text: Our CISO and Cybersecurity Manager implement processes around security monitoring and vulnerability testing. We also have in place an incident response plan, which incorporates four overarching and interconnected stages: (1) preparation for a cybersecurity incident, (2) detection and analysis of a security incident, (3) containment, eradication and recovery, and (4) post-incident analysis. The plan specifies that security events and data incidents should be evaluated, ranked by severity and prioritized for response and remediation. Our procedures include an evaluation of incidents to determine materiality as well as operational, business and privacy impact. Our team of cybersecurity and information security professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies. In addition to implementing technical security measures, we have maintained an ongoing cybersecurity awareness and training program.

companyName: iTeos Therapeutics, Inc.


text: Board of Directors and Audit Committee oversee the management of risks by our management. The Audit Committee is responsible for reviewing our cybersecurity program and risks, as identified by our management, and the steps our management has taken to protect against threats to our assets, including information systems and data security. The Audit Committee provides updates to the Board approximately annually.

companyName: ORAGENICS INC

ticker: OGEN

secItem: Item 1C


text: Training and Awareness We maintain a comprehensive information and cybersecurity awareness and training program for all employees and contracted resources. This includes a mandatory annual information security training, periodic simulations such as red teaming and tabletops, regular communications on relevant topics and policies related to data privacy, phishing, email security best practices, among others. We provide specialized security training for certain roles with access to sensitive data, including human resources or employees who regularly handle personal or sensitive information. Governance (Management Oversight and Engagement with the Board of Directors)

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: The FedEx Data and Technology Risk Council ("DTRC"), which is sponsored by the CISO, oversees the execution of FedEx's comprehensive IT risk management program. The DTRC, which receives quarterly reports on FedEx's IT risk management, is responsible for assessing the overall risk framework on an annual basis, setting acceptable risk tolerance levels, approving risk prioritization and associated risk mitigation activities, and monitoring the changing risk landscape and posture.

companyName: FEDEX CORP

ticker: FDX


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company's business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, see Part 1, Item 1A. Risk Factors entitled "Risks Related to Intellectual Property, Information Technology and Data Privacy" included elsewhere in this Annual Report on Form 10-K.

companyName: Certara, Inc.

ticker: CERT


text: Cleco maintains a formal cybersecurity training program for all employees that includes training on matters such as data protection, phishing, email security best practices, and broader cybersecurity themes such as insider threats, vishing, ransomware, and third-party risk. Cleco also provides specialized security training for certain other employee roles.

companyName: Cleco Corporate Holdings LLC


text: The Company's incident response team, comprised of representatives from the Company's information technology, information security, product security, engineering, communications, privacy and legal groups, is responsible for addressing actual and potential security threats and other security incidents and implementing the Company's incident response plan. The Company's incident response plan includes processes and procedures for assessing potential internal and external threats, escalation, activation and notification, crisis management, and post-incident recovery.

companyName: BLACKBERRY Ltd

ticker: BB


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.

companyName: Bannix Acquisition Corp.


text: Although we have experienced cybersecurity incidents, these incidents have not materially affected Roper, including its business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors, We rely on information and technology, including third-party cloud computing platforms and other third-party business partners, for many of our business operations which could fail and cause disruption to our business operations." above for more information. While we work to maintain our Cybersecurity Program, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all risks from cybersecurity threats or potential risks to such systems, networks, and data or those of our third-party providers.

companyName: ROPER TECHNOLOGIES INC

ticker: ROP


text: We take a holistic approach to identification, mitigation and management of cybersecurity and data risks through governance and compliance processes integrated across our Cyber program and our C&E program. These processes include integrated policies, risk assessments, impact assessments, third party reviews and monitoring, incident response, and external certification programs such as ISO 27001: Information Security Management Systems, ISO 27701: Privacy Information Management Systems, APEC Cross-Border Privacy Rules System and TRUSTe Responsible AI. We recognize that our first line of defense is our employees and we incorporate cybersecurity awareness education in our annual Code of Conduct and Ethics training program to ensure our employees understand their roles in safeguarding against potential cyber threats.

companyName: Dun & Bradstreet Holdings, Inc.


text: h. Governance: The Board's oversight over the effectiveness of the Company's cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's Vice President of Information Technology, Security and Business Intelligence and other members of the cyber team and management.

companyName: Axogen, Inc.

ticker: AXGN


text: State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and many states, have also recently implemented or modified their data breach notification, information security and data privacy requirements. We expect this trend of state-level activity in those areas to continue and are continually monitoring developments in the states in which our customers are located.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: Although the Company and Bank have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected their business strategy, results of operations or financial condition, there can be no guarantee that the Company or Bank will not experience such an incident in the future.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: As part of the cybersecurity program, the Company's cybersecurity environment is monitored by automated tools on an ongoing basis and an internal cybersecurity team that reviews threats, alerts, and incidents. The Company's Incident Response Plan provides governance and guidance in responding to information security incidents and is tested regularly for calibration against existing and emerging threats. The Incident Response Plan describes the process to be followed by the Cyber Committee in connection with the oversight of the cybersecurity environment and specific events that occur from time to time. The cybersecurity program undergoes periodic internal and external reviews. In addition, the Company's Internal Controls Department performs an independent assessment of the design and operating effectiveness of the Company's network of cybersecurity controls in accordance with the NIST Framework. The results of the assessment are periodically shared with the Cyber Committee and the Audit Committee.

