text: While we have never had a material cybersecurity incident that impacted our operations, from time to time we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from artificial intelligence, terrorist acts or other acts of aggression. Our customers and vendors may face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats, including an outside independent Cybersecurity consultant, a Security Incident Response Plan (SIRP) and periodic Information Technology training for all employees.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: The Company relies on the cybersecurity strategy and policies implemented by the Advisor. The cybersecurity program seeks to address cybersecurity risks and support the Company's operational resilience.

companyName: 5C Lending Partners Corp.

secItem: Item 1C


text: Our board of directors considers cybersecurity risk as part of its risk oversight function. Management updates the board of directors, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: Arteris, Inc.

ticker: AIP


text: In addition, our Chief Information Officer supports our company by staying informed about and monitoring efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources; and alerts and reports produced by security tools deployed in the IT environment.

companyName: SmartStop Self Storage REIT, Inc.

ticker: SMA


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the information technology department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business and reports to the Audit Committee of the Board of Directors, which evaluates cybersecurity and information technology risk as well as other aspects of our overall enterprise risk.

companyName: OmniAb, Inc.

ticker: OABIW


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Star Holdings

ticker: STHO


text: Board oversight of risks from cybersecurity threats Our Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. Our Board receives periodic updates from the CCO of the Company, the CIO/CISO, and/or Operational Risk functions, regarding the overall state of Morgan Stanley's Cybersecurity Program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: SL Investment Fund II LLC


text: The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats including, for example, managed cybersecurity service providers, cybersecurity software providers, penetration testing firms, threat intelligence service providers, cybersecurity consultants, dark web monitoring services, forensic investigators, and professional services firms, including legal counsel.

companyName: TerrAscend Corp.

ticker: TSNDF


text: Our cybersecurity risk management approach provides a framework for identifying, monitoring, evaluating and responding to risks from cybersecurity threats and incidents. This framework includes steps for identifying the sources of potential cybersecurity threats or incidents, including potential threats and incidents associated with a third-party vendor or service provider, assessing the severity and risk of potential threats and incidents and implementing cybersecurity countermeasures and mitigation strategies. We recognize that our relationships with third parties may pose significant risks, and therefore we have implemented practices for building vendor diligence, onboarding and monitoring capabilities to assess those risks. These efforts can include internal briefings from our security and technical personnel, as well as external reports and threat intelligence from governmental, public and private sources, including external consultants and reports produced by security tools deployed in our technical environment.

companyName: Zscaler, Inc.

ticker: ZS


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such a material cybersecurity incident.

companyName: BioAtla, Inc.

ticker: BCAB


text: We have certain processes for assessing, identifying, and managing cybersecurity risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee, collaborator, and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural, and technical safeguards, response plans, tests on our systems, review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants and computer security firms, to enhance our cybersecurity oversight including by gaining valuable insights into the ever-evolving cybersecurity landscape. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Dermata Therapeutics, Inc.

ticker: DRMA


text: Cybersecurity Risk Management and Strategy Identifying, assessing, and managing material risks associated with "cybersecurity threats," as such term is defined in Item 106(a) of Regulation S-K, is important to Bitcoin Depot. Among the risks we strive to address and mitigate are the disruption of our business operations and the loss of personal and confidential data due to cybersecurity incidents, fraud, or extortion.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers and hosting companies. All of our critical information is hosted by a third-party service provider. We have a vendor management program to assess cybersecurity risks associated with our use of these providers. Further, we also rely upon such third-party service providers to both assist us in identifying cybersecurity threats, as well as to review and notify us of any data breach on their systems.

companyName: TherapeuticsMD, Inc.

ticker: TXMD


text: Reporting to Board of Directors Significant cybersecurity matters, and strategic risk management decisions, will be escalated to the board of directors.

companyName: Stran & Company, Inc.

ticker: SWAG


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Information Officer. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: Employees and contractors are given cybersecurity awareness training as part of their on-boarding process. We also maintain an organizational IT and Security Policy which includes an Acceptable Use Policy that provides detailed guidelines on proper resource use and personal behavior. We require written acknowledgment of the latter document by all employees and contractors. All policies are regularly reviewed and updated to keep in line with industry developments and organizational changes. Employees and contractors across all departments are encouraged to report any concerns or suspicions to the IT department, who then investigates recommends appropriate actions.

companyName: Vaxxinity, Inc.

ticker: VAXX


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside consultants who advise on the Company's cybersecurity systems.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: To manage the third-party cybersecurity risk introduced by our cloud-first strategy, we have implemented a due diligence process for new software partners as well as an annual review process for essential SaaS system partners.

companyName: JBG SMITH Properties

ticker: JBGS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Operating Officer as part of the Board's continuing education on topics that impact public companies.

companyName: Erasca, Inc.

ticker: ERAS


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. The Company does not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which it is aware are reasonably likely to materially affect the Company. Refer to the risk factor captioned "Significant disruptions in, or breaches in security of, our information technology systems or data or violation of data privacy laws can adversely affect our business and financial statements" in Part I, "Item 1A. Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Veralto Corp

ticker: VLTO


text: In addition, the Company has established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.

companyName: ATEL 14, LLC


text: Brunswick's cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework as guidance for the program. The team regularly assesses the threat landscape to manage risks through a layered cybersecurity strategy based on prevention, detection, and containment, including processes for escalating information about threats or cyber incidents to management and the Board of Directors. We have other policies and procedures that directly or indirectly relate to cybersecurity, including those related to remote access monitoring, encryption, antivirus protection, multifactor authentication, confidential information, and the use of the internet, email, and wireless devices. The Company also engages third parties in connection with the assessment of our cybersecurity risk management processes against the NIST framework. We actively engage with key vendors, industry participants, and law enforcement communities as part of our continuing efforts to evaluate and improve our program. Internally, our employees are a key part of our program: Brunswick enables a culture in which security is everyone's responsibility. Employees are trained through various methods throughout the year, including annual security training.

companyName: BRUNSWICK CORP

ticker: BC


text: The Company engages third-party cybersecurity assessments to ensure an objective evaluation of its cybersecurity stance, including the effectiveness of its risk management strategies. Oversight of cybersecurity risks posed by third-party service providers is systematically managed, ensuring that all external risks are identified and mitigated. The Company did not have any material cybersecurity breaches during the year ended December 31, 2023.

companyName: T Stamp Inc

ticker: IDAI


text: We believe we are positioned to meet the requirements of the SEC. In addition to following SEC guidance and implementing pre-existing third party frameworks, we have developed our own practices and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks. Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. Assessing, identifying, and managing cybersecurity related risks are factored into our overall business approach.

companyName: Netcapital Inc.

