text: The Company has engaged third parties to perform information security risk assessments and testing on a periodic basis. It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support security incident detection and response activities. In order to identify and manage risk from third parties, the Company has implemented a third-party cybersecurity risk management program involving the assessment of information security risk related to the third-party, with consideration given to the inherent risk level, the adequacy of the third-party's control environment to mitigate those risks, and areas of residual risk. The breadth and depth of the assessment activities are designed to be commensurate with the nature and scope of the services provided by the third party.

companyName: Root, Inc.

ticker: ROOT


text: Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered a committee to provide more focused oversight. In the case of cybersecurity and technology risk, the Board's Risk Committee has that responsibility.

companyName: NewtekOne, Inc.

ticker: NEWT

secItem: Item 1C


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incident is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of our business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: The foundation of our framework rests on these key principles: (i) risk assessment and threat intelligence gathering; (ii) implementing robust security controls; (iii) maintaining effective incident response capabilities; (iv) promoting employee awareness and providing cybersecurity training; (v) managing third-party risks; and (vi) providing governance aligning with business objectives and ensuring senior leadership accountability for cyber security risk management. We continue to integrate our cybersecurity framework into our overarching enterprise risk management processes, enabling us to capitalize on our extensive enterprise-wide experience in risk management and swiftly adapt to the ever-evolving cybersecurity threat landscape.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Role of Management Our information security team that is led by our Chief Information Officer (CIO) is responsible for implementing and operating our Cybersecurity Risk Management program.

companyName: Century Communities, Inc.

ticker: CCS


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.

companyName: KLA CORP

ticker: KLAC


text: Third parties with which we, the Adviser, J.P. Morgan and its affiliates do business, that facilitate our, the Adviser's, J.P. Morgan's, and its affiliates' business activities (e.g., vendors, supply chain, exchanges, clearing houses, central depositories, and financial intermediaries) or that J.P. Morgan has acquired are also sources of cybersecurity risk to us. Third party incidents such as system breakdowns or failures, misconduct by the employees of such parties, or cyber attacks, including ransomware and supply-chain compromises, could have a material adverse effect on J.P. Morgan, including in circumstances in which an affected third party is unable to deliver a product or service to us or the Adviser, where the incident delivers compromised software to J.P. Morgan or results in lost or compromised information of J.P. Morgan or its clients or customers.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: 1). Network and Data Security: We employ firewalls and access controls to protect our infrastructure and sensitive information from unauthorized access. 2). Regular Security Assessments: We conduct security reviews to identify and resolve potential system weaknesses. 3). Employee Awareness: Our employees are constantly reminded to keep full awareness of cybersecurity risks and best practices. 1). Cyber Attacks: Our systems could be compromised by cyber-attacks, potentially leading to data loss or operational disruption. 2). Data Breaches: There is a risk of unauthorized access to confidential customer and employee data. 1). Incident Response: We maintain an incident response plan to quickly address and minimize cybersecurity incidents.

companyName: Glidelogic Corp.

ticker: GDLG


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Audit Committee regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Audit Committee, as appropriate.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: We also evaluate the information security of potential partners and vendors as part of our vendor selection process and attempt to negotiate adequate protections from such third parties when we enter into contracts with them. Although our security program is designed to identify, prioritize, assess, mitigate and remediate third party risks, we rely on our partners and vendors to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: AGILYSYS INC

ticker: AGYS


text: Southwest's cybersecurity program focuses on people, processes, and technology, and takes a defense-in-depth approach by seeking to align with industry best practices. We invest in annual cybersecurity awareness training and testing for employees. We teach employees about remaining vigilant in daily work activities and practicing good security awareness. Specialized cybersecurity training is provided to those in specific job functions particularly susceptible to cyber incidents and phishing simulations are conducted monthly. Annually, a cybersecurity fair is held, and every employee is encouraged to participate. During this fair, outside experts present current and relevant information in an engaging and educational atmosphere. Tabletop exercises are periodically conducted to evaluate controls, processes, and procedures within Southwest and with our partners in the handling of a cybersecurity incident. Southwest maintains partnerships with law enforcement and other participants within the natural gas and electric utility industries. We also participate in the Information Sharing and Analysis Center to share threat intelligence and collaborate on cybersecurity issues affecting our industry.

companyName: Southwest Gas Holdings, Inc.

ticker: SWX


text: Cybersecurity risks deemed to be critical are reviewed by a Critical Threat Committee, which is comprised of members of our senior leadership team including our Chief Financial Officer, Chief Legal Officer, Chief Digital Officer, Senior Vice President of Operations, Chief Technology Officer, Chief Product Officer and Controller/Chief Accounting Officer. The Critical Threat Committee reviews the risk and mitigation plan with the applicable cross-functional management team and facilitates notification to the Audit Committee of emerging critical cybersecurity risks. The Audit Committee and the Board of Directors receive regular briefings on cybersecurity risks. See "Governance" below for further discussion of governance of our cybersecurity program.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: Our Chief Information Security Officer ("CISO") leads GIS, and together with our Chief Compliance Officer ("CCO") are responsible for managing and assessing cybersecurity risk and strategy. They oversee our cybersecurity program and are responsible for identifying, assessing, monitoring, managing and communicating our cybersecurity risks. GIS is comprised of information security professionals with a variety of cybersecurity certifications and accreditations. GIS is aided by the Executive Risk Management Committee, which is comprised of senior leaders and subject matter experts throughout our company, including our CISO and CCO, who serve on the committee to assess and mitigate specific business unit risks, promote an understanding of potential issues, and provide risk resolution and prevention support. GIS and the Executive Risk Management Committee are responsible for keeping the Audit Committee apprised of developments with respect to our cybersecurity strategy and risks.

companyName: ACI WORLDWIDE, INC.

ticker: ACIW


text: Hubbell's Board of Directors (the " Board ") recognizes the critical nature of managing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated oversight of risks associated with cybersecurity threats and has developed mechanisms to ensure effective oversight in managing such cybersecurity risks. The Audit Committee is composed of Board members with diverse expertise, including cybersecurity and technology, financial, and risk management experience.

