text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If the confidentiality, integrity, or availability of our information technology, software, services, communications, or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."

companyName: Sweetgreen, Inc.

ticker: SG


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, as further described in Part I, Item 1A, " Risk Factors " in this Annual Report.

companyName: Fresh Tracks Therapeutics, Inc.

secItem: Item 1C


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal IRT personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in our internal IT environment Recognizing the complexity and evolving nature of cybersecurity threats, the Company also engages with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing its cybersecurity management systems and IRP, including its use of third-party service providers. These partnerships enable the Company to leverage specialized knowledge and insights and to assist in updating its cybersecurity strategies and processes to align with industry best practices. The Company's collaboration with these third parties includes consultation and review of security enhancements.

companyName: Solo Brands, Inc.

ticker: SBDS


text: We are a special purpose acquisition company with no business operations. Since our initial public offering, our sole business activity has been identifying and evaluation suitable targets for an initial business combination. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Slam Corp.

ticker: SLAMF


text: InterDigital evaluates cybersecurity risks as part of our overall enterprise risk management. A steering committee of senior executives meets quarterly to evaluate any changes to the Company's exposure to cybersecurity risks, discuss potential mitigation plans and provide updates on mitigation efforts already underway. Our cybersecurity team keeps up to date on the latest threats and risks through multiple channels and is also involved in evaluating risks associated with any new proposed service providers. The Company employs a Director of Cybersecurity & Networks, reporting directly to our CIO, who manages our cybersecurity team that is comprised entirely of security professionals with industry recognized top tier certifications. The cybersecurity team within IS is responsible for assessing and managing risks and informing/gaining feedback from the cybersecurity steering committee.

companyName: InterDigital, Inc.

ticker: IDCC


text: The general objectives for our cybersecurity program are to protect our information systems from cyber threats and to protect the confidentiality, integrity and availability of systems and information used, owned, or managed by Tradeweb and our customers. This involves a comprehensive and ongoing effort to protect against, detect, and respond to cybersecurity threats and vulnerabilities. Our cybersecurity program includes a number of components, such as: • conducting regular risk assessments to identify potential vulnerabilities and threats; • implementing strong cybersecurity frameworks by adopting policies, standards and guidelines derived from a combination of ISO/IEC 27001 principles, the National Institute of Standards and Technology Cybersecurity Framework and industry best practices; • enforcing strict access control policies as appropriate; • implementing strong encryption protocols; • utilizing advanced threat detection systems; • conducting regular security audits and penetration testing; • conducting thorough security assessments of third-party vendors and service providers on an ongoing basis; and • continuous monitoring of our and third-party systems.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for critical service providers.

companyName: Kimco Realty OP, LLC


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our Information Security, Product Security, Compliance and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles involving information technology, including security, auditing, compliance, systems and programming. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.

companyName: Tesla, Inc.

ticker: TSLA


text: The Company recognizes cybersecurity as crucial to protecting its business and employees' sensitive information. The Company has implemented and maintains a Security Incident Response Policy, as part of its enterprise-wide risk management system, which is intended to ensure that the Dynex information technology ("IT") systems function properly and successfully assess, identify, contain, investigate, remedy, report, and respond to information security risks, threats or incidents.

companyName: DYNEX CAPITAL INC

ticker: DX


text: Our Board of Directors recognizes the critical importance of information security to the Company's operational success. We continue to make substantial investments to augment the capabilities of our people, processes, and technologies in order to address our cybersecurity risks. Our cybersecurity risks are integrated into our overall risk management governance and are reviewed on at least a quarterly basis by the Audit Committee of our Board of Directors and at least annually by the full Board of Directors. The policies, processes and standards designed to mitigate those risks are based on recognized frameworks established by the National Institute of Standards and Technology, and are focused on preserving the confidentiality, security, and availability of information that the Company collects and stores. The Company takes a comprehensive approach to analyzing and mitigating cybersecurity risks, focused on preventing, identifying, mitigating, and responding to cybersecurity threats.

companyName: Telesis Bio Inc.


text: Our Director of Information Technology and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging a managed security service provider and other third-party security software and technology services. In addition, we use various internal and external processes and technologies, including third-party security solutions, monitoring, and alerting tools and resources, designed to monitor, identify, and address risks from cybersecurity threats. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.

companyName: 908 Devices Inc.

ticker: MASS


text: Our cybersecurity framework is integrated into First Wave BioPharma's broader enterprise risk management strategy, sharing methodologies, reporting mechanisms, and governance structures with other risk domains including legal, compliance, strategic, operational, and financial risks. Conducting risk assessments to pinpoint material cybersecurity threats to our critical systems, data, products, services, and overall IT infrastructure;

companyName: GridAI Technologies Corp.

ticker: GRDX


text: Members of our Cyber Oversight Group also include our Chief Executive Officer, Chief Legal and Risk Officer, Senior Director of Internal Audit and technology and data privacy in-house counsel. The Cyber Oversight Group is also tasked with reporting to the Audit Committee on cybersecurity risk management strategies, as well as any significant cybersecurity incidents that may occur. In addition, the Cyber Oversight Group meets at least four times per year, or with greater frequency as necessary, to, without limitation: • review with management the Company's cybersecurity threat landscape, risks, and data security programs, and the Company's management and mitigation of cybersecurity risks and incidents; • review with management the Company's compliance with applicable information security and data protection laws and industry standards; • discuss with management the Company's cybersecurity, technology and information systems policies as to risk assessment and risk management, including the guidelines and policies established by the Company to assess, monitor, and mitigate the Company's significant cybersecurity, technology and information systems related risk exposures; and • review and provide oversight on the Company's crisis preparedness with respect to cybersecurity, technology and information systems, including cybersecurity incident response preparedness, communication plans, and disaster recovery capabilities.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: The Company's senior management is primarily responsible for establishing policies and procedures designed to identify, assess and manage the Company's significant risks, with our Chief Information Security Officer ("CISO") having primary responsibility with respect to material risks from cybersecurity threats. We also have a Corporate Enterprise Risk and Capital Committee, made up of members of senior management and the Company's Chief Risk Officer, which provides oversight of our enterprise-wide risk structure and of our processes to identify, measure, monitor and manage significant risks, including, but not limited to, cybersecurity risk.