ticker: NCPL


text: The Board and the Audit Committee are responsible for overseeing the Company's ERM processes, with the Audit Committee being tasked with overseeing cybersecurity risks facing the Company. Throughout the year, the Audit Committee receives relevant updates from management on cybersecurity matters, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the overall threat environment, technological trends, global employee training and efforts to enhance the Company's cybersecurity capabilities and preparedness. Relevant matters are also reviewed with the full Board on at least an annual basis.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: We and Hess design and assess the program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we or Hess meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our businesses.

companyName: Hess Midstream LP

ticker: HESM


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our measures to prevent, detect and mitigate cyber threats include training for employees, multi-factor authentication, backup servers, threat monitoring, periodic strategy review and penetration testing performed by a third-party advisory firm, and coverage under an information security risk insurance policy. Third-party suppliers are pre-screened as part of our vendor onboarding process to evaluate their cybersecurity programs and assess risk. As a part of our pre-screening process, we evaluate each vendor's overall cybersecurity risk profile relative to the services they provide for Biohaven, including questions relating to cybersecurity insurance, security operations and access and management of our data. Cybersecurity incidents involving third-party supplier systems are evaluated for their impact on the Company and managed through our cyber incident management process. In addition, our employees are required to complete an annual cybersecurity training managed through our internal compliance training system.

companyName: Biohaven Ltd.

ticker: BHVN


text: It is the responsibility of the Risk Management Committee ("RMC") of the Board to oversee the Company's cybersecurity risk exposures and action taken by management to monitor and mitigate cybersecurity risks.

companyName: NBT BANCORP INC

ticker: NBTB


text: Our IT team regularly monitors best practices and as needed, implements changes to the Company's cyber risk management program to ensure a robust program is maintained. Aspects of this program include plans and procedures for identifying, communicating and containing security incidents, regular risk assessments and testing of the Company's internal infrastructure to identify vulnerabilities, procedures for recovering from disruptions to our operations, maintaining global security policies, and comprehensive end user training and cybersecurity drills for personnel.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: Our CISO, who reports to the Executive Vice President – Chief Digital and Information Officer and Chief Transformation Officer, leads our information security team and has responsibility for overseeing FedEx's cybersecurity program. The CISO, who has over 25 years of experience at FedEx and has received industry-recognized information security certifications, oversees an information security organization of more than 400 security, risk, and compliance professionals based in the U.S. and internationally across the FedEx enterprise. The leadership team of our information security organization has extensive experience in IT and cybersecurity and possess certifications in cybersecurity and related fields.

companyName: FEDEX CORP

ticker: FDX


text: Incident Response and Assessment Policies and Procedures ADT aligns with industry-standard cybersecurity frameworks designed to protect the company and customer data from unintentional disclosure, cybersecurity events, and other threats of all severity levels. As part of our alignment with these frameworks we have a Cybersecurity Incident Response Plan that outlines actions to be taken after identifying a suspected information security breach and the people responsible for managing those actions. Additionally, this plan outlines communication responsibilities during incidents of all severity levels.

companyName: ADT Inc.

ticker: ADT


text: Cybersecurity is critical to supporting our business and protecting our customers in an increasingly complex environment. We face a variety of cybersecurity threats including attacks that are common to most industries, such as ransomware and denial-of-service, as well as attacks from advanced and highly organized adversaries targeting financial services companies. Our information systems have from time to time experienced such attacks despite our best efforts to prevent them. Our customers, suppliers, and other third parties also face similar cybersecurity threats, and a cybersecurity incident impacting any party could have a material impact on our operations, performance, or operating results. None of these threats or incidents have to date materially affected our business strategy, results of operations, or financial condition. However, we cannot assure that any future security breaches will not occur or that any such events that have occurred or may occur in the future will not result in material harm to our business, operations, reputation or profitability. These threats and related risks highlight the importance of allocating resources to protect the Company and our customers. For more information on how cybersecurity risk may materially affect the Company's business strategy, results of operations or financial condition, please refer to Item 1A, Risk Factors, of

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: Ladder has a cybersecurity risk management program that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. Our cybersecurity risk management program is also a key component of our overall risk management program.

companyName: Ladder Capital Corp

ticker: LADR


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on the Trust's service providers, including a summary of any potential operational risks and any incidents which could impact the Trust. The Board of Directors also periodically receives reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Various individuals and teams throughout our organization are responsible for the oversight and management of cybersecurity risk for our organization.

companyName: Post Holdings, Inc.

ticker: POST


text: The Company has established a cybersecurity risk management program, designed to identify, assess, mitigate, and manage cybersecurity risks, incidents and threats that could potentially impact our business operations. Our internal cybersecurity committee (the "Cybersecurity Committee"), which includes our Chief Financial Officer and key representatives from the Finance, Information Technology ("IT"), and Legal departments, direct our cybersecurity efforts. The Cybersecurity Committee is primarily responsible for monitoring our cybersecurity risk management program, establishing and updating materiality thresholds for reporting cybersecurity incidents and determining whether specific incidents meet established disclosure criteria. The Cybersecurity Committee's role is focused on evaluating incidents against these thresholds to ensure that significant cyber risks are appropriately managed, addressed and if required, disclosed in line with our overarching cybersecurity strategy and policies. The Cybersecurity Committee members rely on the cybersecurity experience of the Company's head of IT, which includes more than twenty years of experience in cybersecurity and information technology, with focused expertise on cybersecurity strategy, architecture, policy, and processes. Remaining team members have a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity. The Company has also established a Cybersecurity Incident Assessment and Reporting Policy (the "Cyber Incident Policy").

companyName: Celsius Holdings, Inc.

ticker: CELH


text: We have not experienced any material cybersecurity incidents to date. However, as described in Item 1A, "Risk Factors," any breach of data security could result in a disruption of our services or improper disclosure of personal data or confidential information, which could harm our reputation, require us to expend resources to remedy such a security breach or defend against further attacks or subject us to liability under laws that protect personal data, resulting in increased operating costs or loss of revenue.

companyName: MILLER INDUSTRIES INC /TN/

ticker: MLR


text: Although we have operational safeguards in place, we still face significant risks from cybersecurity threats, as the number of cyberattacks targeting retailers and corporate networks grows, and the volume, intensity and sophistication of attempted attacks, intrusions, and threats from around the world increase daily. We (and third parties upon whom we rely) may be unable to implement security controls fully, continuously, and effectively as intended. As described above, we utilize a risk-based approach that focuses on proactively preventing security risks followed by prompt detection and containment of risks identified. Security controls, no matter how well designed or implemented, may only mitigate, and not fully eliminate risks. In addition, events, when detected by security tools or third parties, may not always be immediately understood or acted upon. If our technology systems, networks, or information are compromised by malicious software, ransomware, or other cyberattacks, we could lose critical data or confidential information of our customers, vendors or associates, experience disruptions in our ability to distribute and sell merchandise and manage inventories, incur substantial remediation costs and/or become subject to negative publicity, costly government actions or litigation.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: We use technology in substantially all aspects of our business operations, and our ability to serve customers effectively depends on the reliability of our technology systems. Greater use of technology and digitization in operations has delivered benefits to our business, while also exposing us and others in our industry to new vulnerabilities in corporate and operational systems. Additionally, our business operations leverage third-party vendors and systems, which makes us susceptible to various cyber threats.