companyName: HUBBELL INC

ticker: HUBB


text: Our cybersecurity and related controls, policies and procedures ("Cybersecurity Program") are critical business functions protecting our enterprise information systems, data and business operations from external and internal threats. The Cybersecurity Program prioritizes detection, analysis, response and prevention to known, anticipated or unexpected cybersecurity threats, with regular internal and third-party assessments and enterprise risk management governance reviews. The Cybersecurity Program is informed by the National Institute of Standards and Technology's ("NIST") cybersecurity framework standard and is integrated into our overall enterprise risk management framework, along with our compliance requirements under federal and state cybersecurity and related regulations.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Given the evolving nature of cyber threats and the expanding use of online banking and digital services, our risk exposure is expected to remain high. We continuously assess and monitor cybersecurity threats in real time, including risks associated with third-party providers, to enhance our security posture. However, there can be no assurance that our cybersecurity risk management program will fully protect the confidentiality, integrity, and availability of our information systems and solutions. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for further discussion of risks related to cybersecurity.

companyName: BayCom Corp

ticker: BCML


text: The XPLR board is responsible for the oversight of risks from cybersecurity threats. XPLR continues to utilize, through the MSA, NEE's cybersecurity program and capabilities. Significant active cybersecurity incidents and threats are communicated to XPLR's board as they occur.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: We recognize that the safety and security of our systems, technology and infrastructure (and those of key third-party service providers upon which we rely), as well as our content and confidential or sensitive user and employee information, is critical to maintaining the trust and confidence of our users and subscribers, consumers, advertisers and investors (among other stakeholders). As a result, Company management has established programs and related processes designed to manage cybersecurity issues, including the assessment, identification and management of cybersecurity risks, together with related mitigation and recovery efforts. Our board of directors, directly and through our Audit Committee, oversees Company management in the execution of its cybersecurity responsibilities, including the assessment of the Company's approach to cybersecurity risk management.

companyName: Angi Inc.

ticker: ANGI


text: Based on the complex and continuously evolving cybersecurity threat landscape, we established, manage and continually enhance an enterprise-wide Information Security Program ("ISP"). The ISP is based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). The CSF provides guidance for organizations to better manage and reduce cybersecurity risk while helping organizations understand, assess, prioritize, and communicate cybersecurity risks and mitigation. The ISP encompasses critical management components such as risk management, asset management, access controls, cyber awareness training, data security, detection and response, incident response, and business continuity.

companyName: FINANCIAL INSTITUTIONS INC

ticker: FISI


text: Our management team is primarily responsible for assessing and managing our strategic risk exposures, including material risks from cybersecurity threats, with assistance from third-party service providers. Management oversees our cybersecurity process on a day-to-day basis, including those described in "Risk Management and Strategy" above.

companyName: Tivic Health Systems, Inc.

ticker: TIVC


text: The Audit Committee of our Board of Directors (the "Audit Committee") provides oversight over our internal control program, including the adequacy and effectiveness of our information technology infrastructure and cybersecurity program. Each quarter, management provides updates to the Audit Committee regarding its internal control program, including any significant changes to its information technology infrastructure or cybersecurity program. Management also reports any material risks from cybersecurity threats to the Audit Committee. Management periodically provides the Audit Committee with updates on cybersecurity risks and/or trends.

companyName: EKSO BIONICS HOLDINGS, INC.

ticker: EKSO


text: The Company implements processes to assess and manage risks associated with using third-party information system service providers. This risk assessment process assesses both the service provider's security posture as well as the security controls available from the third-party information system. The service provider's security posture assessment includes reviewing any third-party party attestations as well as third-party controls in the following areas: assets, data flows, authentication, access, monitoring, response, and recovery. Depending on the type of system or data, additional controls may be assessed.

companyName: OSHKOSH CORP

ticker: OSK


text: Adient's management strategy includes evaluating and deploying tools and technologies for cyber protection and detection, addressing risks according to likelihood and magnitude, performing cybersecurity related tabletops, phishing exercises, engineering and architectural reviews, and penetration tests to simulate incidents, as well as conducting ongoing awareness trainings.

companyName: Adient plc

ticker: ADNT


text: Company is in the process of establishing a cybersecurity policy which will implement protocols to evaluate, recognize, and address significant risks, including those posed by cybersecurity threats. This strategy encompasses the utilization of standard traffic monitoring tools, educating personnel to identify and report abnormal activities, and partnering with reputable service providers capable of upholding security standards equivalent to or exceeding our own.

companyName: DIH HOLDING US, INC.


text: Reporting to the Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Community Healthcare Trust Inc

ticker: CHCT


text: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Report.

companyName: Leslie's, Inc.

ticker: LESL


text: We maintain an information security program comprised of policies and controls designed to reduce our cybersecurity attack surface and to mitigate cybersecurity risk. However, at any given time, we face known and unknown cybersecurity risks and threats that are not fully mitigated, and we discover vulnerabilities in our program. We continuously work to enhance our information security program and risk management efforts.

companyName: Research Solutions, Inc.

ticker: RSSS


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds Bachelor's and Master's degrees in Business Administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO maintains over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with 3rd party security partners surrounding monitoring and incident response services.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: The Company has established a corporate-level global Information Security Incident Response Team ("ISIRT"), which provides a centralized, coordinated response to, and management of, cybersecurity incidents that may present significant risk to the Company's operations, valuation, brand or reputation, employees, and customer or business relationships. The Company's cybersecurity response team is comprised of multiple subject-matter experts, including information technology, cybersecurity and risk management members with a combined experience of well over 60 years. Core members of the ISIRT consist of the Vice President, Financial Operations and Project Management ("Financial Ops"); Senior Vice President, General Counsel, and Corporate Secretary ("General Counsel"); Chief Information Security Officer ("CISO") who reports to the Chief Information Officer ("CIO"); Chief Privacy Officer ("CPO"); Vice President, Corporate Treasurer ("Treasury"); Director, Risk Management & Insurance ("Risk Management"); and Cyber Security Manager ("Information Security"). If a cybersecurity incident warrants activation of the ISIRT, the Company's Financial Ops and the General Counsel will notify, as appropriate, the Company's executive leadership and the Audit Committee. We also engage specialized third-party consultants to proactively support our cybersecurity efforts, which include but are not limited to, application and network security, information risk management, as well as business continuity and disaster recovery.