companyName: LINCOLN NATIONAL CORP

ticker: LNC


text: Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions, and our information systems, the Company has implemented a comprehensive Information Security Program ("Program") which is a component of its overarching enterprise risk management program. The Program is achieved through a collaborative effort involving operations, technology, compliance, risk, and senior management. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential cyber threats.

companyName: EAGLE FINANCIAL SERVICES INC

ticker: EFSI


text: Prospect Capital Management conducts regular phishing tests where educational materials are provided in each test for those who fail. Prospect Capital Management also utilizes a security awareness training platform as supplementary cybersecurity training for staff with a high failure rate on the phishing tests.

companyName: PROSPECT CAPITAL CORP

ticker: PSEC


text: The Audit Committee of our Board of Directors oversees cybersecurity risk and receives regular updates from our Vice President and Chief Security and Privacy Officer on these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters. Our Vice President and Chief Security and Privacy Officer, who reports to our Chief Technology Officer, leads our central security and privacy team, which works in partnership with each of our businesses and the corporate center to measure security maturity and risk and provides managed security services in a way that allows each business to address their unique challenges and become more efficient in using their resources. We have processes and policies for the escalation of cybersecurity incidents to the central security team, evaluation of the materiality of the incidents, and coordination of our response as needed across businesses and operations. Our Chief Security and Privacy Officer has more than 20 years of privacy and data security experience, including a series of roles in Cimpress over the last 15 years, the last two and a half years of which have been spent leading the central security and privacy team.

companyName: CIMPRESS plc

ticker: CMPR


text: Employee Training Programs We launch separate, annual web-based learning modules on cybersecurity, privacy, and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and/or cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: DUKE Robotics Corp.

ticker: DUKR


text: Incident Response Procedures The Company's cybersecurity incident response plan is a critical component of the overall cybersecurity strategy. This plan outlines the procedures and actions to be taken in the event of a cybersecurity incident to minimize impact and ensure a swift recovery. Key elements of the Company's incident response plan include: • Incident discovery and confirmation: the Company has established clear protocols for identifying and reporting suspected cybersecurity incidents. Employees are trained to recognize potential incidents and report them immediately to the Company's IT security team. • Incident assessment and classification: upon receiving a report of a potential incident, the Company's IT security team conducts a thorough assessment to determine the nature and severity of the incident. Incidents are classified based on their impact and risk level. • Containment and continuity: once an incident is confirmed, the Company takes immediate steps to contain and mitigate its impact, which may involve isolating affected systems, applying security patches, or implementing other remedial actions. • Eradication and recovery: after containment, the Company works to eradicate the root cause of the incident and restore affected systems to normal operation, which includes evicting threat actors, removing malware, repairing vulnerabilities, and validating system integrity. • Communication and reporting: the Company maintains clear communication channels to keep all relevant stakeholders informed throughout the incident response process, which includes internal communication with employees and external communication with customers, regulators, and other parties as necessary. • Post-incident review and improvement: following the resolution of an incident, the Company conducts a post-incident review to identify lessons learned and areas for improvement, which helps enhance incident response capabilities and prevent future incidents.

companyName: LINDSAY CORP

ticker: LNN


text: We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. Assessments by external providers of our cybersecurity measures include information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. The results of such internal and external assessments, audits, and reviews are reported to the audit committee and the board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. In addition to the assessment of internal cybersecurity risks, we have implemented processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers that have access to our data and systems, including payors and IDTFs. These processes include vetting of all service providers for security, reliability, and availability; execution of a Business Associate Agreement with each provider for compliant management, storage, or processing of PHI; and confirmation by each service provider that its SOC-2 reports, or equivalent reports, are current and available, where applicable. In the event a service provider does not have a current and available SOC-2 or equivalent report, we complete an in-depth review of the service provider's cybersecurity risk management and advise relevant business stakeholders of any significant identified risks.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: To ensure our cybersecurity programs adhere to industry best practices, we have adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework and subscribed to the principles of Zero Trust. Both models represent recognized best practices for security and the capabilities needed to identify, protect, detect and respond to cybersecurity risks and challenges. We evaluate our physical, electronic and administrative safeguards on a continuous basis to ensure they are effectively deployed across the business.

companyName: AtriCure, Inc.

ticker: ATRC


text: See Item 1A. Risk Factors "Capacity constraints, systems failures or breaches of our network security could materially and adversely affect our business. If we fail to manage our technical operations infrastructure, our existing customers may experience services outages, and our new customers may experience delays in the deployment of our solution."

companyName: DHI GROUP, INC.

ticker: DHX


text: Our Information Security Officer is accountable for overseeing and directing our Information Security Program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has over 20 years of information security experience in the Banking, Government, Military, Energy, and Insurance sectors and has the following cybersecurity certifications: Certified Information Systems Security Professional (CISSP), BS in Information Systems with a focus in Cyber Security, CompTIA Security+, CCNA (Security), CCNA (Route/Switch), CCNA (Collaboration), CompTIA Net+, Microsoft Certified System Engineer MCSE (win2000).

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Our board of directors oversees our cybersecurity program and receives quarterly updates from the cybersecurity team on matters including Oaktree's cyber risk management program (and risks to us related to cybersecurity) and updates to the cybersecurity program, including active and recently completed initiatives.

companyName: Oaktree Specialty Lending Corp

ticker: OCSL


text: Our cybersecurity risk management efforts are an integral part of our overall risk management processes, and we are deeply committed to safeguarding our digital and information technology environment for our employees, customers and vendors. We employ a robust, global and multi-layered security strategy, known as "defense-in-depth," to assess, identify and manage cybersecurity risks and protect our cyber work environment from potential threats and vulnerabilities. These risks, threats and vulnerabilities include those that could result in significant operational disruption to the Company, such as production disruption, business downtime or loss of containment, as well as risks that could have significant reputational or compliance/regulatory impact.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: These risks have the potential to lead to information technology system failures, threat to water supply, or compromise of sensitive information.