companyName: SYSCO CORP

ticker: SYY


text: We are also subject to the DoD CMMC requirements which necessitates that companies receiving, storing, or processing federal contract information ("FCI") and CUI be formally assessed by a CMMC C3PAO. AeroVironment, Inc., including its subsidiaries Arcturus UAS and Tomahawk Robotics (but excluding any of the BlueHalo acquired entities) is scheduled for a formal Level 2 assessment. The recently acquired BlueHalo passed a formal CMMC Level 2 assessment under the CMMC 2.0 framework, which went into effect December 16, 2024. If we fail to achieve or maintain certification ahead of contract awards, or if we fail to achieve the level required for a particular contract, we will be unable to bid on new contracts or follow-on efforts containing CMMC clauses, which could adversely impact the success of our operations. Additionally, our subcontractors and certain vendors may need to obtain CMMC certification, and we may be negatively impacted if they are not compliant with the CMMC requirements.

companyName: AeroVironment Inc

ticker: AVAV


text: Additionally, we have implemented an employee education and training program, which we provide on an annual basis, that is designed to raise awareness of cybersecurity threats. To support our cybersecurity risk management program, we leverage managed service providers and other third-party information technology and cybersecurity providers and consultants, including to perform regular system scans and threat intelligence analysis. Additionally, we require certain third-party providers and consultants to adhere to contractual requirements relating to privacy and cybersecurity standards.

companyName: HealthLynked Corp

ticker: HLYK


text: leverage threat intelligence available to us and our third party IT service provider to help us identify, protect, detect, respond and recover if there is an actual or potential cybersecurity incident; and carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: CervoMed Inc.

ticker: CRVO


text: Our CISO provides comprehensive updates to the Audit Committee quarterly and the full Board of Directors at least annually. These briefings include a range of topics, including: • Current cybersecurity landscape and emerging threats • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.

companyName: STRYKER CORP

ticker: SYK


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our Information Security Steering Committee ("ISSC") is responsible for oversight of matters related to information security and currently consists of professionals in legal operations and risk management, information governance, human resources operations, internal audit, computerized systems, global security and technical operations, and research technology, all whose input bring significant value when assessing and managing cybersecurity risk. Our ISSC meets periodically and is presented with an update on cybersecurity matters from our Senior Director, Global Information Security. Our Senior Director, Global Information Security is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.

companyName: BeOne Medicines Ltd.

ticker: ONC


text: We have developed and implemented an enterprise-wide cybersecurity program designed to provide a structured and thorough cybersecurity risk management system and governance structure to assess, identify, and manage material risks from cybersecurity threats. The Company considers the following factors, among others, to assess whether adequate protections are in place to address risks from known and anticipated cybersecurity threats: likelihood and severity of risk, impact on the Company and others, including retail customers, suppliers, consumers, and/or employees, if a risk materializes; feasibility and cost of controls; and impact of controls on our operations.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: The Company has implemented and maintains detailed incident response and backup and recovery plans designed to fully address the Company's response to a cybersecurity incident. These plans are tested and assessed on a periodic basis.

companyName: Telesis Bio Inc.


text: Using a platform endorsed by the H-ISAC, the IT security staff performs risk assessments of third parties that appear to represent the greatest risk to our systems and data. Annually, the privacy and security committee reviews and approves our listing of tier one vendors subject to the assessment. The IT security staff then works with the internal points of contact responsible for the applications, software or systems and the vendors to gather the information necessary to assess the associated risks using common cybersecurity standards and frameworks. Any significant risks identified are shared with the vendors and the compensating controls for those risks are documented in collaboration with the vendors. The internal points of contact and other constituencies then review the results of the assessment process in order to assess the associated value of the product or service against the risk.

companyName: Encompass Health Corp

ticker: EHC


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Management is responsible for assessing and managing our cybersecurity risk management program. We have various teams and committees charged with monitoring risks, implementing controls, developing information security policies and procedures, and assessing cyber events. In addition to our Information Technology ("IT") department, we have an Information Security ("IS") department that provides oversight of our cybersecurity-related controls, including assistance in the development of related policies and procedures. The IT department is overseen by an Chief Technology Officer ("CTO") who has a degree in networking as well as significant experience in the development, operation, monitoring and management of information system operations, including but not to limited to cybersecurity oriented controls. The IS department is overseen by a Senior Cybersecurity Manager who holds a Master of Science degree and has varied experience in the field of information technology. Both the IT and IS departments report to the CIO, who holds various certifications in systems and cybersecurity methodologies and has over two decades of experience in the management of various aspects of information systems operations. The CIO approves the information security policies and procedures, implementation of controls, monitoring and detection programs, and employee training on cybersecurity risks. The CIO also is responsible for reporting on cybersecurity matters to the Board.

companyName: Installed Building Products, Inc.

ticker: IBP


text: We also maintain an information security function that oversees the protection of our information assets through a program informed by standards promoted by the National Institute of Standards and Technology cybersecurity framework and the Cyber Risk Institute's Cyber Profile. These frameworks guide our information security function in designing programs to assess cybersecurity risks and prevent cybersecurity incidents. The information security team is led by our Chief Information Security Officer ("CISO") who is responsible for leading enterprise-wide cybersecurity strategy, including assessing and managing risks from cybersecurity threats, and implementing technical security controls by maintaining policies, standards and processes. With more than 20 years of experience in the field of cybersecurity, our CISO has had extensive involvement with the information security function and the maintenance of a robust cybersecurity program. Our CISO has held data privacy and information security roles with increasing responsibility in the financial services, technology and casino industries and is a certified information systems security professional.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our Board of Directors has ultimate oversight of the Company's privacy and cybersecurity programs and strategy, with each of the Board of Directors' Sustainability and Governance Committee and Audit Committee maintaining oversight responsibility for different elements of these programs. The Sustainability and Governance Committee and Audit Committee inform the full Board of Directors of any cybersecurity learnings or risks that were discussed at the committee level.

companyName: MASONITE INTERNATIONAL CORP


text: Our board, through our Nominating and Governance committee, together with our company executives through our Information Security committee, and our IT and security management teams in conjunction with third party service providers who specialize in cybersecurity, help identify, assess and manage the Company's cybersecurity threats and risks. We have a quarterly review of cybersecurity by our Nominating and Governance committee and our internal Information Security committee. We use a number of processes to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example via manual and automated tools, which are internally prepared and also through external third-party vendors, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting routine scans of the threat environments, evaluating our and our industry's risk profile, performing annual assessments and penetration testing, evaluating the threats reported to us, coordinating with law enforcement concerning threats, conducting internal and external audits, conducting threat assessments for internal and external threats, reviewing third party threat assessments, conducting vulnerability assessments to identify vulnerabilities, using of external intelligence feeds, conducting third-party- red/blue team testing and tabletop incident response exercises. In addition, we conduct internal tabletop exercise, third party red-team pen testing and OT security monitoring.