companyName: BRUKER CORP

ticker: BRKR


text: The Rocket Companies Vendor Risk Management Program extends our safeguards to third-party service providers. Our Vendor Risk Management Program includes a robust due diligence process to review and affirm on an initial and periodic basis that our third-party service providers protect our information with the same rigor we require of ourselves.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Role of our Board of Directors Our Board of Directors oversees the Company's enterprise risk management framework, which includes information security. The Board has delegated responsibility for overseeing enterprise risk to its Risk Committee, which is governed by a formal charter. Consistent with the Risk Committee Charter, management reports regularly to the Risk Committee on key risks to the Company, including cybersecurity risks. Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") report regularly to the Risk Committee on the overall status of, and any recommended changes to, the information security program, compliance with applicable regulations and material matters related to the program. The Risk Committee Chair reports to the Board of Directors on matters discussed during Risk Committee meetings.

companyName: PRA GROUP INC

ticker: PRAA


text: The purpose of the Cybersecurity Committee is to assist the Board in fulfilling its oversight responsibility with respect to its information technology use and protection, including enterprise cybersecurity and data privacy, among other things. The Cybersecurity Committee receives, reviews, and discusses reports from members of management, as appropriate or required by law, including but not limited to the Chief Information Officer, Chief Information Security Officer, Chief Risk Officer, Chief Legal, Compliance and Administrative Officer, and other officers or employees as appropriate, regarding TMCC's practices, management and functioning of technology operations and information security, cybersecurity and data privacy risks. The Cybersecurity Committee reports to the Board regarding its activities, its receipt of reports regarding material cybersecurity and data privacy issues, material issues found in vulnerability assessments or penetration testing, and reports from the Chief Information Officer and Chief Information Security Officer.

companyName: TOYOTA MOTOR CREDIT CORP


text: Board Oversight of Cybersecurity Matters The Board considers oversight of CVR Energy's risks and risk management activities, including those related to cybersecurity risk, to be a responsibility of the entire Board. The Board also delegates certain risk oversight responsibilities to certain of its committees, and oversight of the Company's cybersecurity risk is delegated by the Board to its Audit Committee. The Audit Committee receives regular reports, typically on a quarterly basis, from management regarding information technology, cybersecurity risk, AI use and governance, and efforts to prevent and mitigate such risks. The Chairperson of the Audit Committee subsequently reports on these activities to the full Board, which equips the Board and its committees to fulfill their risk oversight role.

companyName: CVR ENERGY INC

ticker: CVI


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cybersecurity Committee of the Board of Directors (the "Cybersecurity Committee"). Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board. The Cybersecurity Committee consists of at least three members of the Board, all of whom are independent. Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.

companyName: MAXLINEAR, INC

ticker: MXL


text: Our Information Security Officer and our cybersecurity team oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes by which our Information Security Officer and our cybersecurity team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include monitoring of network, system and application logs, review of vulnerability scans and penetration test results, review of industry sources for vulnerability and threat indicators, and use of third-party service providers for audit or assessment purposes. In the event of a significant cybersecurity incident that is identified by the Company, Blend leadership and the Audit Committee are informed by the Information Security Officer or our manager of security operations to support swift and informed decision-making.

companyName: Blend Labs, Inc.

ticker: BLND


text: Business Continuity and Incident Response plans that are designed and tested for anticipated operational failures, natural disasters, cyberattacks, and other disruptive events; and an Information Security Awareness program to ensure employees and customers maintain an awareness of information security threats and best practices to prevent them.

companyName: SOUTH PLAINS FINANCIAL, INC.

ticker: SPFI


text: Our Board is responsible for overseeing our strategy and approach to addressing information security risks, including managing and assessing risks from cybersecurity threats, both directly and through the audit committee. The audit committee is responsible for reviewing and monitoring the Company's cybersecurity and information security policies and its internal controls regarding cybersecurity and information security. In addition, the audit committee is responsible for regularly reporting to the Board on the substance of such reviews and, as necessary, recommending to the Board such actions as it deems appropriate. Our CISO reports on information security risks at least annually to the Board and quarterly to the audit committee or Board.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: We have implemented an Information Security Management System Program to secure sensitive data protected by us. This program includes: • establishing policies governing data security; • monitoring data access throughout the organization's independent subsidiaries; • providing continuous security training and awareness; • establishing controls over devices on the network which are actively tracked, monitored and evaluated for new, missing, or updated software needed to strengthen security on the device, patch known vulnerabilities, or stabilize software or operating system issues; • protecting sensitive data through encryption techniques; and • designing and implementing systems to include backup and recoverability principles, such as periodic data backups and safeguards in the case of a disaster.

companyName: ENSIGN GROUP, INC

ticker: ENSG


text: We are materially dependent upon our networks, information technology infrastructure and related technology systems to provide services to our customers, manage our internal operations and support our strategic objectives. Cyber-attacks have become prevalent in our industry, and the techniques used to sabotage or obtain unauthorized access to systems are constantly expanding and evolving. Malicious actors are increasingly sophisticated in their methods, tactics, techniques and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Our board of directors has approved management committees including the Information Technology Steering Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact. These committees provide oversight and governance of the technology program and the information security program. These committees generally meet monthly and quarterly, respectively, to provide oversight of our risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Information Technology Steering Committee on a monthly basis (or more frequently as may be required by the Incident Response Plan).

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: We maintain a global cybersecurity incident response plan and related playbooks, for execution by the SOC team and CSIRT, in coordination with internal and external stakeholders, as applicable. Significant incidents are escalated to a cross-departmental team to assess materiality based on qualitative and quantitative factors. This team consists of executives representing core business functions, including, among others, information technology, legal, finance, accounting, data protection and business divisions, in consultation with third-party advisors, as applicable. We undertake periodic leadership tabletop exercises and periodic adversarial ("red team") exercises simulating incident response under common risk scenarios. As an acquisitive organization, we have also established a program to increase our visibility into the cybersecurity environment of acquisition targets prior to closing.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Authentication (MFA): We require MFA for all system access, adding an extra layer of security to protect against unauthorized access.

companyName: Health In Tech, Inc.

ticker: HIT


text: an outsourced security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;

companyName: NEPHROS INC

ticker: NEPH


text: Occidental's cybersecurity strategy is intended to mitigate cybersecurity threats identified in the risk management process and provide a framework for Occidental to have appropriate administrative, technical and physical safeguards to protect its systems and data and respond effectively to cybersecurity threats. The Company's cybersecurity program aligns with the NIST framework and leverages people, processes and technology to identify and respond to cybersecurity threats in a timely manner. Occidental relies on continuous security monitoring, penetration testing, vulnerability scanning, personnel training and other tools to identify and mitigate potential cybersecurity threats. Occidental also has established cybersecurity policies that address its cybersecurity practices and controls. Occidental has invested in broad cybersecurity awareness and mandatory training to educate those with access to company networks on Occidental's cybersecurity policies and best practices. Occidental conducts regular phishing tests to educate, train and assess the workforce's ability to identify malicious emails. The Company also conducts internal security audits and other readiness tests, including audits conducted by third parties and tabletop exercises, to assess and improve preparedness and promote communication and monitoring across the organization. In addition to its administrative and technical safeguards, Occidental has implemented physical safeguards intended to mitigate risks to its systems. Using a standardized written evaluation and other investigative processes, Occidental identifies and assesses cybersecurity risks flowing from its vendors and suppliers, and manages these using a risk-based approach.