companyName: MIDDLESEX WATER CO

ticker: MSEX


text: We have processes in place to identify, assess and manage material risks from cybersecurity threats. These processes are part of our overall enterprise risk management process and have been embedded in our internal controls and information systems.

companyName: DXP ENTERPRISES INC

ticker: DXPE


text: As a financial institution, we believe that the risk of cybersecurity incidents is a significant, increasing, and always evolving risk for our business. Federal law and regulations require us to maintain a comprehensive written information security program, and federal banking regulators regularly issue guidance regarding cybersecurity threats intended to enhance our cybersecurity risk management. Accordingly, we have developed and implemented processes for assessing, identifying and managing material risks from cybersecurity threats designed to comply with federal law and regulations and protect against cybersecurity threats to our business. Our program is supported by management and the Company's Board of Directors (the "Board of Directors"). The Company maintains an active cyber insurance policy to enhance protections against material data intrusions or loss of privacy. For an overview of the federal banking laws and regulations that govern our management and oversight of cybersecurity risks, refer to Item 1. Business – Supervision and Regulation – "Financial Privacy and Cybersecurity Requirements," incorporated by reference into this Item 1C.

companyName: Investar Holding Corp

ticker: ISTR


text: Although our Risk Factors include further details about the cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Chemours Co

ticker: CC


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors, and we continue to adjust our cybersecurity policies, standards, processes, and practices as necessary.

companyName: YOUNEEQAI TECHNICAL SERVICES, INC.

ticker: YQAI


text: We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information. Despite ongoing efforts to continuously improve our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and customer loss, legal actions, statutory penalties, among other consequences. While we have not experienced any material cybersecurity threats or incidents in recent years, there can be no guarantee that we will not be the subject of future threats or incidents.

companyName: BARFRESH FOOD GROUP INC.

ticker: BRFH


text: Information security is integral to our information technology strategy, with accountability embedded at all organizational levels, including our operations, management and Board of Directors. Key elements include: • Managed Detection and Response ("MDR") & Security Operations Center ("SOC"): Our operations team employs MDR and a SOC for round-the-clock monitoring of cyber threats and vulnerabilities. • Vulnerability Management: We maintain technology solutions for cybersecurity prevention and defense, including outside firewalls, multi-factor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls. Continuous vulnerability scoring helps us address emerging risks objectively and proactively. • Incident Response: Security incidents are managed through established protocols, with escalations to senior management to assess materiality and disclosure requirements. Our information security team develops, implements and regularly tests incident response and information recovery plans designed to assess and respond to cybersecurity threats and incidents. • Board Oversight: The Audit Committee of our Board of Directors is responsible for the oversight of cybersecurity risks. It receives regular updates and presentations on our cybersecurity environment, including strategies, processes and policies, cybersecurity incidents, risks and threats, cybersecurity projects we have implemented and plan to implement and other cybersecurity developments and industry trends. These updates are led by our Chief Information Officer, a seasoned information technology professional with over 20 years of experience, supported by a dedicated security team. The chair of the Audit Committee reports to the full Board of Directors after each meeting. • Risk Management: Cybersecurity risks are either mitigated or documented in a risk register for non-material risks. Non-material risks are reviewed periodically to ensure continuous improvement and timely resolution. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.

companyName: BELLRING BRANDS, INC.

ticker: BRBR


text: The Cybersecurity and Privacy Committee receives quarterly reports from the Chief Technology Officer concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Cybersecurity and Privacy Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. Additionally, the Company has implemented numerous information technology policies and procedures concerning cybersecurity matters, which include policies that directly or indirectly relate to encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information and the use of the internet, social media, email and wireless and personal devices for both Company business and personal matters while utilizing Company resources. These policies go through an internal review process on a periodic basis and are, if needed, updated and re-approved by the appropriate members of management. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion.

companyName: enCore Energy Corp.

ticker: EU


text: Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. In the event of a cybersecurity incident, our CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: AUTONATION, INC.

ticker: AN


text: Oversee Third-party Risk Flywire implements stringent processes to oversee and manage the risks associated with third-party service providers. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments by our Chief Information Security Officer (CISO) and on an ongoing basis by our security and risk management team and our security engineers. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. Risks from Cybersecurity Threats We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: Flywire Corp

ticker: FLYW


text: In the normal course of our relationships with the providers of these services, we regularly monitor their message boards and other formal and informal communications channels for signs of breaches of their systems. We also survey available public information for indications that they have suffered a breach of their systems.

companyName: enVVeno Medical Corp

ticker: NVNO


text: We use service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats, including, for example, cybersecurity software providers and professional services firms (including legal counsel). We also use service providers to perform a variety of functions throughout our business, such as application providers, data hosting providers, and CROs. We have a vendor management strategy designed to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management strategies may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, such as reviewing their information security documentation and imposing contractual obligations on them with respect to their information security controls.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: 11. Cyber Insurance and Risk Transfer The Company maintains cyber insurance coverage to mitigate financial risks associated with cybersecurity incidents. This insurance covers: • Incident response and recovery costs. • Legal fees and regulatory penalties. • Business interruption expenses. The risk management team regularly evaluates the adequacy of coverage based on evolving cyber threats. 12. Historical Cyber Incidents No material cybersecurity incidents were recorded in prior reporting periods.

companyName: FARADAY FUTURE INTELLIGENT ELECTRIC INC.

ticker: FFAI


text: Our IT Security team also operates a 24x7 security operations center through a managed service provider. This dedicated center, alongside active monitoring of the dark web for DaVita-related data, and our use of both internal and external tools, is designed to ensure proactive detection, prevention and remediation of cybersecurity incidents. We inform and develop this integrated approach through our ongoing internal and external evaluations and risk assessments of our IT security program as described above.

companyName: DAVITA INC.

