text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation.

companyName: AXIM BIOTECHNOLOGIES, INC.

ticker: AXIM


text: To proactively identify, mitigate, and prepare for potential cybersecurity incidents, we maintain both a business continuity plan and cyber incident response plan. We recognize that we are exposed to cybersecurity threats associated with our use of third-party service providers. To minimize the risk and vulnerabilities to our own systems stemming from such use, our Information Technology providers identifies and addresses known cybersecurity risks on a continuous basis. In addition, we strive to minimize cybersecurity risks when we first select or renew a vendor by including cybersecurity risk as part of our overall vendor evaluation and due diligence process. We are not aware of any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition as of the date of this Annual Report on Form 10-K.

companyName: Vyome Holdings, Inc

ticker: HIND

secItem: Item 1C


text: NEE, including FPL, uses third parties to periodically assess the extent to which its cybersecurity risk management protocols align with the DOE's Cybersecurity Capability Maturity Model standard. Certain functions within NEE, including FPL, are required to comply with certain regulatory standards that are designed to protect against cybersecurity incidents, including the NERC Critical Infrastructure Protection standards, as well as the NRC cybersecurity protection standards. Further, NEE, including FPL, has a cybersecurity training program and a mock phishing program to educate and train employees on potential cybersecurity risks and on privacy and data protection. Given geopolitical events, NEE, including FPL, continues to take steps to protect against cybersecurity threats to its critical infrastructure, including communications with its employees to ensure heightened awareness of increased cybersecurity threats worldwide.

companyName: FLORIDA POWER & LIGHT CO


text: Board of Directors The Corporate Governance and Risk Assessment Committee (the "Governance Committee") of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. To fulfill this responsibility, the Governance Committee receives regular updates, at least quarterly about the Company's cybersecurity risks and mitigation program from management, specifically the CISO. The Chairman of the Governance Committee provides quarterly reports of such updates to the full Board of Directors. The CISO's quarterly report to the Governance Committee contains updates to the cybersecurity risk register, summaries of any material cybersecurity threats or incidents and responses thereto, updates on cybersecurity trends and the results of any assessments performed. The quarterly reports also include changes to cybersecurity processes, products and third-party service providers, third-party cybersecurity risk reviews, and regulatory changes.

companyName: International Seaways, Inc.

ticker: INSW


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows. See "Risk Factors – General Risks – Cybersecurity breaches or business system disruptions may adversely affect our business."

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Our Enterprise Risk Committee reviews and discusses cybersecurity, information security and data privacy risks at regular intervals. A quarterly Enterprise Risk Committee meeting is chaired by our Chief Risk and Compliance Officer and includes information security briefings led by the Chief Information Security Officer.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: As one of the critical elements of our overall ERM approach, our cybersecurity program includes a focus on the following key areas: • Governance. As discussed further below, the Board's oversight of cybersecurity risk management is supported by the Enterprise Risk Committee of the Board (the "ERC"), which regularly interacts with the Company's ERM function, Corporate Information Security Officer, Business Continuity Director and other key members of management. The activities of the ERC include a quarterly review of our cybersecurity risk profile, and the ERC provides a report of its activities at each meeting of the full Board. • Technical Safeguards. We deploy technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Third-Party Risk Management. We have designed and maintain a comprehensive, risk-based program in accordance with applicable regulatory standards for identifying and overseeing cybersecurity risks, among others, presented by third parties with whom we engage for the conduct of our business, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. • Incident Response Plan. In addition, we maintain a comprehensive incident response plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification to appropriate management committees and, as appropriate, the ERC. The incident response plan is overseen by our Business Continuity Director, who reports directly to our Chief Information Officer, and coordinated across multiple parts of the Company, with key members of management included in the implementation and execution of the plan. The incident response plan is updated as appropriate and evaluated at least annually.

companyName: Ameris Bancorp

ticker: ABCB


text: We use a "cloud-only" environment for our information systems; there is no central access point that provides access to all software and related data. We use third-party clinical research organizations ("CROs") to manage all patient-related data and review their cybersecurity procedures as part of vendor evaluation. Our employees do not have access to any patient-identifiable data.

companyName: Fresh Tracks Therapeutics, Inc.


text: Our information security program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management, including the ELT and the FactSet Board of Directors (the "Board"). We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: Any potential cybersecurity compromise, whether direct or indirect, is analyzed and documented by the securities operations team (the "SO Team") and escalated to the cybersecurity incident response team ("CSIRT") as necessary. The SO Team is comprised of cybersecurity professionals and the CSIRT is comprised of certain of the Sponsor's and Company's executives from legal, corporate communications, IT, compliance, finance, and risk management.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: The Board also engages in oversight of cybersecurity risks. With the input of the InfoSec Committee, our CISO may provide periodic updates to the Board on matters related to cybersecurity as needed.

companyName: ALLURION TECHNOLOGIES, INC.

ticker: ALUR


text: Despite our efforts to manage the risk from cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a further discussion of our cybersecurity risks.

companyName: UNIVERSAL DISPLAY CORP \PA\

ticker: OLED


text: The Company does not believe the April 2024 email spoofing incident was "material" due to the limited amount of money involved and the corrective measures adopted to prevent future incidents of a similar nature.

companyName: Value Exchange International, Inc.

ticker: VEII


text: Our Head of IT provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties. Our Audit Committee regularly meets with our Chief Financial Officer and Head of IT about the Company's ongoing compliance and risk management and reports to the Board regularly.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Internal and external cybersecurity threats and risks, as well as other disasters, may adversely affect our business or the business or our portfolio companies by impairing the ability to conduct business effectively." and "Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business."

companyName: Blue Owl Capital Corp II


text: As part of TMCC's cybersecurity program, TMCC engages with assessors and third-party advisers to perform various services, including assessments of process design and operating effectiveness; security testing and attestation; periodic assessment of enterprise cybersecurity maturity; industry benchmarking; and thought leadership related to continuous improvement of processes, training, technology, and data.

companyName: TOYOTA MOTOR CREDIT CORP


text: Our Board of Directors has designated the Audit Committee as the primary committee responsible for reviewing and managing cybersecurity risks and threats at CytoSorbents. The Audit Committee is comprised of members of the Board of Directors with diverse experience in healthcare, finance and information technology, enabling them to effectively oversee cybersecurity risks and threats. Our management team, with assistance from third-party consultants or advisors as appropriate, provides quarterly updates regarding cybersecurity risks and threats to the Audit Committee and ad hoc updates or communications are provided to the entire Board of Directors as needed.

