. To defend, detect, and respond to cybersecurity incidents, we perform cybersecurity reviews of systems and applications; audits of applicable data policies; vulnerability assessments and penetration testing using external third-party tools to test security control; security incident and event management; continuous monitoring, and threat intelligence gathering; conduct employee training; and implement appropriate changes. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: Armata Pharmaceuticals, Inc.

ticker: ARMP


text: Our cyber policies are based on the National Institute of Standards and Technology 800-171 and CMMC Level 2 framework, requiring formal written policies, procedures, plans of action, general security plans and regular audits. In addition, Southland carries Privacy, Security and Technology Insurance covering incidents and responses related to business interruption, data recovery, data breach, extortion and ransomware, and crisis management.

companyName: Southland Holdings, Inc.

ticker: SLND


text: We have implemented various processes and tools to identify cybersecurity threats, detect potential attacks, and protect our data and information technology. We periodically evaluate evolving cybersecurity risks and legal and compliance requirements, and we make ongoing strategic investments to address those evolving risks and requirements.

companyName: STARBUCKS CORP

ticker: SBUX


text: We have created an Information Security Team, consisting of our Chief Financial Officer and our Chief Compliance Officer, to implement and administer our Cybersecurity Policy. Ensuring that all Equus personnel are aware of the Cybersecurity Policy and agree to adhere to its requirements; Establishing that information concerning the Fund is stored on encrypted cloud-based servers accessible only by authorized Equus personnel;

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: The Company recognizes that the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security ("IS") risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee ("ERC") of the Board of Directors provides oversight of the Company's written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established polices, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.

companyName: LAKE SHORE BANCORP, INC.


text: As an element of its information security risk management oversight activities, the F&A Committee reviews the results of our incident response control tests, external and internal audits and penetration testing and oversees our vendor risk management program. The F&A Committee also receives quarterly updates regarding cybersecurity matters from senior management, including Mr. Screven, our Executive Vice President and Chief Corporate Architect (Chief Corporate Architect). In turn, the F&A Committee reports to the full Board of Directors on a quarterly basis regarding the F&A Committee's cybersecurity risk oversight activities. We also have Board members with expansive knowledge and expertise in the area of cybersecurity. In addition to these regularly scheduled updates, our Chief Corporate Architect, Chief Privacy Officer and Head of Global Information Security may also report to the F&A Committee on how certain information security risks are being managed and progress towards agreed mitigation goals, as well as any potential material risks from cybersecurity threats that have been detected by the information security team.

companyName: ORACLE CORP

ticker: ORCL


text: We conduct cybersecurity awareness training annually and simulated phishing campaigns no less than quarterly to test and educate our employees.

companyName: JBG SMITH Properties

ticker: JBGS


text: The CRO, Derek Bonnett, has been employed by the Corporation since 2016, having served as the Director of Internal Audit until being named the Chief Risk Officer in 2021. He has over fourteen (14) years of experience providing risk management advice, insight, and assurance to financial institutions.

companyName: FIRST COMMUNITY BANKSHARES INC /VA/

ticker: FCBC


text: Cyber Espionage: State-sponsored or corporate espionage efforts may target to steal sensitive information, gain intelligence on operations, or disrupt critical infrastructure.

companyName: International Seaways, Inc.

ticker: INSW


text: The program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). The NIST CSF framework provides the basis to evaluate our program for completeness and helps to ensure that the various components of the program are at a level that reduces cybersecurity risk to levels within the Company's risk appetite, taking into account the current threat and regulatory environment. Key components of the cybersecurity program include: • A risk assessment process that identifies and prioritizes cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the board of directors. • A third-party managed detection and response service, which monitors the security of our information systems around-the-clock, including intrusion detection and alerting. • An incident response plan that outlines establishes a structured approach for the Company's response to a cybersecurity incident. The incident response plan is coordinated through the CISO and key members of management are embedded into the plan by its design. The plan facilitates coordination across multiple parts of our organization and is evaluated at least annually. • A training program that educates employees about cybersecurity risks and how to identify and escalate cybersecurity events. • A third-party risk management program designed to ensure that our key vendors meet our expectations on cybersecurity. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with our cybersecurity requirements.

companyName: Third Coast Bancshares, Inc.

ticker: TCBX


text: for all our eData access (emails, online storage, etc.). In addition, all our applications and third-party applications have timed, authentication and environmental disposable cookie processes that force every user to reauthenticate their credentials. Our business transactional data includes dumb access controls that are vendor-specific, a set or specified range of costs, faceless entry point, and a unique 4FA (four factor authentication) process, protecting access to our banking and application systems.

companyName: Strive, Inc.

ticker: ASST


text: The Company's cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, the CIO and the Director of IT Operations. The CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CIO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: TerrAscend Corp.