ticker: DVA


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains robust policies and procedures relating to our data collection, use and processing activities as well as mechanisms for monitoring our data systems and usage. We do not have retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws, including the EU General Data Protection Regulation (the "GDPR"), the UK Data Protection regime and the California Consumer Privacy Act (the "CCPA"), in the countries in which we operate, and meet our contractual commitments to our clients. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Audit Committee of the Board of Directors oversees risks from cybersecurity threats, including through quarterly reports to the Audit Committee by the Company's CISO and CIO and, as needed, special reports to the Audit Committee and/or the Chairperson of the Audit Committee. The Audit Committee includes members with technology and cybersecurity experience and certifications, including a Committee member with over 28 years of experience working for Hewlett Packard Enterprise Company and a Committee member with a Computer Emergency Readiness Team ("CERT") Certificate in Cybersecurity Oversight issued by the CERT Division of the Software Engineering Institute at Carnegie Mellon University and completion of the National Association of Corporate Directors Master Course in Cybersecurity.

companyName: CARTERS INC

ticker: CRI


text: 24/7 Network Monitoring: Our continuous 24/7 second-level maintenance and monitoring contract provides constant vigilance against network disruptions and potential cyber threats, ensuring swift detection and mitigation of incidents.

companyName: SES AI Corp

ticker: SES


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives periodic updates from management regarding cybersecurity matters and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Verve Therapeutics, Inc.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our Senior Vice President, Information Technology, who holds an undergraduate degree in Computer Engineering and has served in information technology and security roles dedicated to the pharmaceutical and biotechnology sector for approximately 18 years, including serving as the Chief Information Officer of two public biopharmaceutical companies.

companyName: IONIS PHARMACEUTICALS INC

ticker: IONS


text: Through a combination of security, risk and compliance resources, the Investment Manager implements information security through a dedicated ISP that is intended to identify, assess and manage material risks from cybersecurity threats applicable to the Company, and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents. Our ISP is led by the Investment Manager's Chief Information Security Officer ("CISO") who actively partners with the Investment Manager's Chief Compliance Officer and Chief Risk Officer and, in turn, the Company's Board and Secretary. Ultimately, we rely on the Investment Manager's full enterprise risk framework, which includes the ISP, information technology, business continuity, resiliency and cybersecurity risk, in combination with a broader risk management team, including the Investment Manager's Chief Security Officer.

companyName: AB Commercial Real Estate Private Debt Fund, LLC


text: We also participate in, and work with, multiple federal, state, industry, and academic groups dedicated to cybersecurity, such as the U.S. Department of Homeland Security's Cybersecurity & Infrastructure Security Agency, the Federal Bureau of Investigations' InfraGard, an ERCOT critical infrastructure protection working group, the Electricity Information Sharing and Analysis Center, and the Texas Information Sharing and Analysis Organization. This includes information-sharing and coordination with ERCOT, the PUCT, and other ERCOT market participants with a view toward protecting and enhancing the ERCOT grid from cyber and physical attacks and response preparation. In addition, we participate on various technical and advisory boards, such as the advisory board of the Energy Sector Security Consortium, Inc., a nonprofit organization that supports energy sector organizations with the security of their critical technology infrastructures, and the Electricity Subsector Coordinating Council. We believe that our participation and membership within these groups and organizations contributes to security improvements that directly impact our cyber operations.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: The audit committee assists the Board of Directors in overseeing our cybersecurity program. Both the Board of Directors and the audit committee receive regular reports regarding material cybersecurity developments. In the case of a security incident, the ISO will report the incident directly to the Chief Executive Officer, Chief Financial Officer, CISO and Senior Vice President, General Counsel & Compliance Officer. The breach will then be communicated to the audit committee dependent on the materiality of the incident.

companyName: KVH INDUSTRIES INC \DE\

ticker: KVHI


text: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to our audit committee oversight of cybersecurity and other information security risks. Our audit committee oversees management's activities related to our cybersecurity risk program. Our cybersecurity committee, which includes Vice President of IT, Chief Financial Officer, Chief Compliance Officer/General Counsel and other senior management, reports to the audit committee on a quarterly basis regarding information security and cybersecurity matters, including cybersecurity risks, or as needed.

companyName: KLX Energy Services Holdings, Inc.

ticker: KLXE


text: The Audit and Risk Committee, a committee of the Company's Board of Directors, actively participates in discussions with management regarding cybersecurity risks and receives quarterly reports regarding the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, remedy audit findings, and review enhancements to the Company's defenses and management's progress on implementing its cybersecurity strategy. In addition, the Audit and Risk Committee reviews key cybersecurity risks, on a quarterly basis, to help ensure such risks are incorporated into the Company's Enterprise Risk Management framework. The Audit and Risk Committee also meets quarterly in executive session with the Company's Chief Information Security Officer. To assist with their oversight of the Company's cybersecurity programs and mitigation efforts as they relate to the broader cybersecurity landscape, our Audit and Risk Committee has previously and will continue to attend cybersecurity awareness training events hosted by third-party cybersecurity experts.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Braves Holdings. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the GC. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: In our business operations, we use information technology, enterprise applications, communications tools, cloud network solutions, and related systems to manage our operations, including to manage our building systems, tenant and vendor relationships, accounting and recordkeeping, and communications, among other aspects of our business.

companyName: HEALTHPEAK PROPERTIES, INC.

ticker: DOC


text: The Bank's IT Infrastructure team, led by the Director of Cloud Infrastructure, is responsible for the hands-on configuration and patch management of the Bank's information systems to ensure the security, reliability, and availability of those systems. The team is comprised of information system and cloud professionals that hold various certifications in systems administration and cloud computing.

companyName: Federal Home Loan Bank of Dallas


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across our global enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: • Cybersecurity Incorporated into Enterprise Risk Management Program. We have implemented an enterprise risk management ("ERM") program that operates under the leadership of our Chief Privacy and Compliance Officer. Each business unit and corporate support unit has primary responsibility for assessing and mitigating risks within its respective areas of responsibility, and the ERM team is responsible for oversight and reporting to management and the Board.

companyName: EQUIFAX INC

ticker: EFX


text: Our CTO's background includes 14 years of experience leading technology at several eCommerce companies and our Senior Director of Information Security has 16 years of experience in the field of cybersecurity, including extensive experience as head of information security at public and private companies. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.

companyName: FIGS, Inc.