companyName: OCCIDENTAL PETROLEUM CORP /DE/

ticker: OXYWS


text: Board of Directors The Board of Directors, in coordination with the Audit Committee, oversees the Company's management of cybersecurity risk. The Board receives monthly reports from the CIO, focusing on cybersecurity and information technology updates. The reports include key insights regarding our security risk score, areas of focus, and metrics from our third-party provider regarding security investigations and incidents as well as the results of training and phishing simulations. The Audit Committee receives periodic updates on information security risk and maturity of our ISP. The Audit Committee also receives reports with the results of security assessments conducted by third-parties.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: To date, no risks from cybersecurity threats from Longbridge have materially affected or are reasonably likely to materially affect our Company.

companyName: Ellington Financial Inc.

ticker: EFC


text: Our Board has overall oversight responsibility for our risk management, including our cybersecurity risk management. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored. Any significant cybersecurity incidents are reported to the audit committee of the Board, which consists of only independent directors. We have not experienced any cybersecurity incidents in fiscal years 2023 or 2022.

companyName: ECD Automotive Design, Inc.

ticker: ECDA


text: Attack Surface Management - Managing vulnerability and patch management, network penetration testing, application security testing and exercises, including cyber-attack simulations and tabletop exercises with senior management to detect control gaps.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plans (IRP). Through the ongoing communications from these teams, the Steering committee monitors the effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any credible threats or security concerns to the Board when appropriate.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: The full Board of Directors engages in oversight of UScellular's cybersecurity risks. The Board of Directors receives regular updates from management on technology and security updates and UScellular's assessment of cybersecurity threats and mitigation plans. The UScellular Audit Committee oversees the processes over internal controls and financial reporting that includes controls and procedures that are designed to ensure that significant cybersecurity incidents are communicated to both senior management and the Audit Committee. Cybersecurity is also discussed with the Technology Advisory Group of the Board of Directors as warranted, at least on an annual basis.

companyName: ARRAY DIGITAL INFRASTRUCTURE, INC.

ticker: AD


text: Our CIO and CISO provide updates to the Audit Committee, and our VP of Product Security provides updates to the QRC, multiple times per year regarding BD's cybersecurity risk management program, including the results of third-party assessments, progress towards cybersecurity goals and objectives, product cybersecurity matters, third-party risk management, regulatory compliance and other topics as needed. We also have processes by which certain cybersecurity incidents and breaches are escalated and reported to the Board of Directors or a Board committee, as appropriate, based on our management's assessment of risk.

companyName: BECTON DICKINSON & CO

ticker: BDX


text: Since 2015, Synopsys is not aware of any material information security breaches and has not made any associated penalties/settlements, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none. During the same time period, while some of our suppliers have experienced security breaches, none of these breaches have had a material impact on Synopsys.

companyName: SYNOPSYS INC

ticker: SNPS


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on April 1, 2022 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: Golub Capital Direct Lending Unlevered Corp


text: He holds multiple professional certifications, including CISSP, PMP and multiple SANS certifications. Our chief technology officer and senior director of cybersecurity and compliance report to the Audit Committee on these matters. maintain a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our business is subject to complex, stringent and evolving U.S. and foreign laws, regulations, and rules, contractual obligations, industry standards, policies and other obligations relating to privacy and data protection. Our actual or perceived failure to comply with such obligations could result in regulatory investigations or actions, litigations (including class claims) and mass arbitration demands, fines and penalties, disruptions of and changes to our business practices, monetary penalties, reputational harm, loss of revenue or profits, and other adverse business consequences."; and "If our information technology systems, or those used by our CMOs, CROs, commercial vendors or other contractors, consultants or third parties with whom we work, or our data are or were compromised, we could experience material adverse consequences, including but not limited to regulatory investigation, actions, litigation, fines and penalties, disruptions of our business operations, reputation harm, loss of revenue or profits, and other adverse consequences."

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including periodic third-party reviews of our cybersecurity program to help identify areas for continued focus, improvement and compliance.

companyName: TrueBlue, Inc.

ticker: TBI


text: As many security threats involve social engineering, the Company has a multifaceted security training program for its employees. Mandatory cybersecurity training classes are administered semi-annually. Tests of employees' ability to thwart attacks are run successively throughout the year, and remedial refresher courses are required when employees fail the tests. In addition, security awareness assessment is required as part of the annual employee review process.

companyName: Alexander & Baldwin, Inc.

ticker: ALEX


text: Our CISO leads a dedicated internal Global Information Security ("GIS") team that is responsible for leading enterprise-wide information cybersecurity strategy, policy, standards, architecture, and processes, all of which are designed to prevent, detect and respond to information security threats, as further described in "Risk Management and Strategy" above. The CISO's experience includes more than 20 years in the security and fraud profession in multiple high-risk industries, including the critical infrastructure sector, and encompasses various cybersecurity leadership roles and almost seven years as a CISO. She is a Certified Information Systems Security Professional (CISSP) and has a Master's Degree in Information Systems Management.

companyName: Anywhere Real Estate Group LLC


text: We also created a SCRDC composed of members from cybersecurity, privacy, legal, audit, and finance teams. This committee's objective is to review and discuss the nature of cybersecurity and privacy incidents and determine impact and materiality.

companyName: CRAWFORD & CO

ticker: CRD-A


text: Our CISO is responsible to communicate potential and actual cybersecurity incidents to our senior leadership team in a prompt manner. We have established internal reporting processes so that the Board of Directors and the Audit Committee promptly will receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. Such processes are evaluated on a regular basis. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including outside advisors to the extent appropriate.

companyName: Crane NXT, Co.