companyName: Enovix Corp

ticker: ENVX


text: The Company's measures to prevent and detect cyber security incidents include continuous monitoring of Company networks by a security operations team that includes a third-party managed security operations center. Employees throughout the Company are trained to report cybersecurity threats as they are identified. If an incident or suspected incident is reported, the cybersecurity team evaluates it for various factors, including severity and immediacy, pursuant to the Company's cybersecurity incident response plan.

companyName: MSA Safety Inc

ticker: MSA


text: We carry insurance that provides protection against the potential losses arising from a cybersecurity incident. However, there is no assurance that our insurance coverage will cover, or be sufficient to cover, all losses or claims that may result from a cybersecurity incident.

companyName: SPAR Group, Inc.

ticker: SGRP


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and regularly participates in joint meetings with the Audit Committee to discuss these matters.

companyName: Wingstop Inc.

ticker: WING


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Our cybersecurity risk management program is under the direction of IT manager, who has master degree in IT management. The IT manager receives reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Executive Cybersecurity Council meets as appropriate and receives updates from IT manager regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.

companyName: Massimo Group

ticker: MAMO


text: We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Pursuant to the incident response plan, the identifying party is required to notify the Company's CFO and Board of Directors of certain cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The incident response plan also includes procedures for: Gathering information about the cybersecurity incident. Consulting with cybersecurity consultants and other parties to assess the cybersecurity incident.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: The Company's Audit Committee is responsible for exercising oversight of management's identification and management, and planning for, risks from cybersecurity threats.

companyName: TWIN DISC INC

ticker: TWIN


text: Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. As discussed above, the Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management Program, which includes the Technology Risk Management team, and responsibilities assigned to various employees and the Risk and Technology Committee.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: The Company's VP of enterprise systems and applications leads the overall cybersecurity strategy and risk management program. This role oversees development and execution of risk assessments, implementation of security policies and procedures, regular cybersecurity training for our employees, and leadership of the IT security team and coordination with third-party consultants.

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Monitor Cybersecurity Incidents The CIO and Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Arcosa, Inc.

ticker: ACA


text: We do not employ a Chief Information Officer. The Audit Committee discusses risks and threats most applicable to the Company and inquires of management regarding design and effectiveness of controls in place to address the prevention, detection, mitigation and remediation of cybersecurity incidents. The Audit Committee provides regular reports to the full Board of Directors.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: The cybersecurity risk committee receives regular updates on our cybersecurity program from our chief security officer (the "CSO"). In addition, management updates the cybersecurity risk committee, as appropriate, regarding cybersecurity incidents. Our cybersecurity risk committee reports to the board on its activities. In addition to receiving reports from the cybersecurity risk committee, our board periodically receives cyber risk management program briefings directly from the CSO. Additionally, the audit committee of the board (the "audit committee") receives regular cybersecurity updates as part of the audit committee's oversight over our enterprise risk management program.

companyName: Okta, Inc.

ticker: OKTA


text: We are reliant on the continuous and uninterrupted operation of our various technology systems. User access to our sites and information technology systems are important elements of our operations, as are cloud security and protection against cyber incidents. In the ordinary course of our business, we collect and store sensitive data in our data centers and on our networks, including intellectual property, proprietary business information, critical operating information, information regarding suppliers, customers and business partners, including certain personally identifiable information. In addition, the information technology infrastructure we use is important to the operation of our business and to our ability to perform day-to-day operations. Industrial control systems now control large-scale processes that can include multiple sites across long distances.

companyName: TETRA TECHNOLOGIES INC

ticker: TTI


text: We take measures to regularly update and improve our cybersecurity program, including conducting independent program assessments, penetration testing and scanning of our systems for vulnerabilities. We follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework and undergo a third-party assessment every two years to measure the maturity of our cybersecurity program against the NIST Cybersecurity Framework. In addition, we periodically engage third-party advisors to assess the effectiveness and capabilities of our cybersecurity program, strengthen our cybersecurity policies and practices and identify potential vulnerabilities of our systems.

companyName: AbbVie Inc.

ticker: ABBV


text: At an operational level, our Chief Security and Privacy Officer (CSPO) and our Chief Information Security Officer (CISO) lead the management of our cybersecurity risk management program.

companyName: CENTENE CORP

ticker: CNC


text: Identified Material Risks To date, the Company has not encountered cybersecurity challenges, risks, or breaches that have materially impaired its business strategy, operations, or its financial standing.

companyName: YORK WATER CO

ticker: YORW


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. The full board of directors has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. During the year ended December 31, 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Scienture Holdings, Inc.

ticker: SCNX


text: From a governance perspective, senior members of our Enterprise Risk Management, Information Protection and Internal Audit functions provide detailed, regular reports on cybersecurity matters to the Board of Directors, primarily through the Audit Committee, which oversees controls for the Company's major risk exposures and has principal responsibility for oversight of cybersecurity risk, and the Finance, Investment and Risk Management Committee ("FIRMCo"), which oversees business risk related to cyber insurance products. The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: Our security awareness platform aims to reduce vulnerabilities in our systems if they are the target of phishing or social engineering through simulations of attacks coupled with employee training. We assess third party vendors who have access to our data or systems to measure their adherence to relevant industry practices and standards, including due diligence and monitoring compliance with security assessments.

companyName: Royalty Pharma plc

ticker: RPRX


text: Risk Management and Strategy HTLF Bank's Risk Management program is designed to identify, assess, monitor and mitigate risks based on various key risk factors we face including, but not limited to financial, operational, regulatory and legal. Cybersecurity is a critical component of our risk management framework given internal dependencies on technology, the evolving digital environment and the rapid acceleration of cyber-threats. HTLF's cybersecurity risk management program is built on three lines of defense Risk Management framework. HTLF's first line of defense provides frontline business, operational and technical controls and support to securely deliver access to HTLF applications and data to HTLF users. As part of the Risk Management function, HTLF's second line of defense is primarily responsible for infrastructure defense and security controls, performing vulnerability assessments, identity access management, business continuity, third-party information security assessments, employee awareness and training programs, and security incident management. Internal Audit functions as HTLF's third line of defense and independently provides assurance, via multiple audit and testing engagements to validate the effectiveness of HTLF's cybersecurity risk management practices, while measuring against regulatory requirements and HTLF's Policies and Standards.

companyName: HEARTLAND FINANCIAL USA INC


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance

companyName: Kontoor Brands, Inc.


text: Assessing, identifying and managing cybersecurity related risks are integrated into the Company's overall Organization Risk Management (ORM) program. Cybersecurity related risks are included in the risk universe that the ORM program evaluates to assess top risks to the enterprise on an annual basis. To the extent the ORM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.