ticker: FIGS


text: Our Audit Committee, which consists solely of independent directors, oversees the Company's overall enterprise risk assessment and risk management policies and guidelines, including risks related to cybersecurity matters. Our Audit Committee reviews, discusses with management and oversees the Company's information security and data protection programs. In particular, the Audit Committee receives periodic updates from the CISO, internal audit function and other members of management on significant cybersecurity and data privacy threats to our systems and the potential impact on the Company's business, financial results, operations, and reputation, risk management strategies, including information governance and security policies and programs, program assessments, planned improvements, major legislative and regulatory developments that could materially impact the Company's cybersecurity and data privacy policies and programs, and status of information security initiatives, including an appropriate threat assessment relating to information technology risks. After each such update, the Chair of the Audit Committee updates the full Board. The Board also receives similar cybersecurity updates directly from the CISO and other members of management at least annually, and as needed from time to time.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: We have not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect business strategy, results of operations, or financial condition. See "Risk Factors – We have experienced criminal cyberattacks and could in the future be further harmed by disruption, data loss or other security breaches, whether directly or indirectly through third parties whose products and services we rely on in operating our business."

companyName: T-Mobile US, Inc.

ticker: TMUS


text: We have established and maintain incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident. We conduct regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.

companyName: SEELOS THERAPEUTICS, INC.


text: The Chief Information Officer ("CIO"), who reports to the Chief Financial Officer, along with members of the corporate and business unit information technology teams, are generally responsible for developing and managing the Company's cybersecurity programs. Our CIO has over 20 years of experience in various information technology and information security roles, and our information security team is comprised of employees with broad knowledge of cybersecurity issues gained through experience and through training and certifications. These individuals, along with other internal and external personnel as needed, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and applicable personnel are informed of known cybersecurity incidents to form the appropriate incident response team and respond accordingly.

companyName: IDEX CORP /DE/

ticker: IEX


text: In the event of a material cybersecurity incident, communication to the Board is provided pursuant to our cybersecurity incident response plan.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Commvault has established a cybersecurity program for the benefit of the company, our customers, partners and stakeholders. The cybersecurity program includes policies, processes and practices that are designed to assess, identify and manage material risks from cybersecurity threats and is integrated into our enterprise risk management program. Led by the Chief Security Officer ("CSO"), Commvault's cybersecurity program leverages the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, with the primary objective of securing systems and data from cyber threats. We partner with industry-leading cybersecurity experts for continuous monitoring, alerting, mitigation and responsiveness related to our cybersecurity program. We adopt industry best practices and security technologies and have established a Security Incident Response Plan ("SIRP") which outlines our processes for incident preparation, detection, analysis, containment, eradication, and post-incident analysis. In addition to the SIRP, we maintain a Crisis Management Plan to organize roles and responsibilities in the event of a crisis, a Disaster Recovery Plan to provide guidance in the recovery of systems following an outage, and a Business Continuity Plan to identify alternative means of conducting business in the event of business disruption. We partner with third party service providers to enhance our monitoring and response capabilities, facilitate readiness activities including tabletop exercises, and perform various methods of cybersecurity penetration testing. All employees are required to undergo annual security awareness training on current and potential cybersecurity threats and report suspicious activity. We also assess third-party service provider cybersecurity controls and include security and privacy terms in contracts as appropriate.

companyName: COMMVAULT SYSTEMS INC

ticker: CVLT


text: We are a holding company and our operations are conducted substantially in China by our Hong Kong and China subsidiaries. Our PRC subsidiary, the main operating entity of ours, has implemented comprehensive internal policies and measures on protection of cyber security, data privacy and personal information to make sure its compliance with relevant PRC laws and regulations. The main internal policies and measures are as follows: for customer data processing, our PRC subsidiary deploys the access control mechanism on the server side, adopts the principle of minimum authorization for the staff who may contact end users' personal data; our PRC subsidiary's operating systems and database systems have password complexity requirements; (iii)

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: a cybersecurity incident response plan and playbook that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.

companyName: Vertex, Inc.

ticker: VERX


text: h.we regularly review our business continuity and other back-up plans, including as they relate to cybersecurity incidents; and i.we perform periodic simulations of attack scenarios by an internal "Red Team" to test the efficacy of both security controls and our tactical incident response procedures.

companyName: TAKE TWO INTERACTIVE SOFTWARE INC

ticker: TTWO


text: Our Board, with the assistance of our Audit Committee, oversees the Company's cybersecurity program and strategies. The Audit Committee receives regular reports and updates, typically quarterly, from senior management on a wide range of cybersecurity topics. These reports include detailed insights into risk assessments, mitigation strategies, emerging threats, vulnerabilities, incidents, and prevailing industry trends. After each such report, the Chair of the Audit Committee updates the full Board for transparency and accountability in cybersecurity governance. Additionally, at least annually and as needed from time to time, the Board receives similar cybersecurity updates directly from senior management. Further, the Board oversees cybersecurity as part of our enterprise risk management program.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: The Company's determination of the materiality of a cybersecurity incident would generally include an evaluation of the incident's effect on the Company (including (i) its business strategy, results of operations, or financial condition, (ii) the integrity, confidentiality, resiliency, and security of the Company's networks and systems, and (iii) the Company's operations).

companyName: UNITIL CORP

ticker: UTL


text: Our primary source of cybersecurity risk relates to security of our third-party service providers, whose activities and scale may present more desirable targets. However, we do maintain certain systems ourselves and appreciate the need to focus internally as well. We manage cybersecurity risk through a variety of tactics, including (i) the structure of our systems and platforms, (ii) the contractual terms with our third-party vendors, (iii) the proactive vulnerability assessments we conduct (or require our vendors to conduct), (iv) compliance with applicable regulations and continuous improvement around best practices, (v) mitigating user error and human vulnerabilities through training and guidance and (vi) the placement of cybersecurity insurance policies.

companyName: Portillo's Inc.

ticker: PTLO


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.

companyName: CoreCivic, Inc.