companyName: Cytosorbents Corp

ticker: CTSO


text: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees the Technology Risk Management function. This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: The Chief Legal Officer acts as the Company's Data Breach Coordinator and leads our Cyber Crisis and Data Breach Response Committee (the "Committee") which consists of the Company's Chief Technology Officer, Chief Financial Officer and Chief Accounting Officer. Cybersecurity incidents that may significantly impact the confidentiality, integrity, or availability of the Company's data or the reliability of the Company's systems or networks are reported to the Committee. The Committee assesses the materiality of each incident, which is made using both quantitative and qualitative analyses to determine an incident's immediate and reasonably likely future impacts. Such cybersecurity incidents are also reported to the Audit Committee. The Company's Data Governance Committee has oversight of that how the Company's data is handled and shared with third parties and is comprised of the Company's Chief Technology Officer, Chief Legal Officer, Chief Human Resources Officer, Chief Accounting Officer, Vice President of Business Shared Services and Chief Audit Executive.

companyName: BrightView Holdings, Inc.

ticker: BV


text: The Sponsor has an information security program and policy in place, as mandated by New Regulation S-K Item 106. The Sponsor engages Align to provide fully outsourced IT services, including 24x7x365 support, cybersecurity monitoring, and disaster recovery. Align's services encompass Office365 security features such as anti-phishing, encryption, and advanced threat protection, alongside endpoint security via Microsoft Entra ID and Intune, enforcing policies like MFA, BitLocker encryption, and geo-blocking. This program is designed to assess, identify, and manage material risks from cybersecurity threats. Regular reviews of cybersecurity and information technology plans are conducted for key service providers, as part of the Sponsor's disaster recovery and business continuity planning process. Additionally, the Sponsor evaluates whether any cybersecurity threats, including those resulting from previous incidents, have materially affected or are reasonably likely to materially affect the Trust and the Funds.

companyName: Teucrium Commodity Trust

ticker: CANE


text: We have implemented and maintain various cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and clinical trial data ("Information Systems and Data").

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our technology and management teams meet regularly with key internal and external stakeholders to review cybersecurity concerns and areas for continued focus and improvement.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: We engage external parties, such as consultants, to enhance our cybersecurity oversight as required. We conduct periodic risk assessments to evaluate our cybersecurity posture, including through annual third-party vulnerability assessment and penetration tests performed by reputable service providers. We conduct risk assessments, as appropriate, on critical third parties who maintain material data or information to help assess and validate the information security capabilities of these third parties. We maintain insurance coverage for cybersecurity insurance as part of our overall insurance portfolio. We also have implemented administrative, technical, and physical safeguards designed to protect our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: The CSC works with the Company's Office of the CISO, which is responsible for the daily direction of cybersecurity risk activities. The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats. Members of the Office of the CISO also engage with the Company's internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities. The Office of the CISO consists of the Director of Cybersecurity, the Chief Information Officer and other information technology and cybersecurity specialists. The Office of the CISO has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management.

companyName: HYSTER-YALE, INC.

ticker: HY


text: Our information security team is led by our CSO. Mr. Friedman has held the position of CSO at organizations across multiple industries, including financial services, for over 13 years and holds industry security certifications including Certified Information Systems Security Professional ("CISSP"), Certified Information Systems Auditor ("CISA"), Certified Information Security Manager, and Certified in Risk and Information Systems Control. Many members of the information security team also hold CISSP, CISA and other security related certifications. The information security team is made aware of security risks and incidents through a number of channels: • performance of risk assessments on at least an annual basis by the Security Risk Committee; • providing SOC capabilities for the detection and response of cyber incidents; • serving as the point of contact for reporting actual or suspected cyber incidents; • managing compliance and certification for in-scope security related compliance frameworks and regulations; • managing internal and external penetration tests, vulnerability scans, and the Company's vulnerability disclosure program; and • monitoring of cyber threat intelligence and evaluation and analysis of the potential impact of "zero day" vulnerabilities.

companyName: LIVEPERSON INC

ticker: LPSN


text: We have an Information Technology "IT" professional who oversees our information security policies and procedures. Our IT department maintains a cyber incident reporting and response process and provides management notifications based on the seriousness of any incident. Our information security policies and procedures are required to be reviewed on a regular basis.

companyName: Synergy CHC Corp.

ticker: SNYR


text: The SCC meets at least quarterly to discuss its oversight of our cybersecurity policies and procedures, risk-management practices and controls, and efforts to mitigate and prevent cybersecurity risks. The SCC may meet more frequently if required by our Incident Response Plan to facilitate timely response, monitoring, risk-management, and recovery efforts. The SCC is also charged with periodically reporting to management, the Board, and the Risk Committee, the status, and results of our compliance with our security program, results of security assessments, and effectiveness of remediation activities.

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: i. Integration into the COSO-Based Enterprise Risk Management Framework Our overall risk management system provides a structured and consistent approach to risk identification, assessment, and response, including those related to cybersecurity. The integration of cyber risks into our ERM framework underscores our commitment to upholding a robust governance structure that emphasizes the protection of our information systems. We also have in the past year engaged a third-party consultant to conduct a detailed risk assessment workshop utilizing the Center for Internet Security (CIS) framework v8. Additionally, our internal audit department performs periodic assessments of the design and operating effectiveness of our cybersecurity controls.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: Cybersecurity is an area of focus for our Board of Directors and our management. The Audit Committee of our Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats and is informed about cybersecurity risks through presentations from our CIO and our Chief Technology Officer ("CTO"), and other members of our management responsible for day-to-day management and mitigation of cybersecurity risks, as well as through its direct participation in our ERM process, which holistically addresses risks faced by us, including cybersecurity risk.

companyName: Open Lending Corp

ticker: LPRO


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in our information security team and through the use of technological tools and software and results from third party audits. Our CISO and CDO have extensive experience assessing and managing cybersecurity programs and risks. Our CISO has served in that position since 2019 and, before eHealth, was the Chief Information Security Officer and Vice President IT at Castlight Health where he led the company's overall security program. Before that, our CISO was the Chief Information Security Officer and Director Global Infrastructure Operations at Ooyala with similar responsibilities during rapid growth. His security experience also includes a 21-year career in the U.S. Navy where he served as a Cryptologic Officer. Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company's product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr. Director and Head of Product, D3 Incubation Unit at Capital One. Our CISO reports directly to the Audit Committee of the Board of Directors on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate issues at least once annually or more frequently as determined to be necessary or advisable. In addition, we have an escalation process in place to inform senior management and the Board of Directors when it is appropriate under the circumstances.

companyName: eHealth, Inc.

ticker: EHTH


text: In addition, our recently enhanced information security process includes cybersecurity and prevention training for all employees and key consultants, including timely and relevant topics covering social engineering, phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately.

companyName: ACTUATE THERAPEUTICS, INC.

ticker: ACTU


text: Material effects of cybersecurity threats Although cybersecurity risks have the potential to affect the business, financial condition, and results of operations, we do not believe that risks from attacks, including results from any previous cybersecurity incidents or threats, have materially affected or likely to materially affect our strategy, operations or financial condition. However, no matter how well controls or designed or how well cybersecurity risk management procedures are implemented, there can be no full assurance given that risk remains of an incident that could cause material harm to the business. See " Our business relies heavily on owned and third-party technology and computer systems, which subjects us to various uncertainties " in the section entitled " Risk Factors ".