ticker: CXT


text: We conduct periodic risk assessments to identify cybersecurity threats. These risk assessments include identifying reasonably foreseeable potential internal and external risks, the likelihood of occurrence and any potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, controls and other safeguards in place to manage such risks. We also use third-party service providers from time to time in connection with our risk assessment processes.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: Although our "Risk Factors" section in this report presents information about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. Notwithstanding our investment in cybersecurity, we may not be successful in identifying a cybersecurity risk or preventing or mitigating a cybersecurity incident or product security vulnerability that could have a material adverse effect on our business, results of operations, or financial condition. Although we maintain cybersecurity insurance, the costs related to cybersecurity incidents may not be fully insured. For a discussion of cybersecurity risks affecting our business, see "Item 1A—Risk Factors—Risks Related to our Business and Industry—If we experience a security incident, or unauthorized access to or other unauthorized processing of confidential information, including personal data, otherwise occurs, our software may be perceived as not being secure, customers may reduce the use of or stop using our products, and we may incur significant liabilities."

companyName: Elastic N.V.

ticker: ESTC


text: Proactive Security Measures: In addition to risk assessments, we employ proactive security measures to enhance our cyber defenses. These measures include the continuous monitoring of network activity, the implementation of access controls and encryption protocols, and the deployment of intrusion detection systems to swiftly detect and respond to any suspicious activities.

companyName: Jet.AI Inc.

ticker: JTAI


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team. Our Director of Operations & Information Technology has approximately 20 years of experience in his field, and Bachelor of Science in Information Technology Concentration in Information Systems Security and an MBA in Business Analytics.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: The chair of the cybersecurity steering committee, our executive director of cybersecurity, has over 25 years of information technology industry experience, including 20 years focused on cybersecurity, and master's degrees in a cybersecurity discipline and in business administration, in addition to multiple certifications related to information technology and cybersecurity.

companyName: Sage Therapeutics, Inc.


text: The Bank's dedicated Information Security Department, led by our Chief Information Security Officer, is comprised of specialized professionals responsible for the processes and procedures to design and implement protective, proactive and reactive measures to protect the Bank against cybersecurity risks, and for developing, documenting, and approving the Bank's technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of the Bank's information technology assets and data under the Bank's control. The Chief Information Security Officer's expertise in cybersecurity includes holding a Bachelor of Science degree in Computer Engineering, a Master of Business Administration degree in Technology Management, and Information Systems Security Professional certification, along with decades of experience in information technology and cybersecurity.

companyName: Federal Home Loan Bank of San Francisco


text: The Company's processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity, and incident response training for all employees. This training is also supplemented with periodic phishing tests.

companyName: CROSSFIRST BANKSHARES, INC.


text: Our Chief Information Officer (CIO) and Chief Information Security Officer (CISO) lead our cybersecurity program in collaboration with the Company's business functions. The CIO or CISO present updates to the Audit Committee quarterly and, as necessary, to the full Board. These regular reports include updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. The CIO also promptly informs and updates the Audit Committee and the Board about any information security incidents that may pose significant risk to the Company. The Company's program is periodically evaluated by external experts, and the results of those reviews are reported to the Audit Committee and the Board as necessary.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Technology Committee of our board of directors. The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: CULLEN/FROST BANKERS, INC.

ticker: CFR


text: The Audit Committee of the Board oversees our cybersecurity risk and receives regular reports from our management team on various potential cybersecurity matters, including areas of emerging risks, incidents and industry trends, and other areas of importance. We may in the future engage an assessor(s), consultant(s), auditor(s) or other third party(s) to supplement our existing cybersecurity processes.

companyName: Inflection Point Acquisition Corp. V

ticker: IPEX


text: We have an enterprise-wide information security program designed to identify, protect, detect, respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools and third-party managed security services that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring and detection tools. Security awareness training is also a key component of our information security program and involves required training for our employees several times per year.

companyName: AGILYSYS INC

ticker: AGYS


text: The Company's VP of Information Security is responsible for implementing the Information Security Policy on a day-to-day basis along with the Security Committee (as defined in the Information Security Policy), which includes the heads of the following departments, at a minimum: Information Security, Technology, Compliance, Product Management, Internal Audit, and Legal.

companyName: OptimizeRx Corp

ticker: OPRX


text: We expect to continue to invest in long-term solutions to protect against cybersecurity risks and threats. Except as otherwise provided herein, this Item 1C reflects the Company's cybersecurity policies and procedures as of December 31, 2024.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Greg C. Thomas is an experienced information technology professional in our information technology department and has served as Chief Technology Officer since 2018. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Thomas possesses a proven real estate industry track record of guiding organizations through strategic technology, organizational, risk mitigation, process improvement initiatives, and digital transformations. He also possesses extensive experience in technology and cybersecurity, gained over his career spanning more than 30 years, including as Chief Information Officer at two other large real estate firms, as well as in leadership roles within the real estate industry technology practices of Ernst & Young LLP and Deloitte LLP. He earned Bachelor of Science degrees in Systems Analysis and Finance from Miami University.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework, or NIST CSF. This means that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. It does not, however, mean that we meet any technical standards, specifications, or requirements.

companyName: Phathom Pharmaceuticals, Inc.

ticker: PHAT


text: As of December 31, 2023, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: Green Plains Inc.

ticker: GPRE


text: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.

companyName: BOYD GAMING CORP

ticker: BYD


text: Reporting to Board of Directors The CISO, in his capacity, regularly informs our Chief Financial Officer and Chief Executive Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Compliance Committee and the full Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: U S PHYSICAL THERAPY INC /NV

ticker: USPH


text: Role of Management Cybersecurity risk is integrated into our Global Risk Management process. Cybersecurity risk continues to be identified as one of our key enterprise risks. Risk owners from the Management Committee, senior leadership and the Global Risk Management function have been assigned to develop risk mitigation plans, which are tracked and reported at least quarterly to the Finance and Risk Committee of the Board and annually to the full Board. See "Item 1 – Business – Global Risk Management" for more information on the Global Risk Management function.

companyName: ASSURANT, INC.

ticker: AIZ


text: We leverage the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to better manage and respond to cybersecurity risks in protecting our infrastructure and sensitive data. We have mapped our people, process, and technology in alignment with the categories defined in the NIST industry standard framework: Identify, Protect, Detect, Respond, and Recover. Additionally, Insulet's information security management system is ISO 27001 and 27701 certified. For the sixth consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards.