ticker: CXW


text: The Company utilizes a risk-based, multi-layered information security strategy based on the U.S. National Institute of Standards and Technology Cybersecurity Framework to assess, identify, and manage risks from cybersecurity threats. This approach includes: (i) dedicated security operations center monitoring; (ii) network-based and host-based protections; (iii) a Privacy Council focused on privacy regulation adherence; (iv) privilege access management controls; (v) annual and ongoing information security training for all employees and targeted tabletop and other exercises; (vi) encryption of data, backup, recovery, and testing; (vii) regular internal and external audits against information security best practices; and (viii) benchmarking using external third parties. The Company employs these measures, and others, to protect its information assets and operations from internal and external cyber threats while ensuring business resiliency. It also aims to protect employee, customer and supplier information from unauthorized access or attack, as well as secure the Company's networks, systems, devices, products, and services.

companyName: EASTMAN CHEMICAL CO

ticker: EMN


text: Cybersecurity, Risk Management, Strategy and Governance There continues to be a rise in electronic fraudulent activity security breaches and cyber-attacks within the financial services industry. We are confronted with a spectrum of cyber threats, ranging from common attacks such as ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and to maintain customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain information security controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: Kearny Financial Corp.

ticker: KRNY


text: As part of our cybersecurity risk management system, our incident management teams track and log privacy and security incidents across Alphabet, our vendors, and other third-party service providers to remediate and resolve any such incidents. Significant incidents are reviewed regularly by a cross-functional working group to determine whether further escalation is appropriate. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of our senior management. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our Alphabet Inc.

companyName: Alphabet Inc.

ticker: GOOGL


text: Risk Management and assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized access to or occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As we grow, we plan to develop a more robust and detailed strategy for cybersecurity in alignment with nationally accepted standards.

companyName: PDS Biotechnology Corp

ticker: PDSB


text: of Risks and Cybersecurity Governance combat internal risks to the security, confidentiality, and/or integrity of any electronic records containing personal information, and evaluating and improving, where necessary, the effectiveness of the current safeguards for limiting such risks, the Sponsor has identified the following risks that are present to its business as well as procedures to help mitigate those risks: Internal Threats There must be communication to employees on the detailed provisions of the cybersecurity program at onboarding and annually.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: To date, no cybersecurity incident (or aggregation of incidents) or cybersecurity threat has materially affected our business strategy, results of operations or financial condition, and we are not aware of any cybersecurity incidents that are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further information regarding the risks associated with cybersecurity incidents, see "Risk Factors—Security breaches, data breaches, cyber-attacks, other cybersecurity incidents or the failure to comply with privacy, security and data protection laws could materially impact our operations, patient care could suffer, we could be liable for damages, and our business, operations and reputation could be harmed" in Item 1A of this Annual Report on Form 10 K.

companyName: Dror Ortho-Design, Inc.

ticker: DROR


text: We have developed and implemented processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. We have established a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management strategy is informed by the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and the NIST Risk Management Framework. Our cybersecurity processes have been integrated into our overall business risk management process.

companyName: ALPINE IMMUNE SCIENCES, INC.


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our process for onboarding new vendors, we assess new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and such third-party service providers are reviewed and approved by our Finance and Legal departments. We have implemented processes to confirm that agreements with third-parties contain data security and privacy terms as appropriate. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Cybersecurity Risks As discussed above and under " Item 1A —Risk Factors—Risk Factors—General Risk Factors," we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.

companyName: IAC Inc.

ticker: IAC


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools that are designed to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Verve Therapeutics, Inc.


text: Role of Management Our SVP-IT oversees and provides accountability related to our cybersecurity risk management strategy and overall information security program. The SVP-IT's cybersecurity team is led by a Director of Information Technology Security. The cybersecurity team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The program incorporates policies and practices designed to protect the privacy and security of our sensitive information.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee provides updates to the Board of Trustees. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.

companyName: LXP Industrial Trust

ticker: LXP


text: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors."

companyName: RingCentral, Inc.

ticker: RNG


text: With respect to third-party service providers, our cybersecurity risk management program includes conducting due diligence of relevant service providers' information security programs prior to onboarding, reassessing vendors using a risk-based approach, and performing off-boarding activities as relevant. We also customarily require our financially significant third-party service providers and those third parties with access to sensitive data to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our board of directors on any appropriate items.

companyName: Journey Medical Corp

ticker: DERM


text: We engage consultants, or other third parties, in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect the Company.

companyName: Axonics, Inc.


text: Cyber Risk Management and Strategy Under the board's and audit committee's oversight, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This risk management program addresses, but is not limited to, risks identified by internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. We also engage external independent assessors from time to time to conduct cyber risk assessments and to report both findings and recommendations to management.

companyName: HUBSPOT INC

ticker: HUBS


text: In 2023, the Company engaged an independent assessor to assess the maturity of its cybersecurity program against the NIST Cybersecurity Framework (NIST CSF). The results of the NIST CSF maturity assessment laid the roadmap for the cyber initiatives conducted in 2023 and future. Further, a third-party conducted an external and internal penetration test, performed a dark web scan for any Aptevo private and confidential data and assessed Aptevo's cloud security configuration posture. All critical and high-risk findings from that assessment were addressed in 2023.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: conduct bi-weekly email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Our Chief Financial Officer leads our information security organization (overseeing work done by a third party IT services company) and reports to the Chief Executive Officer and Board of Directors of any material information regarding such cybersecurity matters.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: Our CSPO, CISO and other dedicated cybersecurity risk management personnel are certified and experienced information systems security professionals and information security managers. Our CSPO has over 30 years of experience in information security having 15 years of experience leading information security programs and obtained the Certified Information Systems Security Professional certification ISC2. Our CISO, who has over 33 years of experience in cyber operations, communications, crisis management and command and control, holds multiple graduate degrees, obtained the Certified Information Systems Security Professional certification from ISC2 and holds the Qualified Technical Expert certification from the Digital Director's Network.

companyName: CENTENE CORP

ticker: CNC


text: The Company's objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse the Company's systems or information. A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, security assessments, tabletop exercises, and other exercises focused on evaluating effectiveness of the Company's processes and programs. The Company also deploys technical safeguards that are designed to protect its information systems from cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to the Company's business. The Company has also developed and periodically updates incident response plans that provide a documented framework for responding to actual or potential cybersecurity incidents, including timely notification and escalation to the appropriate management committees and to the Risk Oversight Committee of the board and full board of directors as appropriate. These incident response plans are coordinated through the Information Security Officer ("ISO") and other key members of management, including the Chief Risk Officer.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Our Director of Information Technology, who has over 15 years of experience managing information technology and cybersecurity matters and holds a Master's Degree in computer science with a concentration in cybersecurity, together with our senior leadership team, is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."