companyName: Aeries Technology, Inc.

ticker: AERT


text: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Deutsche Bank Group in managing these risks, see "Part 1. Item 1A. Risk Factors – General Risk Factors – Cybersecurity risks and data protection could result in the loss of data, interruptions in our business, damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations" in this Annual Report on Form 10-K.

companyName: RREEF Property Trust, Inc.


text: Moreover, our GRC Committee meets bimonthly to evaluate, among other things, cybersecurity incident response readiness and results of our quarterly cybersecurity tests and annual risk assessment. The GRC Committee also reviews corporate progress regarding artificial intelligence governance, audits, and various other security and privacy exercises and addresses any identified gaps in Zuora policies to prevent, detect, mitigate, and/or remediate any potential cybersecurity incidents.

companyName: ZUORA INC


text: Cyber Governance Board Oversight of Cybersecurity Risks. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management. Our Board, Audit Committee, and Compliance and Quality Committee provide oversight of risks from cybersecurity threats through the following activities: • Cybersecurity risk governance including high-level guidance and oversight for us gleaned from each Director's extensive senior level operational management experience; and assessment of whether risks are being appropriately considered, evaluated and managed by management. • Oversight of cybersecurity risk ownership through assessment of our requirements and resources; and identification and evaluation of cybersecurity risks impacting our business. • Oversight of our cybersecurity risk mitigation operations through deployment of information technology, assessment of our cybersecurity risk management framework and review of our programs to meet business requirements. • Our Board, Audit Committee, and Compliance and Quality Committee receive regular presentations and reports on cybersecurity risks from management that address a wide range of topics, including: • recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technical trends and information security considerations arising with respect to our peers and third parties; • integrating cybersecurity oversight into the work of the Board, Audit Committee and Compliance and Quality Committee, allocating oversight responsibilities and leveraging Director skill sets; and • the role of the Board, Audit Committee, and Compliance and Quality Committee in potential incident response and recovery. • Oversight of the management of vendor and third-party service provider cybersecurity risks. • Oversight of data governance, automated intelligence and machine learning as applied to the Company's operations. • The Board, Audit Committee, and Compliance and Quality Committee, also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: agilon health, inc.

ticker: AGL


text: We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and to the Information Technology Steering Committee. The Incident Response Plan is coordinated through the Information Security Officer. Key members of management are embedded into the Plan by its design. The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: Our Senior Director of Information Technology and Cyber Security, who reports to our Chief Financial Officer, leads the operational oversight of company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Specific cybersecurity related responsibilities of the Senior Director of Information Technology and Cyber Security include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents. Our Senior Director of Information Technology and Cyber Security has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.

companyName: Cue Biopharma, Inc.

ticker: CUE


text: As of September 30, 2025, we have not identified any indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements. For further discussion of cybersecurity risks, please refer to Item 1A. Risk Factors.

companyName: CEMTREX INC

ticker: CETX


text: Our Director of Information Technology, our Controller, and members of our cybersecurity committee provide quarterly briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Arcellx, Inc.

ticker: ACLX


text: Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats as a part of its overall risk oversight responsibilities. Such responsibility includes compliance with disclosure requirements, cooperation with law enforcement, and analyzing the related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board for consideration. The Audit Committee receives annual reports on our cybersecurity risks from management. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: DNA X, Inc.

ticker: SONM


text: No Previous Material Cybersecurity Threats We are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. Despite the security and risk management measures that we have implemented and any additional measures we may implement or adopt in the future, our facilities and systems, and those of our third-party service providers, have been and are vulnerable to security breaches, computer viruses, lost or misplaced data, programming errors, scams, burglary, human errors, acts of vandalism, misdirected wire transfers, or other malicious or criminal activities. A successful attack on our information or operational technology systems could have material consequences to the Company. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.

companyName: VISTA GOLD CORP

ticker: VGZ


text: Further, the Chief Technology Officer is a member of the Compliance Committee chaired by the Chief Compliance Officer, which consists of members of senior and executive management, as is it charged with maintaining Bank-wide compliance with relevant statutes, regulations, and interpretations as well as consumer protection.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: Our IT department performs annual risk assessments to evaluate the effectiveness of the controls to support the requirements under Gramm-Leach Bliley Act ("GLBA"), and Federal Institutions Examination Council ("FFIEC") Guidance on Securing Customer Information. The focus areas include: • technology systems used for information that is collected, processed, and stored; • assessing internal and external cybersecurity threats and vulnerabilities; • performing regular penetration and controls testing; • evaluation and assessment of impact should the information or systems become compromised; • evaluation for the effectiveness of the governance structure for Information security risk management.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 16 years of work experience at the Company and elsewhere, heads the cross-functional team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the business and reports directly to the CIO, who reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security team members, each of whom is responsible for various parts of the business on an ongoing basis and, in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO collaborates closely with the legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Data Encryption and Access Controls Robust encryption protocols safeguard sensitive data, both in transit and at rest. Multi-factor authentication and role-based access controls further restrict unauthorized access, ensuring that only authorized personnel can access critical systems and information.

companyName: Astrana Health, Inc.

ticker: ASTH


text: In addition, we maintain third-party vendor management standards that are used to evaluate cybersecurity risks associated with our third-party service providers, and we assess information technology and software vendors to determine their security posture and maturity. All vendors that process our data or access our systems go through a security and privacy review before they are engaged that is targeted to the services to be provided and the systems and data involved. Based on the information provided by the vendor and depending on the nature of the services provided, our vendor management process may involve security questionnaires and contractual obligations such as audit rights and breach reporting.

companyName: Datadog, Inc.

ticker: DDOG


text: Board of Director Oversight Our Audit Committee is responsible for oversight of our programs and procedures related to cybersecurity risk. Management provides periodic reports to the Audit Committee on cybersecurity risk. The Audit Committee reports significant findings from these reports to the full Board of Directors.

companyName: Cactus, Inc.

ticker: WHD


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability ("CIA") of Company and customer information, identifying, preventing, and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain cybersecurity incident controls and procedures that are designed to ensure prompt escalation of incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.

companyName: PGT Innovations, Inc.


text: Role of management Our Chief Information Officer, together with our Vice President, Infrastructure, is responsible for the day-to-day management of our cybersecurity risks.

companyName: Summit Materials, LLC


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including through the use of third-party providers for regular mandatory trainings; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Intapp, Inc.

ticker: INTA


text: Our Corporate Compliance Officer is Karis McLarty. Ms. McLarty is an international privacy, economic crime and corporate human rights lawyer. Ms. McLarty has 20 years of experience specializing in U.S. and cross-border protection of large companies. Her areas of responsibility cover privacy, cyber risk and data protection; COSO, COBIT and ISO governance; forensic investigations, including regarding privacy and cyber issues; and regulator reporting, economic crime, antitrust and sustainability. Ms. McLarty holds the CIPP/E certification in European Data Protection and two Master's degrees in Jurisprudence and Forensic Psychology (MA Oxon, MSc).