companyName: OSHKOSH CORP

ticker: OSK


text: Management of Cybersecurity Risk GoDaddy management is responsible for identifying, assessing, and managing the company's material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures and maintaining the company's cybersecurity programs.

companyName: GoDaddy Inc.

ticker: GDDY


text: Our Chief Information Security Officer and our Security Team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Chief Information Security Officer and our Security Team are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents include the following: regular penetration testing, independent security posture assessments, phishing tests (with trainings for the failed users), general cybersecurity and phishing training for all Rambus personnel and tabletop exercises to simulate threats and identify gaps.

companyName: RAMBUS INC

ticker: RMBS


text: Bi-annually the Company engages a third party to conduct an audit of the Company's cybersecurity systems and processes to test their adequacy and efficacy. The results are shared with senior leadership and the Audit Committee of the Board, and incorporated into strategic security plans. The Company maintains cybersecurity insurance, which is assessed annually for the appropriateness of coverage levels and emerging trends.

companyName: El Pollo Loco Holdings, Inc.

ticker: LOCO


text: We rely on our technology infrastructure and information systems to interact with our clients, our employees, to sell our services, to utilize our data, to support and grow our client base, and to bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors that we contract with, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems, and which may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include governmental actors or other actors with significant means. We expect that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of AI and machine-learning technologies.

companyName: HARTE HANKS INC

ticker: HHS


text: The Company has adopted a risk-based strategy designed to achieve a targeted and cost-effective approach to managing cybersecurity risks that strengthens our abilities to prevent, detect, and respond to cybersecurity incidents. The Company has configured its IT environment, where possible, to restrict access using a least privileged methodology. We use various technologies and monitoring capabilities to detect anomalies and track information and assets. We have implemented a cybersecurity awareness program consisting of frequent training, phishing exercises, and bulletins regarding pertinent cybersecurity developments. We maintain and regularly update incident response, disaster recovery and business continuity plans and procedures. Our IT specialists subscribe to threat intelligence feeds and are members of cybersecurity-related associations such as the Information Systems Audit and Control Association, the Computing Technology Industry Association and the Cloud Security Alliance. We also maintain insurance coverage for cyber and data security risks of an amount and subject to conditions and exceptions that we believe are customary for companies like ours, but there can be no assurance that our levels of coverage are adequate or that we will be able to continue to maintain our existing insurance or obtain comparable insurance at a reasonable cost or at all.

companyName: Sotera Health Co

ticker: SHC


text: We have adopted a cybersecurity and data privacy incident response plan that provides a framework for identifying, classifying, documenting, and responding to cybersecurity and data privacy incidents and determining whether reporting of an incident is appropriate or required under regulatory standards. The plan also includes a materiality assessment framework to assist us in determining whether a security incident is "material" under the federal securities laws. A cross-functional working group reviews significant cybersecurity incidents under this framework to assess the incident and, among other things, determine whether further assessment and escalation of the incident within USANA is appropriate. Any incident assessed as being or potentially becoming material is immediately escalated to designated members of our executive leadership team. We consult with outside cybersecurity and data privacy consultants and legal counsel as appropriate, including on cyber incident significance and/or materiality analysis and disclosure matters, and designated members of our management team make the final materiality determinations and disclosure and other compliance decisions. Our management apprises the Governance Risk and Nominating Committee and, where necessary, our independent registered public accounting firm, of cybersecurity matters and relevant developments, as appropriate. Governance.

companyName: USANA HEALTH SCIENCES INC

ticker: USNA


text: Our Board of Directors considers cybersecurity to be a business risk and oversees enterprise-wide risks through the Audit Committee. The Audit Committee is designated by the Board with the responsibility for monitoring and reporting on management's cybersecurity and risk management processes. The ERM Committee is the management-entity designated by the Chief Executive Officer with the responsibility to direct and execute our risk governance and strategy, including cyber risk. This ERM Committee is composed of the Company's Executive Vice Presidents and each of the Company's Senior Vice Presidents. Our Senior Vice President and Treasurer chairs the ERM Committee. The Vice President for Information Technology ("IT") leads the information security program, manages cyber governance and incident management. The Vice President of IT and the Director of Infrastructure and Security have over forty-five years of combined information technology experience and over a decade of cybersecurity experience. The ERM Committee and Vice President for IT assess cyber risk and provide recommendations for management. The Chair of the ERM Committee and the Vice President for IT brief the Audit Committee regularly. These updates include an overview of cyber risk management activities, cyber threats, and key information security processes and mitigation efforts. The Chair of the Audit Committee provides regular reports to the Board of Directors on critical cyber risk and security topics presented to the Committee by management.

companyName: LSB INDUSTRIES, INC.

ticker: LXU


text: Impact of Cybersecurity Risks and Threats While some of the Company's third-party service providers have experienced cybersecurity incidents and the Company has experienced threats to its data and systems, as of the date of this report, the Company's management is not aware of any cybersecurity threats or incidents that have materially affected its business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors under the heading "The Company may be adversely impacted if the Company is affected by cybersecurity attacks or other security breaches."

companyName: HORMEL FOODS CORP /DE/

ticker: HRL


text: compliance with PRC laws and regulations with respect to data security in all material aspects, we have implemented comprehensive internal policies and measures on protection of cyber security, data privacy and personal information as listed above.

companyName: ENTREPRENEUR UNIVERSE BRIGHT GROUP

ticker: EUBG


text: The Company faces risks from cybersecurity threats, including as a result of any cybersecurity incidents, that could have materially affected or are reasonably likely to materially affect its business strategy, results of operations, and financial condition, cash flows or reputation. Although to our knowledge such risks have not materially affected us in the last three fiscal years, from time to time the Company has experienced and will continue to experience cybersecurity incidents, whether directly or through our supply chain or other channels, in the normal course of its business. For more information about the cybersecurity-related risks that the Company faces, see the risks detailed under the headings "The Company relies heavily on technology and automated systems to operate its business and any significant failure or disruption of, or failure to effectively integrate and implement, these technologies or systems could materially harm its business or business strategy" and "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this Form 10-K.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. We maintain a robust cybersecurity infrastructure to safeguard our operations, networks, and data through comprehensive security measures including our technology tools, internal management, and external service providers.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: As a U.S. Government defense industry contractor, we have experienced cybersecurity attacks and may be subject to significant cybersecurity attacks in the future. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. For additional information, see "Our business could be adversely impacted by significant cybersecurity attacks" in Item 1A. Risk Factors above.

companyName: FREQUENCY ELECTRONICS INC

ticker: FEIM


text: Our Senior Director, Information Protection & Compliance directly oversees our information security team and has over twenty years of experience in the information security industry and industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager. Our Senior Director, Information Protection & Compliance and our management committee on cybersecurity, which includes our Chief Executive Officer, Chief Operating Officer, Chief Legal Officer, and CIO are primarily responsible to assess and manage our material risks from cybersecurity threats. This same group oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above.