companyName: BIORA THERAPEUTICS, INC.


text: The ISC also oversees day-to-day cybersecurity risk mitigation efforts, which include, but are not limited to monitoring systems for availability, performance, and security issues, periodic vulnerability scans, penetration testing performed at least annually by independent, reputable, third-party vendors, as well as evaluating any risks associated with prospective third-party service providers who require access to sensitive customer data and implementing any additional controls to address significant risks identified. Furthermore, the ISC meets quarterly to discuss and analyze any relevant developments within the organization and industry relative to cybersecurity, reviews our internal policies and operational procedures relevant to cybersecurity at least annually, and promulgates updates when deemed necessary or advisable.

companyName: MARCHEX INC

ticker: MCHX


text: The Company has in place a cybersecurity incident response plan. Procedures for addressing cybersecurity incidents include reporting incidents up to senior management, including the Company's legal department for analysis. If a cybersecurity incident were determined to be material by the Company's legal department, the Company's Audit Committee would be informed promptly and the Company's disclosure committee would address appropriate public disclosures. As noted above, management regularly reports to the Audit Committee regarding the current cyber threat environment and the controls and procedures meant to address such risks.

companyName: Healthcare Realty Trust Inc

ticker: HR


text: We have integrated cybersecurity risk management into our overall risk management framework and include cybersecurity in our risk management processes and procedures and in our decision-making about and evaluation of such processes and procedures.

companyName: Sezzle Inc.

ticker: SEZL


text: For additional information on the cybersecurity risks we face, see "ITEM 1A. RISK FACTORS—Cybersecurity and Privacy Related Risks—We are subject to risks arising from a significant breach of our information systems."

companyName: VALERO ENERGY CORP/TX

ticker: VLO


text: We have a Senior Vice President of Information Technology whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.

companyName: Ameresco, Inc.

ticker: AMRC


text: The Corporation has developed and implemented an Information Security Program based on the Cybersecurity Framework (CSF) best practices and recommendations from the National Institute of Standards and Technology (NIST), applicable regulatory guidance, and other industry standards. Components of the program include a risk assessment program to identify, assess, and mitigate cybersecurity risk; a vendor management program to address third-party cybersecurity risk; a business continuity program (BCP) to ensure continuity of operations; and an incident response program documenting cybersecurity incident response and notification procedures. The Corporation's Information Security Officer (ISO) oversees the programs and reports on their statuses to management committees including the Senior Leadership Committee, ERM Governance Committee, and Operational Risk Committees. The ISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to the Board of Directors.

companyName: ENB Financial Corp

ticker: ENBP


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: Kroger Cyber Incident Response Plan The IR Plan documents the processes by which information security events are detected, identified, prioritized, and analyzed. The Kroger iSOC, CISO, legal counsel, and corporate affairs stakeholders are then engaged depending on the incident's scope, business effect, and potential material risk. This cross-functional team is responsible for assessing an appropriate response and mitigation pathway. Once security events are identified through the enterprise detection and monitoring ecosystem, the IR Plan sets forth an incident prioritization/decision workflow to determine scope, business effect, and potential material risk. This workflow is implemented through collaboration with the iSOC, CISO, legal counsel, and corporate affairs stakeholders. In addition to the processes outlined above, we have also implemented an information security training program for employees that includes security awareness training related to cyber security risks, simulated phishing emails and regular communication to the enterprise regarding cyber security risks.

companyName: KROGER CO

ticker: KR


text: The Company maintains cybersecurity processes, technologies and controls to help it assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of the Company's overall enterprise risk management process.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including, as appropriate, briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, such as external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: The Company's VP, IT Security and Risk Management and CIO who collectively lead our Cybersecurity and Risk Management Team have relevant degrees and certifications in Information Technology and Security and have extensive experience in their current and prior roles related to IT Security. Along with leading the Company's cybersecurity learning and awareness trainings, they also regularly participate in various third-party industry conferences and trainings.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company in the future, including our business strategy, results of operations, or financial condition, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K, including the risk factor entitled "Security breaches, improper access to or disclosure of our data or user data, other hacking and phishing attacks on our systems, or other cyber incidents could harm our reputation and adversely affect our business."

companyName: AppLovin Corp

ticker: APP


text: Management ' s Role Holley's information technology team, which is responsible for developing and implementing our cybersecurity program, currently operates under the oversight of our Chief Financial Officer ("CFO"). The CFO is generally responsible for managing risks from cybersecurity threats, as well as overseeing the safeguarding and fortification of our networks and systems. With a proven track record in developing and leading data science teams, the CFO's expertise in business, finance and technology enables him to guide the team in making strategic information technology investments that strike a balance between growth opportunities, risk mitigation and return on investment. The information technology team is comprised of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, penetration testing processes and methodologies, and risk communication and reporting. Currently, an Interim Chief Information Officer ("CIO") is overseeing our cybersecurity program as we proceed with an executive search to appoint a permanent CIO. Going forward, the CIO will be responsible for the management and oversight of Holley's cybersecurity program.

companyName: Holley Inc.

ticker: HLLY


text: Our cybersecurity program is designed to protect our information systems and information against cybersecurity threats that may impact the confidentiality, integrity and availability of our information systems and information. Our program includes policies, processes and technologies to assess, identify and manage risks from cybersecurity threats and aligns with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: LandBridge Co LLC

ticker: LB


text: We believe cybersecurity is critical to advancing our technological developments. As a U.S. commercial space company with an established manufacturing business, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial-of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Sidus Space Inc.

ticker: SIDU


text: As noted above under "Risk Management", we maintain an information and cybersecurity risk management program, which is led by our CISO and is designed to protect the confidentiality, integrity and availability of critical information and information systems. The program is designed based on the NIST CSF; provided that this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats. In general, the audit committee oversees risk management activities designed and implemented by our management.

companyName: DermTech, Inc.