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Overall Risk Management We maintain a cybersecurity program that is reasonably designed to protect our information, and that of our customers, against cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: The company's cybersecurity program is led and overseen by our Chief Information and Technology Officer (the "CITO") and our CISO. The CITO joined CarMax in 2012, reports to our Chief Executive Officer and has served in various technology leadership roles in startup organizations and Fortune 500 companies across the retail, travel, hospitality, finance, and technology industries for over 20 years. The company's CISO reports to the CITO, joined CarMax in 2015 and has served in various roles in information technology and cybersecurity for over 30 years, including prior service as the vice president of information security, risk and compliance for a Fortune 500 company. Our CISO has various industry certifications, including the Certified in Risk and Information Systems Control (CRISC), the Certified in the Governance of Enterprise IT (CGEIT) and the Certified Information Systems Auditor (CISA) certifications.

companyName: CARMAX INC

ticker: KMX


text: The Board of Directors and Audit Committee have oversight responsibility for the Company's cybersecurity risks. While the Company's employees play a key role in cybersecurity, the Company's Chief Information Officer, General Counsel and other members of management have shared responsibility for assessing and managing the Company's cybersecurity risks. The Company's management has sufficient knowledge, experience and expertise for assessing and managing the Company's cybersecurity risks. The Board of Directors and Audit Committee receive updates from management regarding cybersecurity risks, cybersecurity threats that could impact the Company and cybersecurity initiatives to enhance the Company's cybersecurity practices. The Audit Committee also receives updates on the results of assessments and audits of the Company's information technology systems and controls.

companyName: PUBLIX SUPER MARKETS INC


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing Clients with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures. We seek to detect and investigate unauthorized attempts and attacks against our network, products and services, and to prevent their occurrence and recurrence where practicable through changes or updates to our internal processes and tools and changes or updates to our products and services; however, we remain potentially vulnerable to known or unknown threats. In some instances, we, our trading partners, our Clients, and our service providers and contractors can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. Refer to Item 1A. Risk Factors of this Annual Report on Form 10-K for more information on our cybersecurity risks.

companyName: Baldwin Insurance Group, Inc.

ticker: BWIN


text: The Cybersecurity Working Group maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.

companyName: WELLTOWER INC.

ticker: WELL


text: We have integrated cybersecurity risk management into our overall risk management framework by (i) maintaining disaster recovery, business continuity and security incident recovery plans, (ii) conducting annual enterprise and IT risk assessments, (iii) implementing periodic key risk indicator tracking, and (iv) holding regular cross-departmental meetings to address cybersecurity risks.

companyName: Texas Pacific Land Corp

ticker: TPL


text: The strategy followed by our Security Incident Response Team ("SIRT") for managing material risks from cybersecurity threats is aligned to the National Institute of Standards and Technology's ("NIST") Cyber Security Framework 1.1 and its associated references in NIST SP 800-53r5.1.1 and NIST 800-61r2 Guides. The strategy was updated in the fourth quarter of 2023 to support our compliance with the SEC's Rules on Cybersecurity Disclosure for Public Companies and then it was reviewed in the fourth quarter of 2024 as part of our yearly review cycle and is included in our overall enterprise risk management program.

companyName: Satellogic Inc.

ticker: SATL


text: for further actions, including regarding the appropriate disclosure in accordance with SEC regulations, mitigation, and other response or actions that the Board deems appropriate to take.

companyName: Transportation & Logistics Systems, Inc.

ticker: TLSS


text: Managing Material Cybersecurity Risks Seaboard maintains a risk-based approach to information security that is based on the CIS-18 controls framework to identify key areas of cybersecurity risk. Seaboard's information security program maintains a team responsible for managing the cybersecurity risk assessment process across all segments (the "Information Security Team"). The Information Security Team routinely performs assessments and generates reports throughout the year to determine risks, threats and compliance with information security policies, standards and the framework of controls. This Information Security Team partners with each of the segments to identify key areas of cybersecurity risk based on the framework and develop action plans tailored to address those risks. These action plans are included on a multi-year roadmap that addresses priority, funding and implementation. These risks are evaluated on a quarterly basis according to Seaboard's cybersecurity reporting process.

companyName: SEABOARD CORP /DE/

ticker: SEB


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company. For more information about the cybersecurity risks we face, see the risk factor entitled "Our business and operations would suffer in the event of a significant computer system failure, cyber-attack or deficiency in our cyber-security" in Item 1A- Risk Factors.

companyName: SIGA TECHNOLOGIES INC

ticker: SIGA


text: In addition, we maintain policies over areas such as protecting and handling confidential information, processing of personal data, access on/off boarding, user management, acceptable use, and IT change control management to help govern the processes put in place by management designed to protect our IT assets, data and services from threats and vulnerabilities. We employ additional key practices within the cyber risk management program including, but not limited to maintenance of an IT assets inventory, periodic network scans, identity access management controls including restricted access to privileged accounts, and physical security measures at our facilities. We also utilize information protection/detection systems, or IPS/IDS, including maintenance of firewalls and anti-malware tools, network and data traffic monitoring with automated alerting, ongoing cybersecurity user awareness training, industry-standard encryption protocols, formalized change management processes and critical data backups to reduce cybersecurity risk.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: The Gramm-Leach-Bliley Act (GLBA) regarding protection of nonpublic personal information, The Federal Financial Institutions Examination Council's "Interagency Guidelines Establishing Information Security Standards," Supplemental federal and state banking regulations and guidelines regarding protection of nonpublic customer information, as applicable to this program.

companyName: UNITED SECURITY BANCSHARES

ticker: UBFO


text: Our information security function, led by our Chief Information Officer ("CIO"), implements and maintains the processes and controls to help identify, assess, and manage material risks from cybersecurity threats. These controls include, but are not limited to, the following Center for Internet Security ("CIS") controls: • Account Management; • Access Control Management; • Continuous Vulnerability Management; • Network Infrastructure Management; • Incident Response Management; • Security Awareness and Skills Training; and • Data Protection - Encrypt Data on End-User Devices. Supporting these controls are specific security measures that include threat intelligence monitoring, vulnerability scanning, and policy enforcement.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: We continuously monitor our computer systems, devices and networks, and work to improve our safeguards against regular and continually evolving cyber and other security threats. To date, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. However, notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident in the future that could have a material adverse effect on us. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. For further information about the cybersecurity risks we face, see "Item 1A. Risk Factors – System disruptions or failures, cybersecurity risks, and compromises of data, or the failure to comply with related laws and regulations, could harm our business."