companyName: INSULET CORP

ticker: PODD


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity standards and practices follow industry trends, which align with frameworks established by the Center for Internet Security ("CIS"). The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients and business partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Axogen, Inc.

ticker: AXGN


text: Risk Management and Strategy recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Cannaisseur Group Inc.

ticker: TCRG


text: As part of the Company's overall enterprise risk management program, the Company has developed business continuity and disaster recovery plans, which include measures to respond to potential disruptions to our information technology systems (or information technology systems of third parties on which we rely). The Company also maintains a written information security incident response plan and conducts tabletop exercises to enhance incident response preparedness. The Company is also a member of an industry cybersecurity intelligence and risk sharing organization.

companyName: Bath & Body Works, Inc.

ticker: BBWI


text: Recognizing the evolving nature of cybersecurity threats, we have been engaging with external experts, including cybersecurity assessors, consultants, and auditors, to assess and enhance our risk management systems. These third parties are assisting us with evaluating our cybersecurity posture, recommending improvements, and advising on the implementation of best practices. As we progress, we will continue leveraging these external insights to enhance our cybersecurity strategies and ensure alignment with industry standards.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: The cybersecurity program includes: • a dedicated cybersecurity team; • information technology and telecommunication systems implemented with segmentation and multiple levels of access controls; • a security operations center that continuously monitors information technology and telecommunications systems; • an incident response team composed of individuals from the information technology, operations, accounting, finance, legal, and communications departments, as needed, which is activated to respond to cybersecurity incidents; • periodic drills and exercises to address risks and prepare for extraordinary scenarios, including industry collaboration on incident preparation, such as GridEx drills hosted by NERC, participation in a full activation drill at least annually, and several tabletop drills during the year; • periodic drills with the full executive team, including the Chief Executive Officer (CEO), Chief Financial Officer (CFO), Chief Accounting Officer (CAO), Chief Information Officer (CIO) and General Counsel; • periodic information security awareness training and phishing simulations for employees and contractors who access our networks; • periodic security assessments of evolving risks and threats that lead to strengthening of cybersecurity measures; • implementation of automation solutions to strengthen detection and response capabilities; and • maintenance of cyber liability insurance.

companyName: WISCONSIN POWER & LIGHT CO


text: Third-party specialists are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our cybersecurity program is designed and implemented to assess, identify, mitigate and manage risks from cybersecurity threats that may result in adverse effects on the integrity and availability of our production and information systems. Among other items, our cybersecurity program is comprised of policies, standards, plans and frameworks for information security, business resilience, insider threat mitigation, technology asset management, cyber risk management, incident response and procurement. Material risks from cybersecurity threats include, among other things, operational disruption, including failure to meet our service level agreements, loss or destruction of data, hardware or intellectual property, and cyber extortion through ransomware. The management of cybersecurity risks, which involves significant and sustained resource commitments and Management attention, is also integrated into the Company's enterprise risk management program through formal processes that help identify and elevate the most serious risks, including those pertaining to cybersecurity, for management at the enterprise level and oversight at the Board level. For more information on the Company's cybersecurity risks and their possible impact on our business strategy, results of operations, or financial condition see Risk Factors – Cybersecurity and Technology Risk Factors in Part I, Item 1A of this Form 10-K.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. We maintain processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management system. Our enterprise risk register inventories significant risks to our company, including significant cybersecurity risks, and we maintain a separate functional risk register, specifically focusing on potential cybersecurity risks. Within these risk registers, we record each identified risk, describe its likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external service provider to support our cybersecurity team by performing penetration tests and periodic external security evaluations.

companyName: Transocean Ltd.

ticker: RIG


text: The assessment, identification and management of cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") process. Cybersecurity risk is included among the significant residual risks identified during the Company's assessment of business risk. This risk assessment process is used to inform the Company's strategic planning process, and to develop action plans to appropriately address and manage risk. It is also used to focus our Board and its committees on the most significant risks to the Company. In addition, the enterprise risk function has established foundational frameworks for assessing, monitoring and overseeing the Company's risks, including risks from cybersecurity threats. This includes reporting on issues, risk events or incidents and emerging risks to applicable risk committees to provide monitoring of key risk exposures.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: We engage in the periodic assessment and testing of our cybersecurity policies and practices. These efforts include a range of activities focused on evaluating the effectiveness of our cybersecurity measures and planning. We engage third parties to perform assessments on various aspects of our cybersecurity measures, including information security maturity assessments, audits, and reviews of our information security control environment and operating effectiveness. The results of such assessments, audits, and reviews are reported to senior management and the Audit Committee, and we adjust our cybersecurity processes as necessary based on the information provided by these assessments, audits, and reviews.

companyName: GATX CORP

ticker: GATX


text: Cybersecurity is an integral part of risk management at Nabors. We rely on our technology infrastructure and information systems to interact with clients, vendors, operate our drilling rigs, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: We have developed and maintain a cybersecurity risk management methodology intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management methodology is integrated into our overall enterprise risk management, and apply across the Company to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk management processes and procedures, we have instituted a cybersecurity awareness designed to identify, assess and manage material risks from cybersecurity threats. The cyber risk management methodology involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity awareness, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations.

companyName: Carriage House Event Center, Inc.


text: We have also established an interdisciplinary Cybersecurity Incident Response Team ("CIRT"), which is responsible for our incident response plan, our security controls, and for assessing incidents reported by our information technology security team. In addition, our cybersecurity risk management program includes: Monitoring and evaluation of our vulnerability performance.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: Although no cybersecurity incidents during the year ended December 31, 2024 which had a material impact on our business strategy, results of operations or financial condition, the scope and impact of any future incident cannot be predicted. See Item 1A. - Risk Factors for more information about our information security and cybersecurity risks.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. The threat landscape is constantly changing and will continue to as new technologies, such as AI, evolve.