ticker: TSNDF


text: We design and assess our cybersecurity policies, standards and practices following recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We have established written policies that are provided to all associates regarding identification, classification of severity and escalation of cybersecurity incidents and we provide annual and ongoing cybersecurity awareness training for our associates — including regular training on information security and data privacy policies. We also perform internal audits on our cybersecurity and data privacy practices.

companyName: UNISYS CORP

ticker: UIS


text: The Company engages a third-party provider to maintain our systems and management participates in the assessment to identify any risks from cybersecurity threats. Our third-party provider monitors our firewall, network, system security and internal and external backups and reports any issues to the Company.

companyName: INSPIRE VETERINARY PARTNERS, INC.

ticker: IVPR


text: The Company is subject to attempted cyberattacks and other cybersecurity risks. Our business relies on various information technology and application systems that may be impacted by a malicious cyberattack. Such cyber incidents may cause lost revenues or increased expenses stemming from inability to use certain systems for a period of time, loss of financial assets, fines related to breach of personally identifiable information or other protected information, reputational damage and remediation and litigation costs as well as increased cybersecurity protection costs.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. The threat landscape is constantly changing and will continue to as new technologies, such as AI, evolve.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: The Fund relies on management of the Investment Adviser to implement third-party risk management processes to manage the risks associated with reliance on vendors, critical service providers, and other third-parties that may lead to a service disruption or an adverse cybersecurity incident. This includes assessment of vendors during the selection/onboarding process, internal controls, compliance with service level agreements, and more.

companyName: Wellings Real Estate Income Fund


text: CEO, along with the Board, are tasked with oversight of cybersecurity risks and bear the primary responsibility for this domain.

companyName: Clubhouse Media Group, Inc.


text: The Zoetis information security team regularly provides an information security dashboard to the Audit Committee, covering the most active and relevant threats to Zoetis, relevant trends, and any notable events. The Zoetis information security team regularly presents updates to the Audit Committee with respect to the information security program, including the status of our security measures and our efforts to identify and mitigate information security risks. The Audit Committee also regularly reviews certain data privacy and cybersecurity metrics as part of the compliance update presented to the Audit Committee.

companyName: Zoetis Inc.

ticker: ZTS


text: We are subject to various cybersecurity risks in connection with our business. For additional information, see Item 1A — Risk Factors. As part of our overall enterprise risk management system and processes, we assess, identify and manage material risks from threats to our information systems. Once risks are identified, our Enterprise Risk Management Committee ("ERM Committee"), which consists of executives appointed by the Board, oversees and reviews these risks and provides an annual report regarding such risks to the Audit Committee for further review and evaluation. We also maintain processes to oversee and identify risks from cyber threats associated with our use of third-party service providers, including annual reviews of third-party SOC1 reports.

companyName: Rayonier, L.P.


text: We have employed a multi-layered, risk-based approach to cyber and information security, incorporating a variety of tools and processes to aid in risk identification, assessment and management. The Bank conducts a variety of information security risk assessments throughout the year. We employ a defense in depth strategy that incorporates preventive, detective, and administrative safeguards including but not limited to, configuration hardening, robust patch management and vulnerability scanning, advanced anti-malware firewall technologies, anti-phishing and web filtering controls. These controls are tested annually by an independent third-party audit firm. Quarterly employee training is performed on cybersecurity, information security, identify theft prevention and data privacy. The Bank has not experienced any material losses relating to cybersecurity threats or incidents to date.

companyName: TIMBERLAND BANCORP INC

ticker: TSBK


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the Chief Information Security Officer, who oversees the Company's Trust and Security department, and the members of the Cybersecurity Risk Management Team. Our Trust and Security department has significant collective experience in relevant computer science and engineering disciplines and cybersecurity matters.

companyName: Confluent, Inc.

ticker: CFLT


text: Our Vice President of Strategic Initiatives and Chief Financial Officer oversee our cybersecurity risk management program described in "Risk Management and Strategy" below. While the Board of Directors has overall responsibility for risk oversight, it is supported in this regard by the Audit Committee, including with respect to cybersecurity matters. The Audit Committee assists the Board of Directors in monitoring cybersecurity risk by receiving as needed updates from and engaging in discussions with the Vice President of Strategic Initiatives and the Chief Financial Officer, that cover, among other things, our cybersecurity risk management program, response readiness and training efforts. The Audit Committee updates the full Board of Directors on cybersecurity matters as appropriate.