companyName: HAWAIIAN HOLDINGS INC


text: We have adopted the National Institute of Standards and Technology Cybersecurity Framework and the Center for Internet Security Critical Security Controls to continually evaluate and enhance our cybersecurity. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout our organization. These cybersecurity drills are performed both in-house and by a third-party service provider. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. Our Cybersecurity Steering Committee also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cybersecurity Steering Committee escalates events, including to the Chief Financial Officer and Board of Directors, as relevant, according to pre-defined criteria.

companyName: Turning Point Brands, Inc.

ticker: TPB


text: The Senior Vice President of Systems and the Vice President of IT work directly with the internal and external IT personnel to implement our information security policies and processes, including those described in the "Risk Management and Strategy" above. They are informed about and monitor the prevention, detection, mitigation, and remediation or prevention of cybersecurity incidents through those processes. They regularly report on the status of these matters to the Executive Vice President of Risk, Systems, and IT.

companyName: CONSUMER PORTFOLIO SERVICES, INC.

ticker: CPSS


text: Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management. The Company has a dedicated role in the Director of Cybersecurity and IT Compliance, who reports to our Senior Vice President of Information Technology ("SVP-IT"). Our current SVP-IT has significant experience in information technology across a variety of industries, including consumer goods, automotive, manufacturing and outsourcing. Our current SVP-IT and Director of Cybersecurity and IT Compliance also have experience in cybersecurity, information security, policy, architecture, engineering and incident response. The SVP-IT works with other functions within the Company to implement controls, procedures and practices to help minimize the Company's risks, as well as to introduce security by design. Our SVP-IT provides regular updates on cybersecurity matters to our senior management.

companyName: HELEN OF TROY LTD

ticker: HELE


text: The ISSC, chaired by the vCISO, is responsible for implementing cybersecurity risk management policies and strategies. The vCISO, appointed by the Board, has extensive experience in information security, holding various professional certifications, including a Certified Information Systems Security Professional ("CISSP"). The ISSC also includes senior executives from risk, compliance, IT, and internal audit functions, ensuring a multidisciplinary approach to managing cybersecurity threats.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Management's role in assessing and managing cybersecurity risks is led by our Chief Information Security Officer (CISO), who is a senior vice president and officer of the Company. As of the date of this report, our CISO has over twenty years of experience in information security leadership, including leading threat and vulnerability management, cybersecurity operations and cybersecurity defense, cybersecurity incident response, and technology risk management. He holds a bachelor's degree in computer science and several professional qualifications, including Certified Information Systems Security Professional and Information Systems Security Management Professional. The responsibilities of prevention, detection, mitigation, and remediation of cybersecurity incidents are allocated across the CISO's organization, and each organizational unit reports risks and incidents to the CISO, who in turn informs other senior management of cybersecurity incidents that may be material to the company.

companyName: Unum Group

ticker: UNM


text: When a threat or other issue is identified, our Director of Information Technology will notify the senior management team and initiate the appropriate response plan based on the criticality of the threat or issue. Our Director of Information Technology along with our management team, which includes our Chief Executive Officer, Chief Financial Officer, and General Counsel, will coordinate to execute the appropriate response plan and will also investigate any issue to determine whether an incident is material, requiring disclosure to shareholders in SEC filings. Our Board of Directors and our Audit Committee also receive prompt and timely information regarding any cybersecurity risk and ongoing updates regarding any such risk.

companyName: Intrepid Potash, Inc.

ticker: IPI


text: Tools utilized to prevent threats include multifactor authentication, e-mail security services, mobile e-mail security policies, virtual private networks, third-party security experts, and timely applied software patches, among others. We engage in annual penetration testing, disaster recovery testing, internal and external audits of our cybersecurity controls and simulated cyberattack scenarios to gauge our preparedness for these situations. In addition, employees are required to pass a mandatory cybersecurity training course annually and receive periodic phishing simulations to facilitate recognizing phishing attempts. We carry Cyber Insurance which includes access to a Cyber Incident Response team in the case of a cybersecurity event.

companyName: HCI Group, Inc.

ticker: HCI


text: Cybersecurity is an integral part of the Board of Trustees', Audit Committee's and Corporate Governance and Nominating Committee's risk analysis and discussions with management. The Board of Trustees has assigned cybersecurity oversight responsibility to the Corporate Governance and Nominating Committee as outlined in the Committee's Charter, which is publicly available on the Company's website. We also have a Cyber Steering Committee which works in conjunction with the Computer Incident Response Team ("CIRT") to develop strategies to mitigate risks and to address any cyber issues that may arise. The Cyber Steering Committee and CIRT are made up of certain executives, management, members of our information technology team and third-party advisors. The committees are led by our SVP, Chief Information Officer.

companyName: Urban Edge Properties

ticker: UE


text: Management's Responsibilities Our global information security program is led by our corporate Chief Information Security Officer, who works closely with key corporate functional and line of business stakeholders. The Chief Information Security Officer partners with these functions for the purpose of identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures, reporting cybersecurity breaches and other information security incidents, and maintaining our cybersecurity program. The team of senior management officers, who support our information security program, have expertise with cybersecurity, as demonstrated qualifications such as by prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. Our management team receives regular updates on our cybersecurity posture and reviews detailed information about our cybersecurity preparedness. Additionally, we have a Leidos Security Council that is co-chaired by the Chief Information Security Officer and the Chief Security Officer to address "all security hazards" across our global enterprise to ensure cohesion and effectiveness of our combined security governance and risk mitigations.

companyName: Leidos Holdings, Inc.

ticker: LDOS


text: Suppliers that have access to, host or transmit our data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards. Follow-up activities are performed as needed. Contracts with suppliers also include critical security requirements, such as right to audit, technology requirements and hiring practices, including background checks for those who have access to our network. To further ensure supplier resilience and continuity, we regularly evaluate and assess our critical supplier relationships and business continuity plans, enabling us to quickly adapt and maintain operations in the event of prolonged disruption.

companyName: Cigna Group

ticker: CI


text: Although we provide our Affiliates with operational autonomy in managing their businesses and may have limited involvement in the design, oversight, and maintenance of their respective technology systems and networks, we offer cybersecurity support to Affiliates through our information security program, including with respect to conducting Affiliate program assessments and assisting, as appropriate and practicable, in their identification of, and response to, an actual or suspected cybersecurity incident. Additionally, prior to any investment in a new Affiliate, we conduct a diligence review of its information security program.

companyName: AFFILIATED MANAGERS GROUP, INC.