companyName: NATURAL HEALTH TRENDS CORP

ticker: NHTC


text: We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Risk Management and Strategy one of the elements of our overall risk management program, we focus on the following key areas: Technical Safeguards: We have commenced to implement technical safeguards, including by not limited to firewalls, anti-malware functionality and access controls.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: Our CISO has over 20 years of information technology experience with specialization in information security and technology risk management. Our CISO is a Certified Information Systems Auditor and Certified Data Privacy Security Engineer. He serves as a Board member at the National Cybersecurity Alliance and is a member of Finance Services Information Sharing and Analysis Center (FS-ISAC) along with multiple other customer advisory boards. He was formerly a director at a large financial services organization and been in various information security roles at a Big 4 consulting firm prior to joining Discover.

companyName: Discover Financial Services


text: On a periodic basis, our management team and the Board of Directors conduct tabletop exercises and simulations in cybersecurity matters with assistance from internal and outside experts. These exercises are intended to strengthen resilience and readiness with scenarios, including cybersecurity matters.

companyName: NASDAQ, INC.

ticker: NDAQ


text: By engaging in these rigorous and diverse testing and assessment activities, we verify the current effectiveness of our cybersecurity measures and identify areas for continual improvement, ensuring our defenses evolve in line with the dynamic nature of cyber threats.

companyName: WIDEPOINT CORP

ticker: WYY


text: Our cybersecurity risk management processes are devised, implemented and assessed quarterly by our Cybersecurity lead, Enterprise Risk Management lead and Head of IT Strategy and Solutions. Our leads have extensive experience in cybersecurity and information technology, and based on their careers, have a deep understanding of our information technology and business needs. Our leads report to the cybersecurity committee monthly regarding emerging risks and the overall cybersecurity environment and immediately when a cybersecurity incident occurs. Our IT heads and Cybersecurity lead closely monitor cybersecurity risks, including our practices and procedures against the cybersecurity environment, including the operation of our incident response plan. Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We strongly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving quarterly exercises, cyber-event simulations, training programs and incorporating our Technology Acceptable Use Policy into onboarding and training materials.

companyName: Aeries Technology, Inc.

ticker: AERT


text: While we have experienced cybersecurity incidents that have disrupted our operations in the past, to date, no cybersecurity incidents have had or are materially likely to have, a material impact on RPM.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: 1. Risk Assessment: Regular assessments of cybersecurity risks are conducted annually to identify potential threats, vulnerabilities, and their potential impact on the Bank's operations. These assessments encompass both internal and external factors affecting PyraMax's IT infrastructure and systems.

companyName: 1895 Bancorp of Wisconsin, Inc. /MD/

ticker: BCOW


text: Committee receives periodic updates from management on potential risks, threats, and controls to mitigate identified risks. The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: MAYS J W INC

ticker: MAYS


text: Our information security program includes, among other things, cybersecurity incident response, vulnerability management, antivirus and malware protection, technology compliance and risk management, encryption, identity and access management, application security, and security monitoring. The program also has an information security awareness program, which includes annual training regarding our acceptable use and information classification and handling policies, regular phishing campaigns complemented by additional employee training as appropriate, and communications and companion trainings to keep our users informed on current events.

companyName: ALIGN TECHNOLOGY INC

ticker: ALGN


text: The Company's Chief Information Security Officer (CISO) leverages a model of continuous vulnerability detection to identify new cybersecurity risk as soon as practicable. The information security program is subject to a bi-annual assessment using the ISO 27001 standard for managing cybersecurity. Annually, external security firms conduct penetration tests of the Company's technology surface area internally and externally. The Company's information security program is subject to internal and independent external audits.

companyName: Employers Holdings, Inc.

ticker: EIG


text: aRegularly updating and improving our cybersecurity practices and policies based on changing business practices, emerging threats, new technologies, and evolving industry standards. bConducting ongoing penetration testing and benchmarking against industry practices to enhance our security posture.

companyName: IREN Ltd

ticker: IREN


text: The Incident Response Team and the non-management employees who support the Incident Response Team are best positioned to identify, assess, respond to and galvanize both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team will notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation. A strong working relationship exists between the legal, accounting/finance, IT and business departments so that identified issues are addressed in a timely manner and incidents are reported to the appropriate regulatory bodies as required.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: We rely on third parties, including cloud vendors and consultants, for various business functions. Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. Governance.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: All cybersecurity events are communicated to the Corporate Controller and Internal Audit Vice President for disclosure considerations. Material and severe occurrences are escalated to the Chief Executive Officer and Chief Financial Officer for further review, discussion and remediation.

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: The Board oversees management's execution and performance of its risk management responsibilities, which includes cybersecurity threats. The Board receives at least one cybersecurity report every quarter from our Chief Information Officer, our Chief Information Security Officer, our Chief Risk Officer or other professionals. The Board also reviews and approves the business resiliency and information security programs intended to guard against cybersecurity and related risks. Lastly, the Board receives input on cybersecurity issues from external entities such as our independent auditor, regulators and consultants. Each of these steps further the Board's efforts to ensure we have established and are proactively maintaining an enterprise-wide cybersecurity risk program with appropriate policies, practices and controls designed to ensure resiliency in the face of emerging threats.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. Refer to the risk factor captioned "Our business is subject to various cybersecurity and other operational risks" in Part I, Item 1A. "Risk Factors" for an additional description of cybersecurity risks and potential related impacts on the Company.

companyName: Perella Weinberg Partners

ticker: PWP


text: In addition, external partners and products are submitted through a security risk assessment process facilitated through our security scorecard tool for data security risk and vulnerability maturity rating, and our teammates undertake a yearly security and compliance online training with test certification. Our teammates are also subject to security awareness communications and random simulated phishing campaigns. Teammates are also required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on location. In 2023, substantially all Brown & Brown teammates completed ethical conduct training; cybersecurity awareness training; the California Consumer Privacy Act (CCPA) Survey; and the Annual Certification for Insurance Licensees training as a reminder of the regulatory obligation to report certain changes to the jurisdictions in which they are licensed.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: To date, we have not experienced a cybersecurity threat or incident that has had a material adverse affect on our business, results of operations and financial condition. We, and third parties we do business with, have experienced cybersecurity attacks and incidents in the past, some of which have resulted in unauthorized access to our information and systems and other disruptions to our business operations, and we could in the future experience similar incidents. See Risk Factors in Item 1A for additional information on cybersecurity risks.

companyName: SHERWIN WILLIAMS CO

ticker: SHW


text: At the management level, primary responsibility for assessing and managing material risks from cybersecurity threats rests with our Vice President, Corporate Information Security, Risk & Compliance ("VP, CIS"). Our VP, CIS has over two decades of experience in information technology and cybersecurity. The VP, CIS reports to our Chief Information Officer ("CIO") who has significant experience leading technology teams at large public companies and our CIO reports to our Chief Technology Officer.