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: Therefore, we have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk, which may make us susceptible to heightened cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. We have not encountered any cybersecurity incidents since our initial public offering.

companyName: Cohen Circle Acquisition Corp. I


text: Cybersecurity risks and threats. We and certain of our third-party service providers have experienced, and may continue to experience, internal and external cybersecurity threats, which can result in impacts to critical data and confidential or proprietary information and the disruption of certain business operations. Nonetheless, we have not been subject to cybersecurity incidents that, individually or in aggregate, have been material to our operations or financial condition, and we cannot provide assurance that cybersecurity incidents will not have a material impact in the future. See Item 1A. "Risk Factors".

companyName: VECTOR GROUP LTD


text: Based on our assessment process, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate cybersecurity risks and potential material impacts. Depending on the environment or systems, we implement measures designed to prevent, detect, respond to, mitigate, and recover from identified and significant cybersecurity threats. The risk management and reduction measures we implement for certain of our environments or systems include: policies and procedures designed to address cybersecurity threats, including an incident response policy, acceptable use policy, and vulnerability management policy; internal and/or external security audit assessments of select environments to assess our exposure to cybersecurity threats, compliance with risk mitigation procedures, and the effectiveness of relevant controls; documented risk assessments; encryption of certain data; network security controls in certain systems; physical and electronic access controls in certain environments; asset management, tracking and disposal; systems monitoring of certain systems; employee security training; penetration testing of certain environments; maintaining cyber insurance; and a dedicated cybersecurity leader.

companyName: Dutch Bros Inc.

ticker: BROS


text: The Company recognizes the importance of cybersecurity and has implemented a comprehensive program to protect its information assets. Key components of our cybersecurity program include appointment of an Information Security Officer, who is also the Chief Operating officer with extensive knowledge of cybersecurity issues, information security policies and procedures, engagement of third-party security experts, regular penetration testing, managed backup and data protection, managed threat response, hardware and software protections, physical security measures, employee training, internal cybersecurity audits, and ongoing product cybersecurity assessments. The Company maintains cybersecurity insurance covering its internal operations and customer-facing products.

companyName: ESCALON MEDICAL CORP

ticker: ESMC


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Technology, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Technology brings decades of technical experience to our executive risk committee along with technical education in computer engineering.

companyName: Trade Desk, Inc.

ticker: TTD


text: The CISO and man Group's Information Security team are responsible for identifying and assessing reasonably foreseeable internal and external risks to the security, confidentiality, and/or integrity of any electronic, paper, or other records containing non-public information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, including those pertaining to the Company. Additionally, Man Group uses systems and processes designed to reduce the impact of a security incident at a third-party service provider. As part of its risk management process, Man Group also maintains a cyber incident response plan that provides guidance for assessing cybersecurity incidents and is utilized when cybersecurity incidents impacting the Company or the Adviser are detected. Man Group also requires that all employees, including employees of the Adviser, complete periodic information security training, including new hire training, regular compliance training, and periodic informal training pertaining on specific areas of concern.

companyName: Varagon Capital Corp


text: The Company leverages both internal resources and third-party suppliers as needed for technology assets, systems and development to support its information technology security program. The Company uses third-party rather than internal resources when the Company determines that using a third-party better meets the needs of the business. Before contracting with a third-party supplier, the Company determines if the vended resource is compliant with Company policies. Formal approval for a third-party supplier is obtained through the appropriate Company processes according to the type of resource provided by the third-party supplier.

companyName: Finance of America Companies Inc.

ticker: FOA


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our customers expect us to protect their data and the impact of not doing so has financial, reputational, and regulatory implications. Disruptions caused by cyberattacks, data breaches, or system compromises can impact our business operations and financial performance. The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with established plans.

companyName: Upland Software, Inc.

ticker: UPLD


text: Furthermore, AVD has taken measures to prevent cybersecurity breaches, to minimize threats and, to the extent possible, to anticipate trends and identify vulnerabilities before arising to the level of an incident. In short, AVD is pro-active in its approach and has formulated a specific plan to investigate, respond and minimize loss of functionality or other damage from an incident. There are no cybersecurity threats, including as a result of prior incidents, that have materially affected the Company, including our business strategy, results of operations or financial condition as of the date hereof to our knowledge.

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Attacks on our internal IT systems could damage our reputation, cause us to lose revenues, and adversely affect our business, financial condition and results of operations", which should be read in conjunction with the information above.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all Company risks. As part of this process, appropriate HCWB personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigation. A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported by the key members of management, the and the board of directors, as appropriate.

companyName: HCW Biologics Inc.

ticker: HCWB


text: General procedures designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; and outsourced IT security team to assist with managing (1) our cybersecurity procedures, (2) our security controls, and (3) our response to cybersecurity interests.

companyName: INVO Fertility, Inc.

ticker: IVF


text: We maintain an enterprise risk management program ("ERM") designed to assess, identify, manage and mitigate material risks, including cybersecurity risk. ERM is a Company-wide initiative that involves both the Board of Directors and the Company's management. The program is designed to (i) identify and assess risks most critical to the Company's success including through detailed analysis of the likelihood of occurrence and potential impact of each risk, (ii) assign individual executives the responsibility of managing those risks, and (iii) align those management assignments with appropriate board-level oversight.

companyName: Cornerstone Building Brands, Inc.