ticker: AMG


text: Our cybersecurity program is based on the ISO 27001 security controls set, and in particular, it focuses on the principles of confidentiality, integrity and availability. We maintain an ISO 27001 certification with a fully integrated set of operational policies and procedures to adhere to the 14 domains of ISO 27001. This includes but is not limited to the organization of information security to assign roles and responsibilities within Adaptive, access control to restrict employees' access to view only that information that is relevant to their roles, information security incident management, and compliance to broadly ensure alignment with applicable laws and regulations. We perform an annual risk assessment conducted by an outside assessor and operate a vendor risk assessment program for third party vendors to evaluate how their systems may impact our business in the event of a cybersecurity incident. We also provide annual, mandatory cybersecurity training for employees to equip our workforce with the knowledge to identify and respond to cybersecurity threats, such as phishing attempts.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: We recognize that third-party service providers may introduce cybersecurity risks. In an effort to mitigate these risks, we assess third party cybersecurity controls through a cybersecurity questionnaire and include security and privacy addendums to our contracts where applicable.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including professional services firms; cybersecurity consultants; and managed cybersecurity service providers.

companyName: Beta Bionics, Inc.

ticker: BBNX


text: Performing a cybersecurity risk assessment to evaluate our readiness if the risks were to materialize; and Ensuring risk is addressed and tracking any necessary remediation through an action plan.

companyName: American Bitcoin Corp.

ticker: ABTC


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face material cybersecurity threats. However, we do depend on the digital technologies of third parties, including information systems, infrastructure and cloud applications and services, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. In the event of a cybersecurity incident impacting us, the management team will report to the board of directors and provide updates on the management team's incident response plan for addressing and mitigating any risks associated with such an incident. As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss.

companyName: Direct Selling Acquisition Corp.


text: We employ various cybersecurity processes and controls to aid in our efforts to identify, assess, and manage our material risks from cybersecurity threats and to protect against, detect, and respond to cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K). To identify and assess material risks from cybersecurity threats, we consider and gather information with respect to the confidentiality, integrity, and availability of our information systems (as defined in Item 106(a) of Regulation S-K). We have adopted policies and procedures that are designed to assist us with managing identified risks at a system and organizational level and assessing the materiality of the risk, its severity, and potential mitigations or remediations. Our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: Our commitment to cybersecurity begins at the Board and extends to the most senior leadership of all functional areas of the Company. Our Audit Committee oversees our risk management process at the Board level. The Audit Committee's responsibilities include regular review of policies and practices with respect to risk assessment and risk management, including in the areas of cybersecurity and other information technology risk and privacy.

companyName: Dayforce, Inc.

ticker: DAY


text: Cybersecurity risk is overseen by the Board and the Bank's multiple lines of defense, including front-line bankers and operations teams, Enterprise Risk Management ("ERM"), and internal audit. Information security risk is managed in accordance with an established ERM framework, which includes elements such as key risk indicators, enterprise standards, controls, and self-assessments that comply with established ERM policies. These elements are regularly assessed, measured, and reported to Board-level and Bank senior management-level risk committees, and those committees review such reports.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: To our knowledge, cybersecurity threat risks have not materially affected our Company, including our business strategy, results of operations or financial condition.

companyName: Apollo Asset Backed Credit Co LLC


text: Cybersecurity Incidents While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Annual Report on Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe.

companyName: MidWestOne Financial Group, Inc.

ticker: MOFG


text: We also have a cybersecurity insurance policy in place and fully utilize its tools, guidance, and policies to ensure compliance and enhance our overall security posture.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: Among other best practices, we use multi-factor authentication wherever possible for external access to systems, assess and update current versions of security solutions, perform annual cybersecurity training and email phishing campaigns for employees, use third parties to perform external penetration testing, and maintain disaster recovery and incident response plans. We employ a combination of methods to monitor for new or developing cybersecurity risks. Incidents, if any, are escalated to management and the Board according to our incident response policy. Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: STRATTEC SECURITY CORP

ticker: STRT


text: We also identify and oversee cybersecurity risk from third-party service providers through our vendor management policy, which requires increasing levels of due diligence and required insurance coverages in proportion to each provider's access to our information systems.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: The board of directors and Audit Committee receive regular reports from the Company's Cybersecurity Risk Management Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors and Audit Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: GENELUX Corp

ticker: GNLX


text: Our Board of Directors oversees our strategy and risk management, including material cybersecurity risks. The Audit Committee of the Board of Directors (the "Audit Committee") oversees our cybersecurity and information technology risk exposures, as well as our cybersecurity and information technology policies and programs, in accordance with its charter. The Audit Committee holds quarterly meetings and receives periodic reports from, and also engages in regular discussions with, management and also our MSP regarding our significant cybersecurity risk exposures and the measures implemented to monitor and control these risks. Our Technology Committee also meets at least quarterly to assess cybersecurity risks and prepares reports to the Audit Committee. A number of members of our Technology Committee have gained relevant knowledge, skills and experience in information technology and cybersecurity risk management, including overseeing third-party vendors in such areas, over their careers at the Company or other organizations.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.

companyName: Johnson Controls International plc

ticker: JCI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including our Chief Technology Officer (CTO) and our Senior Director, Information Security. Our CTO has over 15 years of experience in engineering and development, including in leadership roles. Our Senior Director, Information Security has over 20 years of experience in information security, including similar roles leading Information Security teams at Ticketmaster, Sony Pictures, and Warner Bros.

companyName: WM TECHNOLOGY, INC.

ticker: MAPS


text: A comprehensive set of security technologies constantly monitor our information systems and data, including endpoint detection and response services, intrusion detection and prevention, various filtering technologies, and event correlation technologies that alert management to potential cybersecurity threats.

companyName: NATIONAL BANKSHARES INC

ticker: NKSH


text: Employee Training Employees are an integral part in the line of defense against cybersecurity risks. Every employee is responsible for protecting Company and client information. Accordingly, employees complete formal training, including regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. Our employees are supported by solutions designed to identify, prevent, detect, respond to and recover from incidents. Technologies include firewalls, intrusion detection systems, managed endpoint security automation and response capabilities, encryption, data backups and multi-factor authentication when available. Notable services include 24/7 security monitoring and response, real time vulnerability scanning, third party monitoring and threat intelligence.

companyName: Winchester Bancorp, Inc./MD/

ticker: WSBK


text: Cross-Collaboration and Coordination : Cybersecurity risks related to our business, privacy and compliance issues are identified and managed through a multifaceted approach, including third-party monitoring, internal and external IT security audits and reviews by relevant committees.

companyName: MAGNACHIP SEMICONDUCTOR Corp

ticker: MX


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our board of directors is responsible for overseeing cybersecurity, information security and information and operational technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our board of directors in exercising oversight of the Company's cybersecurity, information security and information and operational technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of significant cybersecurity incidents to our Audit Committee, who in turn reports to our board of directors, as appropriate.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: The head of our IT department reports to our Chief Operating Officer, or COO, and works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. We have established an Incident Review Team, which consists of representatives of our Finance, IT and Legal departments, to investigate, evaluate and respond to cybersecurity incidents. The Incident Review Team is responsible for escalating confirmed cybersecurity incidents to a Materiality Assessment Team, consisting of members of management. The Materiality Assessment Team is responsible for reporting cybersecurity incidents to the audit committee of the board of directors, as appropriate based upon the nature of the incident (or series of incidents).