companyName: NIKE, Inc.

ticker: NKE


text: Under our framework, cybersecurity issues are analyzed by subject matter experts for potential financial, operational, and reputational risks, based on, among other factors, the nature of the matter and breadth of impact. Matters determined to present potential material impacts to the Company's financial results, operations, and/or reputation are immediately reported by management to our Board of Directors or the Audit Committee, as appropriate, in accordance with our escalation framework. In addition, we have established procedures to ensure that management responsible for overseeing the effectiveness of disclosure controls is informed in a timely manner of known cybersecurity risks and incidents that may materially impact our operations and that timely public disclosure is made as appropriate.

companyName: MERIT MEDICAL SYSTEMS INC

ticker: MMSI


text: Role of the Board of Directors In December 2023, the Board delegated responsibility for overseeing our cybersecurity risk management to the Audit Committee. In accordance with the Audit Committee's charter, the Audit Committee will at least annually review and discuss with management, including the CIO and CISO, our processes, policies, procedures, and protocols related to cybersecurity and information security, and it is anticipated that the full Board will participate in this annual review. In addition, in accordance with the Audit Committee's charter, the Audit Committee will throughout the year regularly review and discuss with management, including the CIO and CISO, cybersecurity program assessments and audits, planned improvements and the status of any information security initiatives, as well as risks from cybersecurity threats pertinent to us and any previous cybersecurity incidents experienced by us, including any material impact or reasonably likely material impact on the Company, our business strategy, results of operations, or financial condition. The Audit Committee will provide reports to the Board at each regularly scheduled Board meeting of the matters it has recently addressed, including relating to the oversight of our cybersecurity risk management, and the full Board may participate from time to time, as warranted, in the Audit Committee's sessions on cybersecurity risk management. Outside advisors also may meet from time to time with the Audit Committee or Board, as warranted, to review and discuss cybersecurity matters.

companyName: IDEXX LABORATORIES INC /DE

ticker: IDXX


text: The practice of our CISO and CIO is to communicate significant cybersecurity matters directly to senior management, including our Chief Executive Officer, Chief Financial Officer and General Counsel, which ensures that our executive management team remains continually informed of critical events impacting our business.

companyName: Enpro Inc.

ticker: NPO


text: Tilray recognizes that cybersecurity is critical to protecting our systems, data, and operations. We are committed to addressing the significant risks posed by cyber threats by proactively managing the evolving landscape through a comprehensive, enterprise wide approach. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management framework to other legal, compliance, operational, and financial risk areas. The Company is committed to maintaining robust processes to assess, identify and mitigate material risks from cybersecurity threats and to protect against, detect and respond to cybersecurity incidents.

companyName: Tilray Brands, Inc.

ticker: TLRY


text: During the year ended March 31, 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Fatpipe Inc/UT

ticker: FATN


text: We have implemented Cyber Incident Response Programs, which are within the scope of our ISO 27001 certifications. We have also implemented Business Continuity Programs, which are within the scope of our ISO 22301 certification. We have established comprehensive incident response and recovery plans and test and evaluate the effectiveness of those plans regularly.

companyName: PEGASYSTEMS INC

ticker: PEGA


text: The ISO provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the board of directors.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives. The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board's legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022, 2023 and 2024 in overseeing the development of the Company's Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.

companyName: Vericel Corp

ticker: VCEL


text: The Cybersecurity Incident Response Team, which includes representatives from our information security and technical services departments, in addition to company management and executives across the Company, is activated when a suspected incident is reported or discovered and is responsible for dissemination of information and coordination of personnel efforts required to successfully respond to an incident.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Management and Assessment of Risk The Enterprise Risk Sub-Committee (ERC) (a management committee) assists executive management and the Board of Directors with providing oversight of the Bank's enterprise risk management program.

companyName: Independent Bank Group, Inc.


text: The Company's Audit Committee of our Board of Directors is charged with specific responsibility for overseeing risks from cybersecurity threats. Our Data Protection Officer provides the Audit Committee with semi-annual reports on cybersecurity risks and any material cybersecurity incidents. In addition, our Data Protection Officer provides semi-annual reports directly to our Board of Directors. These regular updates include topics related to cybersecurity practices, cyber risks and risk management processes, such as updates to our cybersecurity programs and mitigation strategies, and other cybersecurity developments.

companyName: THOR INDUSTRIES INC

ticker: THO


text: To date, the Utilities are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Utilities, including their business strategy, results of operations or financial condition. For further information, see "The Company is subject to information technology and operational system failures, network disruptions, cyber attacks and breaches in data security that could materially and adversely affect its businesses and reputation" in Item 1A. Risk Factors.

companyName: HAWAIIAN ELECTRIC INDUSTRIES INC

ticker: HE


text: Our global information technology organization, led by our CDO, is responsible for our overall information security strategy, policies, operations and threat detection and response. Our current CDO has more than two decades of experience in the automotive industry. The global information technology organization manages and maintains the cybersecurity program with the goal of preventing, detecting and remediating incidents, and works to increase our system resilience to minimize the business impact should an incident occur. Our cybersecurity program is informed by multiple, overlapping cybersecurity frameworks. These include the National Institute of Standards and Technology Cyber Security Framework (NIST-CSF); Cybersecurity Maturity Model Certification (CMMC); Control Objectives for Information and Related Technology (COBIT); International Organization for Standardization (ISO, specifically 27001); and Trusted Information Security Assessment Exchange (TISAX). Our cybersecurity program has achieved TISAX certification, or "labeling" for its demonstrated ability to identify, protect, detect, respond and recover from cyber risks. The "labeling" process requires independent, third-party auditors to test and confirm the controls we have implemented.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: Our Board is ultimately responsible for the risk oversight of the Company, including cybersecurity and privacy risks. Our Board has delegated day-to-day responsibility for oversight of cybersecurity risks to the Cyber Committee. The Cyber Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. Pursuant to its charter, our Cyber Committee: • assists our Board in fulfilling its risk oversight responsibilities with respect to the protection of the Company's assets, including confidential, proprietary and personal information, reputation and goodwill in all forms; • supervises and monitors the soundness of our cybersecurity and data protection strategies and practices; • oversees and monitors our material compliance with applicable information security, privacy and data protection laws, industry standards and contractual requirements; • promotes and furthers the integrity, adoption and coordination of our data security processes across the Company to help ensure that data and system security is a Company-wide business objective and priority; and • oversees our cybersecurity and data protection performance and the overall implementation of our cybersecurity and data protection strategy.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: Our key cybersecurity processes are organized into four primary categories: • Outage and access: these processes address system intrusion and credential and password threats and risks; • Payment and loyalty rewards: these processes protect the information of our customers; and • Personal data: these processes protect the payroll and healthcare data of our current and former employees and vendor information. • Vendor partner security: these processes review the infrastructure and security processes of vendor partners that process transactions, provide cloud-based solutions and provide the backbone for our data flow.