text: In an effort to deter and detect cyber threats, we periodically provide our workforce, including all employees and contingent staff, with a privacy, data protection, cybersecurity and incident response, and prevention education and awareness program, which includes annual and supplemental training covering timely and relevant topics, such as social engineering, phishing, password protection, confidential data protection, asset use, and mobile security, and educates employees on the importance of reporting all incidents immediately. In addition, we perform monthly phishing test campaigns to reinforce identification and reporting training. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs. Lastly, we perform annual vulnerability assessments, conducted by independent, third-party cybersecurity firms.

companyName: ARVINAS, INC.

ticker: ARVN


text: The team within the Information Security function (referred hereinto as the "cybersecurity team") possesses a robust blend of technical knowledge, practical skills, and strategic insight, gained through years of experience in the field of cybersecurity. Our cybersecurity team includes professionals certified in a wide array of cybersecurity disciplines. Their qualifications include, but are not limited to, Certified Information Systems Security Professional for general security practices, Certified Ethical Hacker for penetration testing capabilities, Certified Information Systems Auditor for information systems auditing, Certified Information Security Manager for overseeing enterprise security, Certified Risk and Information Systems Control for risk management, and Certified Cloud Security Professional for cloud security expertise. Additionally, they possess various other certifications in specific technologies and cloud security from providers like AWS and Microsoft, along with numerous other industry-relevant security certifications. This diverse expertise underscores their comprehensive understanding of the cybersecurity landscape. The cybersecurity team attends training programs to update their skills and knowledge.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our Chief Information Security Officer (CISO) reports quarterly to the Audit Committee concerning Stewart's cybersecurity program, operations, and other ad hoc updates. On a regular basis, management conducts a third-party assessment of Stewart's cybersecurity controls, the results of which are reported to the Audit Committee.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: Our Board of Directors (the "Board") has direct oversight of cybersecurity risks and strategy and receives quarterly updates from our Chief Information Officer (CIO). The Board has also delegated to our Audit Committee responsibilities related to cybersecurity and other risks of our Company. Our CIO has spent over 20 years in engineering and product development roles and our VP of Information Security and Operations has spent over 25 years in infrastructure and cybersecurity roles including in the finance and insurance industries. Additionally, one of the independent directors on our Board and a member of our Audit Committee has significant experience leading technology and information systems at some of the country's leading healthcare organizations and adds to our Board substantial expertise and knowledge in information technology, privacy, data governance and cybersecurity. A cross-functional incident response team, which includes members of our management team, determines the apparent severity of reported potential incidents and operationalizes the cybersecurity incident response protocol.

companyName: Hub Group, Inc.

ticker: HUBG


text: As part of our information security program, we have adopted a Cyber Incident Response Plan ("Incident Response Plan") which is administered by our CISO who closely coordinates with the Company's Information Technology team. The Incident Response Plan describes the Company's processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response. The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company's Senior Leadership Team, including the Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Risk Officer ("CRO"), Chief Legal Officer ("CLO") and the Board of Directors. As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents. Annually, our incident response team performs exercises to simulate responses to cybersecurity events. Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.

companyName: SEACOAST BANKING CORP OF FLORIDA

ticker: SBCF


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our CISO, reporting directly to our Chief Information Officer ("CIO"), is responsible for designing, developing and implementing our overall information security program that sets forth a governance structure and processes to ensure regular risks assessments and timely reports regarding cybersecurity risks. We actively scan across our information infrastructure for security vulnerabilities inherent in our business as we rely extensively on information and technology systems for managing transactions, tracking financial performance, and storing sensitive data. We also continuously monitor and assess risks associated with the interconnected nature of many of our information and technology systems, such as ERP platforms, supply chain management systems, and electronic payment gateways. In the normal course of our monitoring process, our information security team also regularly conducts penetration testing of our business and information systems in close collaboration with a third-party expert, and promptly remediates identified vulnerabilities to prevent any potential compromise of our systems or data.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: While we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such threats or incidents in the future. Like any technology provider, we have experienced cybersecurity incidents in the past which were remediated on a case-by-case basis. See "Risk Factors" for more information on our cybersecurity risks.

companyName: Identiv, Inc.

ticker: INVE


text: We have identified cybersecurity risk as one of our key enterprise risks. One of our Co-Presidents is responsible for managing cybersecurity risk. He develops mitigation strategies and implements controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should it occur. At least annually, he reports on this risk and related mitigation work to the Audit Committee of our board of trustees, which is the committee that has primary responsibility for overseeing our enterprise risk management program and is composed solely of independent trustees. The Audit Committee reviews and discusses all of our key enterprise risks, including cybersecurity risk, and the enterprise risk management program itself. The chair of the Audit Committee may, at his discretion, report to the Chairman of the Board or the full board of trustees regarding any aspect of the program or risks.

companyName: Pebblebrook Hotel Trust

ticker: PEB


text: BXTI conducts periodic cybersecurity risk assessments, including assessments or audits of third-party vendors, and assists with the management and mitigation of identified cybersecurity risks. The CSO and CTO are responsible for the review of Blackstone's cybersecurity framework annually as well as on an event-driven basis as necessary. The CSO and CTO also review the scope of Blackstone's cybersecurity measures periodically, including in the event of a change in business practices that may implicate the security or integrity of Blackstone's information and systems.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Mr. Halliday is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SOUNDTHINKING, INC.

ticker: SSTI


text: As of the date of this report, we have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect the Corporation, including our business strategy, results of operations, or financial condition.

companyName: EXXON MOBIL CORP

ticker: XOM


text: Our Board, with the assistance of the Audit Committee, to whom the Board has delegated to the primary authority and responsibility to oversee cybersecurity risks, oversees the management of risks arising from cybersecurity incidents, and, as noted above, cybersecurity is one of the material risks tracked through our ERM process. The Audit Committee is briefed quarterly by our Senior Director on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance. Executive management and other senior leaders participate in the semi-annual updates to our ERM risk register and heat map, and those updates, which incorporate cybersecurity risk and strategy, also are presented to our Board for discussion and feedback at least annually. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee Chair.

companyName: Coeur Mining, Inc.

ticker: CDE