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: The AIR Operating Partnership takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents. We regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems according to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall approach to enterprise risk management. To protect its information systems from cybersecurity threats, We use various security tools that help it identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. Our cybersecurity program is designed to align with the National Institute of Technology Standards Cybersecurity Framework 2.0, which provides a structured approach for governing, assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Apartment Income REIT, L.P.


text: leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Our SVP of IT and Facilities is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: Vaxcyte, Inc.

ticker: PCVX


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes an initial assessment by our Sr. Director, Information Technology (our " Sr. Director of IT ") and IT team, and on an ongoing basis of a few key high-risk third-party systems by our security engineers. We also rely upon certain third-party system providers, including cloud and non-cloud programs provided by software developers such as Microsoft Corporation, Blackline Systems, Inc., Workiva, Inc., and others, to review and notify their customers of any data breach. This approach, both internal and reliance on external review notification, is designed to mitigate risks related to data breaches or other security incidents originating from third-parties.

companyName: Energy Recovery, Inc.

ticker: ERII


text: Our SVP, Global Operations is responsible for monitoring the prevention, mitigation, detection, and remediation of cybersecurity incidents and reports the same to the Audit Committee of the Board each quarter. The Audit Committee has been delegated the responsibility for fulfilling the Board's oversight responsibilities regarding cybersecurity risk.

companyName: Silvaco Group, Inc.

ticker: SVCO


text: Our executive management team, along with our managed information technology service provider, is responsible for assessing and managing risks from cybersecurity threats to the Company, including our Confidential Information and Critical Systems.

companyName: New Asia Holdings, Inc.

ticker: NAHD


text: Cybersecurity is fundamental to FIS' complex, global business. As part of our business, FIS, its vendors and technology partners electronically receive, process, store and transmit a wide range of confidential information, including sensitive customer information and consumer personal data. Our operations extend to managing payment systems, cash access and prepaid card systems. Cyberattacks on information technology systems and the vendors and technological supply chain they rely on continue to grow in frequency, complexity and sophistication. This is a trend we expect to continue. Cyberattacks have garnered significant attention from individuals, businesses, governmental entities and the media drawing the focus of a large ecosystem of criminal threat actors. The objectives of these cyberattacks include, among other things, gaining unauthorized access to systems to disrupt operations, steal information, seek ransom payments from victims, perpetrate financial fraud, or sell stolen information. Perpetrators of cyberattacks attempt to exploit technical, human, social, and organizational vulnerabilities to gain unauthorized access. There is a growing trend of identifying and exploiting vulnerabilities in widely used technologies or vendor systems, allowing a single compromise to extend unauthorized access to numerous systems.

companyName: Fidelity National Information Services, Inc.

ticker: FIS


text: Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: ALIMERA SCIENCES INC


text: Investigating the root cause Communication and reporting to stakeholders Recovering and restoring affected systems Our incident response procedures include escalation protocols to notify appropriate members of senior and executive management, the Board, and regulatory authorities in a timely manner based on the criticality of the cybersecurity incident. We conduct regular tabletop exercises and simulations to test the effectiveness of our response capabilities.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic or competitive in nature, and tenant data ("Information Systems and Data").

companyName: INNOVATIVE INDUSTRIAL PROPERTIES INC

ticker: IIPR


text: As part of our 80/20 strategic approach and our integration of DS Smith, the Company is evaluating how the ERM Council might operate in 2025 to ensure that our structure supports our strategic goals.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company's cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company's overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2024 Form 10-K for additional information on our enterprise risk management.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: • Cybersecurity incident means an unauthorized occurrence, or a series of related unauthorized occurrences, on or conducted through a registrant's information systems that jeopardizes the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Cybersecurity threat means any potential unauthorized occurrence on or conducted through a registrant's information systems that may result in adverse effects on the confidentiality, integrity, or availability of a registrant's information systems or any information residing therein. • Information systems means electronic information resources, owned, or used by the registrant, including physical or virtual infrastructure controlled by such information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the registrant's information to maintain or support the registrant's operations.

companyName: Arq, Inc.

ticker: ARQ


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engage s a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.

companyName: CONTINENTAL RESOURCES, INC


text: Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager. The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company's cyber risks and threats, the status of projects to strengthen the Company's information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.

companyName: HAWTHORN BANCSHARES, INC.

ticker: HWBK


text: See "Risk Factors" in Part I, Item 1A of this Form 10-K for further information about information and cybersecurity risk.

companyName: CANADIAN PACIFIC KANSAS CITY LTD/CN

ticker: CP


text: We have created a cybersecurity program that endeavors to prevent, detect, contain and respond to material risks from cybersecurity threats and incidents and integrate cybersecurity risk into our enterprise risk management framework and activities. Our program consists of policies and procedures for identification, assessment, remediation, response, and reporting of cybersecurity threats and incidents. The cybersecurity program is a part of our company's ERM framework and activities. The cybersecurity program employs a risk-based approach and draws upon a combination of industry standard frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework and the Payment Card Industry Data Security Standard (PCI DSS).

companyName: Burlington Stores, Inc.

ticker: BURL


text: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risks; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates in conjunction with our overall risk management systems and processes, covering all company risks.

companyName: F5, INC.

ticker: FFIV


text: Our Board of Directors considers cybersecurity risk one of the significant risks to our business. As such, the Board of Directors has retained responsibility for overseeing policies and procedures related to cybersecurity and data privacy matters. The Board of Directors routinely evaluates our cybersecurity strategy to review its effectiveness. Management provides reports to the Board of Directors regarding cybersecurity and other information and operations technology risks.

companyName: ONE Gas, Inc.

ticker: OGS


text: Our cybersecurity program incorporates several control and best practice regimes, including for example, the Center for Internet Security (CIS) controls. We conduct regular internal and external assessments, audits, and tabletop exercises to assess security vulnerabilities, control compliance and incident preparedness. These assessments and exercises include, for example, red team exercises simulating external attacks, crisis management exercises, including incident response, and internal audit reviews. Management and the Board's Cybersecurity Committee reviews the results of these exercises, audits and assessments.

companyName: VERISIGN INC/CA

ticker: VRSN


text: Our Board considers cybersecurity risk as part of its risk oversight function. The Board oversees management's implementation of our cybersecurity risk management program. The Board receives periodic reports from the CISO on our cybersecurity risks. In addition, the CISO and ISOC members update the Board, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant. The Board also receives briefings from the CISO and ISOC members on our cyber risk management program. Board members receive presentations on cybersecurity topics from our CISO, internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Solo Brands, Inc.