companyName: Kura Oncology, Inc.

ticker: KURA


text: As of December 31, 2023, the Fund is not aware of any cybersecurity risks that have materially affected or are reasonably likely to materially affect the Fund's business strategy, results of operations, or financial condition.

companyName: BlackRock Private Credit Fund


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Beeline Holdings, Inc.

ticker: BLNE


text: We take a risk-based approach to cybersecurity aligned with National Institute of Standards and Technology (NIST) principles and have implemented controls throughout our operations that are designed to address cybersecurity threats and incidents. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help us identify, escalate, investigate, resolve and recover from security incidents in a timely manner.

companyName: Global Business Travel Group, Inc.

ticker: GBTG


text: The Board of Directors and executive leadership team at Delek are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the company's resiliency against cyber threats. To assist in these efforts, the Board of Directors has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.

companyName: Delek US Holdings, Inc.

ticker: DK


text: We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence and at least annually. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds. We generally require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices.

companyName: MediaAlpha, Inc.

ticker: MAX


text: c.the use of external service providers, including third party advisory firms, where appropriate, to assess, test or otherwise assist with and/or audit aspects of our security processes; d.cybersecurity awareness training of our employees;

companyName: e.l.f. Beauty, Inc.

ticker: ELF


text: Our information security program is managed by a Chief Information Security Officer ("CISO"), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including assessing and managing our material risks from cybersecurity threats. The CISO is a Certified Information Systems Security Professional ("CISSP"), and has over 20 years of experience holding various roles in information technology and cybersecurity. The Audit Committee of our Board of Directors is charged with oversight of cybersecurity matters, including oversight of risks from cybersecurity threats.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee (the Committee) oversight of cybersecurity risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Tyra Biosciences, Inc.

ticker: TYRA


text: We have implemented a program for incident response and breach management as part of our crisis management process, and we perform tabletop exercises for cyber incidents with the crisis management team. Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational, business, and privacy impacts.

companyName: T1 Energy Inc.

ticker: TE


text: Our management team will also provide periodic briefings to the audit committee regarding our Company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee will then provide updates to the Board on such reports.

companyName: Evofem Biosciences, Inc.

ticker: EVFM


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of vulnerability scans and penetration testing; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including annual incident training, regular phishing email simulations and tabletop exercises to simulate incident responses; • a robust cybersecurity incident response plan that includes documented procedures for preparing for, detecting, responding to and recovering from cybersecurity incidents, as well as processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident; and OPENDOOR TECHNOLOGIES INC. • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: We maintain a cybersecurity program designed to assess, identify, and mitigate risks from cybersecurity threats. This program is informed by the five elements of the National Institute of Standards and Technology framework: identify, protect, detect, respond, and recover. We utilize various methods to achieve these objectives including but not limited to company-wide policies and operating procedures, periodic testing, systems monitoring, patch management, and mandatory ongoing employee trainings. Additionally, we partner with third-party experts to conduct periodic penetration tests and to evaluate our information technology infrastructure for vulnerabilities. We also evaluate cybersecurity risks associated with third-party vendors that provide the hosted applications we use in our financial close process through review of their System and Organization Controls ("SOC") 1 reports at least annually. We continue to invest in our information technology infrastructure and cybersecurity program to strengthen our ability to protect the confidentiality, integrity, and availability of our data and the security of our information systems. In addition to our cybersecurity program, we assess cybersecurity risks as part of our overall risk management processes, primarily through our annual Enterprise Risk Assessment. Our Enterprise Risk Assessment surveys various employees and leaders throughout our organization with the goal of evaluating our risk landscape, enhancing our overall understanding of risks to our business, and ultimately managing and/or mitigating identified risks. We assess various risks, including cybersecurity related risks, based on the likelihood of an incident occurring, impact to our organization if an incident occurred, and the level of internal control we currently have over the risk. The results are analyzed to identify vulnerabilities and then risk management/mitigation plans are designed, implemented, and evaluated for effectiveness.

companyName: COLLEGIUM PHARMACEUTICAL, INC

ticker: COLL


text: Our program includes annual review and assessment by external, independent third-parties, who evaluate and report on our internal incident response preparedness, adherence to best practices and industry frameworks, compliance with applicable laws and regulations, and help with identifying areas for continued focus and improvement. We perform penetration tests and an independent audit every quarter to ensure our systems are secure. We also carry general liability insurance coverage and coverage for errors and omissions that is expected to provide protection against certain potential losses arising from a cybersecurity incident. However, such insurance may not be sufficient to cover all of our potential losses and may not continue to be available to us on acceptable terms, or at all.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: CEL-SCI's risks from cybersecurity threats have not affected or are reasonably not likely to materially affect its business strategy, results of operations, or financial condition.

companyName: CEL SCI CORP

ticker: CVM


text: We continue to improve our ability to defend against, respond to, and recover from ransomware and other cyber events; enhance application cybersecurity capabilities, including defenses against fraud attacks; and to ensure security capabilities are built into new cloud-based platforms that we adopt. We are also required to maintain strong cyber defense protocols in the states where we are authorized or licensed to write business. We monitor the status of new cybersecurity regulations, including notification requirements.

companyName: SAFETY INSURANCE GROUP INC

ticker: SAFT


text: The audit committee of the Company's board of directors, with the assistance of the Company's Chief Financial Officer and Vice President of Information Technology, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters.

companyName: MARIMED INC.

ticker: MRMD


text: SecureTech believes it has adequate processes and systems to maintain the confidentiality of its communications and records. Given our current level of sales and small number of employees, we do not perceive cybersecurity threats as a material risk at this time. However, SecureTech presently lacks formal processes for assessing, identifying, and managing cybersecurity risks directly or through third-party service providers. Additionally, we have not engaged any assessors, consultants, auditors, or other third parties concerning cybersecurity matters.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: Our recent merger with Berry presents an opportunity to enhance and unify our cybersecurity risk programs by integrating the strengths of both legacy cybersecurity organizations. As part of this integration, we are conducting a comprehensive cybersecurity risk assessment, harmonizing cybersecurity policies, processes, operations, and consolidating the cybersecurity functions into a single organization. Our integration efforts will concentrate on maintaining the continuous availability of our operations while aligning our organization's risk management strategy.

companyName: Amcor plc

ticker: AMCR


text: Other than as described above, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. We continue to enhance our data security infrastructure and take further steps to prevent unauthorized access to our systems and the data we maintain. For additional information regarding the risks from cybersecurity threats we face, see "Risks Related to Our Business – We could incur significant liability, and our business, financial condition, results of operations and reputation could be harmed, if our information systems are breached or we otherwise fail to protect customer, investor, employee or Company data or systems" under Part I, Item 1A. "Risk Factors" above.

companyName: 1st FRANKLIN FINANCIAL CORP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors- Legal and Regulatory Risks".

companyName: KOHLS Corp

ticker: KSS