companyName: SHOE CARNIVAL INC

ticker: SCVL


text: Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."

companyName: Carlyle Group Inc.

ticker: CG


text: We recognize the importance of assessing, identifying and managing material risks associated with any "cybersecurity threat," as such term is defined in Item 106(a) of Regulation S-K. We assess cybersecurity risk on an annual basis and whenever management deems there to be a significant change to exposure or external threats. We also have several enterprise-wide and business unit-specific cybersecurity processes, technologies, and controls to aid in our efforts to identify, evaluate, and respond to such cybersecurity risk. As part of our cybersecurity risk management processes, we leverage our membership in the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) and utilize carefully vetted third-party information technology systems vendors to conduct regular network and endpoint monitoring, vulnerability assessments, and penetration testing. We consider cybersecurity risks associated with our use of third-party information technology vendors during the selection process and include ongoing monitoring as part of our cybersecurity processes. In the year ended December 31, 2023, we did not experience a material "cybersecurity incident," as such term is defined in Item 106(a) of Regulation S-K.

companyName: TELLURIAN INC. /DE/


text: Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any. Our management will promptly report to the board of directors on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks.

companyName: Chenghe Acquisition II Co.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President. Our executive team including our Chief Executive Officer, and Chief Financial Officer are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. This executive team is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: Assessing, identifying and managing cybersecurity-related risks are integrated into the Company's overall Enterprise Risk Management ("ERM") program. Cybersecurity-related risks fall within the scope of risks that the ERM program evaluates to assess top risks to the enterprise. Such risks are directly communicated to the Audit Committee on a bi-annual basis, or more frequently as needed. The Audit Committee reports the results of their bi-annual meetings to the Board of Directors at the succeeding Board meeting. To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. We have a formal process to annually assess the feasibility, validity and effectiveness of our incident response plans including information technology recovery and business continuity procedures.

companyName: REV Group, Inc.


text: Like other companies with a large technology footprint and high-profile client base, our Sponsor and Advisor are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations. In the future, it is possible such attacks could be successful and have a material impact on our operations. Our Sponsor's and Advisor's cybersecurity program strategy is to implement layered controls to reduce their and our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework.

companyName: JLL Income Property Trust, Inc.


text: As a company, we leverage the National Institute of Standards and Technology (NIST) Cybersecurity Framework to align with industry best practices and to develop policies and procedures, which include a Cybersecurity Response Plan focusing on detection, validation, mitigation, recovery, and refinement. In addition to the Cybersecurity Response Plan, we provide cybersecurity awareness training to our employees, including training on social engineering, phishing, password protection, confidential data protection, mobile security, and incident reporting, to help prevent and reduce the impact of potential cybersecurity events.

companyName: Sanara MedTech Inc.

ticker: SMTI


text: The SEC adopted a new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies in 2023, which applies to all public companies subject to the reporting requirements of the Securities Exchange Act of 1934 and requires disclosure of material cybersecurity incidents in Current Reports on Form 8-K and periodic disclosure of cybersecurity risk management, strategy, and governance in annual reports in Annual Reports on Form 10-K.

companyName: FARMERS NATIONAL BANC CORP /OH/

ticker: FMNB


text: Our cybersecurity strategy is built on a foundation of proactive risk management, continuous monitoring, and adherence to industry best practices. We employ a multi-layered approach which leverages cutting-edge technologies to defend against evolving cyber threats.

companyName: International Land Alliance Inc.

ticker: ILAL


text: Notwithstanding the focus and emphasis on cybersecurity, the Company has experienced and will continue to experience cybersecurity incidents. While prior incidents have not had a material effect on the Company's business, there can be no guarantee that the Company will not experience a future incident that does have a material effect on its business. See "Risk Factors - Risks Related to Information Technology - The Company's business and financial performance may be adversely affected by cybersecurity attacks, information systems interruptions, equipment failures, and technology integration" for more information on the Company's cybersecurity risks.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: Cybersecurity Risk Management and Strategy KKR's asset management business has a cybersecurity incident response plan as a key component of its cybersecurity program, which is generally incorporated as part of our enterprise risk management program. The KKR CISO and KKR's Chief Compliance Officer co-chair a cybersecurity incident response team ("KKR CIRT"), which aims to manage and mitigate the risk and impact of cybersecurity breach events at KKR's asset management business, including those arising from third-party service providers, including those providers that have access to KKR's customer and employee data. Cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities.

companyName: KKR & Co. Inc.

ticker: KKR


text: The Director of IT is responsible for implementing and maintaining the information security program. The Director of IT role is currently held by an individual who has over 20 years of experience in enterprise-level IT operations and management, cybersecurity operations and management and IT/Cyber architecture and strategy. The Director of IT reports to our VP of Finance, who together are responsible for coordinating information security risk assessments and overseeing periodic testing of our cybersecurity controls. Our VP of Finance meets with the Audit Committee of our board of directors periodically for the audit committee to provide guidance on the prioritization of the risk remediation and ongoing implementation of cybersecurity improvements across our organization.

companyName: KalVista Pharmaceuticals, Inc.

ticker: KALV


text: When we experience cybersecurity incidents, we promptly activate incident response protocols and commence investigation of the incident. We may notify law enforcement and engage third-party professionals, as appropriate, as part of our incident response and/or investigation. Based on our assessments, during the last fiscal year, we have not identified any cybersecurity threat that has had a material impact on, or that we expect will have a material impact on our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time. If realized, these risks are reasonably likely to materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."

companyName: Intapp, Inc.

ticker: INTA


text: Cybersecurity Risk Management and Strategy We, like other companies in our industry, face several cybersecurity risks in connection with our business. Our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats. During the reporting period, we have not experience any material cyber incidents, nor have we experienced a series of immaterial incidents, which would require disclosure.

companyName: NKGen Biotech, Inc.


text: Our cybersecurity processes include automated tools and technical safeguards managed and monitored by our cybersecurity team and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. For example, we regularly conduct penetration and vulnerability testing, security audits, and tabletop exercises. We conduct regular employee training on cybersecurity and provide management reports to monitor training effectiveness. We also employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer that otherwise implicates third-party technology and systems we use. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: Leslie's, Inc.

ticker: LESL


text: We have not experienced any material cybersecurity incidents to date. However, given the evolving nature of cybersecurity threats, we continue to invest in our cybersecurity capabilities and monitor the landscape to enhance our resilience against potential threats.

companyName: Frequency Holdings, Inc

ticker: FRQN


text: Our CISO implements a program and supporting processes to proactively assess systems for vulnerabilities, while taking a risk-based approach to prioritize remediation steps. Should a cybersecurity incident occur, the CISO would reference an incident response plan and supporting playbooks to support the incident response process. We regularly test our incident response process by leveraging a combination of internal resources and trusted third-party consultants to test our response readiness and the completeness of our incident response plan, including through the use of tabletop exercises.