ticker: SBDS


text: The Company's approach to managing cybersecurity risks is shaped by insights from the FFIEC CAT, a tool designed for assessing and improving cybersecurity practices. This tool undergoes a thorough examination by an independent third-party on an annual basis to ensure an unbiased and comprehensive evaluation. In its most recent assessment in 2023, the FFIEC CAT identified that the Company is operating at an acceptable level of cyber maturity. This means the bank is effectively handling the inherent risks it faces in five critical areas: cyber risk management and oversight, collaboration on threat intelligence, implementation of cybersecurity controls, management of external dependencies, and resilience in handling cyber incidents.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our IT Manager, who has worked in various roles responsible for securing networks, hardware and other application systems, Chief Financial Officer, and Chief Accounting Officer.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our business is highly dependent on our information systems, including our ability to operate them effectively and to successfully implement new technologies, methods and processes, as well as adequate controls and cybersecurity incident recovery plans. We rely on our information systems to manage our business, data, communications, supply chain, ordering, pricing, billing, inventory replenishment, accounting functions and other processes. In addition, we must protect the confidentiality and integrity of the data of our business, employees, customers and other third parties. Our business involves the collection, processing, storage and transmission of personally identifiable information and other sensitive and confidential information. This data is wide ranging and relates to our employees, customers and third parties, including the subjects of law enforcement. Our compliance obligations include those prescribed under the laws and regulations that dictate whether, how and under what circumstances we can receive, process, hold and/or transfer certain data that is critical to our operations, including data shared between countries or regions in which we operate and data shared among our products and services.

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Impact of Risks from Cybersecurity Threats As of the date of this report, we are not aware of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations and financial condition. We acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents, material or otherwise, remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cybersecurity incident will not occur. While we devote resources to our security measures designed to protect our systems and information, no security measure is infallible. For more information about the cybersecurity risks we face, refer to Risk Factors under Part I, Item 1A of this Annual Report.

companyName: Permian Resources Corp

ticker: PR


text: As discussed in more detail under the heading "Governance" below, our cybersecurity program is led by our Director of Cybersecurity, who reports to our Chief Information Officer, and is responsible for publishing cybersecurity policies and standards, conducting annual risk assessments and maintaining our compliance. Our Chief Information Officer leads our cybersecurity team and regularly reports to our Audit Committee.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET


text: o Third-Party Risk Management: BlackRock maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, counterparties and clients, as well as the systems of third parties that could significantly and adversely impact BlackRock's business in the event of a cybersecurity incident affecting those third-party systems. Operational incidents can arise as a result of failures by third parties with which BlackRock does business, such as failures by internet, communication technology and cloud service providers or other vendors to adequately follow processes and procedures, safeguard their systems or prevent system disruptions or cyber-attacks. Third-party risks are included within BlackRock's ERM framework, and risk identification and mitigation are supported by BlackRock's cybersecurity program. BlackRock also performs diligence on certain third parties and monitors cybersecurity threats and risks identified through such diligence.

companyName: BlackRock Direct Lending Corp.


text: Information regarding cybersecurity risks may be elevated by IT leadership through a variety of channels, including discussions between or among key leaders and our management and reports to the Company's Board of Directors and/or certain Board committees. When a cybersecurity incident is detected, we conduct an immediate assessment, determine materiality, and take appropriate actions as described above. This process is also followed when we are notified that a supplier has a cybersecurity incident. As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or the third parties with whom we work experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."

companyName: Datadog, Inc.

ticker: DDOG


text: the use of a third-party Managed Security Service Provider (MSSP) that includes a 24x7 security operations center (SOC) that is designed to monitor and analyze suspected suspicious activity on our internal network and remediate or escalate activity as appropriate; regular cybersecurity awareness training for employees with access to our information systems, incident response personnel, and senior management; a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; a disaster recovery plan and controls designed to protect against business interruption, including by backing up our critical systems;

companyName: CHEESECAKE FACTORY INC

ticker: CAKE


text: Cybersecurity Program Overview The Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company. The Adviser maintains a comprehensive information security policy to manage risk which details procedures such as incident response, business continuity and disaster recovery management plans, penetration testing and quarterly cybersecurity training for all employees. The Adviser (through the Staffing Agreement with the Administrator) employs a Chief Technology Officer ("CTO"), Bobby Patnaik. Mr. Patnaik has more than twenty years of experience, including fourteen years in financial services. Prior to joining Lafayette, Mr. Patnaik worked at Goldman Sachs Asset Management rising to the Global Head of Institutional/Fund Reporting and Reference Data Technology after spending several years developing and leading middle and back-office technologies. Mr. Patnaik began his career working for several technology and telecommunication companies, including AT&T and Verizon.

companyName: Lafayette Square USA, Inc.


text: The Board of Directors has delegated primary oversight of the Company's cybersecurity risk to the Audit Committee, which receives updates on cybersecurity risks and incidents at each regularly scheduled Audit Committee meeting from the CIO, CISO, and other members of management, as needed. When making decisions regarding director appointments and committee assignments, the Board of Directors takes into consideration the cybersecurity experience of directors and director candidates and strives to maintain cybersecurity expertise on the Board of Directors and Audit Committee. We have protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board of Directors.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Our internally developed infrastructure and systems, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats and incidents, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity or availability of such systems or related information.

companyName: USA Rare Earth, Inc.

ticker: USAR


text: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer ("CIO"), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Vice President, Chief Information Security Officer ("CISO") that is responsible for providing governance, risk and compliance oversight for STERIS's incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence. We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team ("IRT") responsible for managing and responding to cybersecurity incidents, including data breaches. Our IRT is led by the CISO and is comprised of senior management and others, including external resources, as required. Our incident response policy includes steps for detecting and investigating cybersecurity incidents, assessing the nature, scope, and severity of cybersecurity threats, identifying the impact of cybersecurity incidents, communicating cybersecurity incident disclosures, and implementing cybersecurity countermeasures and mitigation strategies. A subcommittee of our IRT reviews and assesses associated public reporting implications of cybersecurity incidents. Our process also includes informing the Board of Directors and the Audit Committee following a material cybersecurity incident.

companyName: STERIS plc

ticker: STE


text: As trusted partners to healthcare providers, patients, biopharmaceutical companies, academic and non-profit institutions, business partners and employees, we appreciate the importance of maintaining a comprehensive and trustworthy information security program. Our information security program is fully integrated into our operations, and a hallmark of our program is its cross-functional approach with our internal privacy objectives and stakeholders.

companyName: Adaptive Biotechnologies Corp

ticker: ADPT


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our comprehensive ERM program and are based on frameworks established by the National Institute of Standards and Technology ("NIST"), Center for Internet Security ("CIS") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: WASHINGTON TRUST BANCORP INC

ticker: WASH


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 28 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 67 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 29 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).

companyName: Coterra Energy Inc.

ticker: CTRA