companyName: Enpro Inc.

ticker: NPO


text: As a defense contractor developing advanced technologies, we face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly capable adversaries, including nation state actors that target the defense industrial base and other critical infrastructure sectors. Our customers, suppliers, subcontractors and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our Board and senior management oversee our processes for management of cybersecurity risks consistent with the foregoing standards. Such oversight includes regular reporting by management to the Board on the adequacy of such processes and potential material issues identified. Before escalation to the Board, issues are generally identified and assessed through our risk governance structure established under our Enterprise Risk Management Program. The risk governance structure includes three distinct components: management oversight, third-party professional assessment, and separate oversight and review by our Internal Audit Department. Management oversight is maintained through several committees that serve as forums for further assessment, remediation, and escalation. These management oversight committees include the Information Security Committee, co-chaired by the CISO and CRO, the Operational and Compliance Risk Committee, chaired by the CFO, vice chaired by the CISO and Chief Compliance Officer, the IT Steering Committee, chaired by the Chief Information Officer (CIO), the Enterprise Risk Management Committee, chaired by the CRO, the Data Governance Committee, chaired by the CIO, and the executive management committee known as the Strategic Deployment Committee, chaired by the CEO.

companyName: 1ST SOURCE CORP

ticker: SRCE


text: While we have experienced cybersecurity incidents in the past, to-date none have materially affected the Company or our financial position, results of operations and/or cash flows. We continue to invest in cybersecurity and the resiliency of our networks, including our controls and processes, all of which are designed in an effort to protect our IT systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Risk Factors – Business, Operational, and Strategic Risks."

companyName: SMITH A O CORP

ticker: AOS


text: Cybersecurity tools and services are configured to identify threats and risks that may be associated with the use of third-party applications or solutions. We prioritize our cybersecurity efforts relating to third parties based on the likelihood and potential impact of cybersecurity threats. These efforts may include reviewing security documentation or protocols of key vendors, service providers, and external users of our systems.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A. Risk Factors "Cyber-attacks targeting systems and infrastructure used by the gas and oil industry and related regulations may adversely impact our operations and, if we or our third-party providers are unable to obtain and maintain adequate protection for our key systems and data, our business may be harmed."

companyName: EXPAND ENERGY Corp

ticker: EXE


text: The Audit Committee and the full Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee performs an annual review of the Company's cybersecurity program, which includes discussion of management's actions to identify and detect threats, as well as planned actions in the event of a response or recovery situation. The Audit Committee's annual review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Board receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and recent threats and how the Company is managing those threats. Further, at least annually, the Board receives updates on the Company's Crisis Management Plan, which covers, among other things, potential cybersecurity incidents, data privacy and its compliance programs. To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics. For example, in 2022, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and speakers who discussed digital, technology and innovation trends across industries.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Management reports cybersecurity risks to the Enterprise Risk and Compliance Committee in accordance with the risk management program and to our Board's Audit Committee in an effort to keep members of the Audit Committee apprised of the rapidly evolving cyber threat landscape and to enable the assessment of the effectiveness of our overall cybersecurity and compliance programs.

companyName: Toast, Inc.

ticker: TOST


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our Board for certain cybersecurity incidents.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our Head of IT meets with our Chief Financial Officer periodically to discuss and review our cybersecurity risk management processes and to address matters related to potential cybersecurity and information technology risks, with input from our third-party technology providers, as appropriate. In addition, our Head of IT has regular meetings with our managed security service provider to inform our cyber risk management processes and reporting to management. Our Head of IT, working with our Chief Financial Officer, provides periodic reports on cybersecurity and information technology matters to our Audit Committee, which assists our board of directors in reviewing and overseeing our risk management process, including cybersecurity risks.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: The cybersecurity risk management program, processes and strategy described in this section are limited to the personal and business information belonging to or maintained by the Company (collectively, "Confidential Information"), our own third-party critical systems and services supporting or used by the Company (collectively, "Critical Systems"), and service providers.

companyName: HeartCore Enterprises, Inc.

ticker: HTCR


text: In the past two years and with the guidance of a qualified third-party, the Management Company has made improvements in the cybersecurity program across the Entity, and has developed processes for deterring, detecting, evaluating, and responding to potential cybersecurity incidents. In doing so, the Management Company focuses on its employees, networks, applications and data with a cybersecurity plan, informed by nationally recognized frameworks.

companyName: AEI INCOME & GROWTH FUND XXI LTD PARTNERSHIP

ticker: XXAAU


text: We conduct mandatory training for all employees to communicate our policies and procedures regarding cybersecurity and to assist employees in learning how to identify potential cybersecurity threats.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include threat briefings from internal personnel and external service providers, as well as alerts and reports produced by security tools deployed in the information technology environment.

companyName: STAAR SURGICAL CO

ticker: STAA


text: The Audit and Finance Committee, comprised solely of independent directors, oversees our enterprise risk management program and assists the Board of Directors in fulfilling its oversight responsibility with respect to our information security and technology risks (including cybersecurity), which are fully integrated into our enterprise risk management systems. The Audit and Finance Committee reviews and discusses our information security and technology risks (such as cybersecurity), including our information security and risk management programs.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: We promote a culture of cybersecurity compliance throughout our organization, including required monthly cybersecurity training for all employees with company accounts and annual training for service-related employees on cybersecurity related topics, including social engineering (e.g., phishing, vishing and smishing), ransomware, denial of service or information, and other security breach tactics. We conduct quarterly ERM discussions where top risk owners discuss how risks have changed and how such risks are being addressed with approaches designed to mitigate such risks. In addition to assessing our own cybersecurity preparedness and as part of our overall cybersecurity risk management framework, we also consider and evaluate cybersecurity risks associated with our use of third-party service providers. We perform a formal System and Organization Controls ("SOC") review process annually on our financially significant third-party service providers, which includes our internal assessment of complementary user entity controls. All other material third-party service providers undergo assessment as a contract is entered into or renewed to ensure cybersecurity alignment. Our internal audit group meets regularly with management team members of Marriott, our third-party hotel manager, to assess security applications compliance. We also regularly meet with management team members of Marriott to understand system upgrades, changes and associated risks with third-party managed applications. In addition, we generally require our third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: During the period covered by this report, the Company has not identified any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: With respect to incident response, we maintain a Global Information Security & Privacy Incident Response Plan ("IRP"), which applies globally to information security incidents involving properties owned, leased, or managed by Marriott, as well as our above-property business locations. Franchisees are responsible for information security at franchised properties and the systems and business processes related to information security that are under their direction and control. Franchisees are required to comply with brand standards relating to information security, which include an obligation to report information security incidents to us.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Currently, our Chief Operating Officer is expected to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. Our Chief Operating Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: The Chief Information Security Officer ("CISO") leads our information security organization responsible for overseeing our information security program. The CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").

companyName: DISH DBS CORP