companyName: MOODYS CORP /DE/

ticker: MCO


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.

companyName: Glimpse Group, Inc.

ticker: GGRP


text: Our Audit Committee is regularly involved in reviewing cybersecurity risk management. At least quarterly, the Vice President of Operations presents and reviews key security metrics with the Audit Committee including a review of cyber-security events, cybersecurity initiatives and new or developing cybersecurity risks relevant to the business. The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks. Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and data security processes and business policies impacting our overall cybersecurity risk.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: Our cybersecurity function, led by our head of IT and supported by third -party service providers, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: maintaining manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of our threat environment, evaluating our and our industry's cybersecurity risk profile, evaluating threats reported to us, completing internal and external cybersecurity audits, completing third-party cybersecurity threat assessments, conducting vulnerability assessments, leveraging external intelligence feeds, and tabletop incident response exercises.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our IT Steering Committee performs thorough due diligence and risk analyses on third party vendors, verifying that sufficient security testing is performed on all software before installation on Luxfer's network. The IT Steering Committee also monitors and reviews access and permissions to all software and programs regularly.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. Management is responsible for the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks.

companyName: SELLAS Life Sciences Group, Inc.

ticker: SLS


text: Board Roles and Responsibilities The Audit Committee of the Board of Directors oversees the Company's cyber risk management program. The Chief Information Officer (CIO) and the Vice President of Network Services present frequent updates to the Audit Committee and, as necessary, to the full Board of Directors. These regular reports include detailed updates on the Company's performance preparing for, preventing, detecting, responding to and recovering from cyber incidents. In addition, we have established processes to notify the Audit Committee of active incidents, as deemed necessary. The Company's program is periodically evaluated by third-party experts, and the results of those reviews are reported to the Board of Directors.

companyName: PACKAGING CORP OF AMERICA

ticker: PKG


text: We have a cybersecurity risk management program to identify, monitor, and mitigate cybersecurity risks. The program consists of formal roles and responsibilities for information security and incident response, and is overseen by our IT Steering Committee, which consists of key executives and employees with guidance from our third-party cybersecurity vendor. Our enterprise risk management program considers cybersecurity risks alongside other company risks, and we consult with our cybersecurity vendor to gather information necessary to identify cybersecurity risks, evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk. In addition to continuous cyber monitoring, the IT Steering Committee participates in quarterly cyber updates with our cybersecurity vendor, which includes identification of new cyber risks and threats, reported vulnerabilities, trend analysis on attack vectors, and monitoring of risk mitigation activities.

companyName: NORTHERN OIL & GAS, INC.

ticker: NOG


text: Key elements of our cybersecurity risk management program include but are not limited to, risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, services, and our broader enterprise IT environment;

companyName: SURGE COMPONENTS INC

ticker: SPRS


text: In order to identify material risks from cybersecurity threats associated with the use of third-party service providers, such as bank operations technology, payroll and benefits administrators, and professional service providers, the Company has established a dedicated department within its Enterprise Risk Management division. This department manages risks of third-parties and evaluates cybersecurity risks associated with the Company's third-party service providers with the Bank's Information Technology Department.

companyName: GLACIER BANCORP, INC.

ticker: GBCI


text: Cybersecurity risk management is a component of our overall risk management systems and processes and we recognize the importance of evaluating, detecting, and mitigating significant risks related to cybersecurity threats, including operational risks, theft of intellectual property, fraud, injury to employees or customers, and breach of applicable laws.

companyName: ARKO Corp.

ticker: ARKO


text: We have established a Security Governance Framework that defines roles and responsibilities, so that security is taken into account at all levels and in every department or function of the Company.

companyName: LOGITECH INTERNATIONAL S.A.

ticker: LOGI


text: To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior on systems used by our employees, alongside other technical safeguards including: Web Application Firewalls (WAF) Endpoint protection and response Security Event and Incident Management (SIEM) Identity and Access management (IAM)

companyName: TMC the metals Co Inc.

ticker: TMC


text: The full Board is responsible for oversight of cybersecurity risk and receives regular reports from the CTO or CEO. Our CTO also presents his assessment of material risks from cybersecurity threats to the Board at least annually. If a cyber incident is reported to the Board of Directors, our Incident Response Plan is triggered which involves a number of immediate actions be initiated. The impact, if any, of cyber incidents on internal control over financial reporting is discussed with the full Board.

companyName: ACCESS Newswire Inc.

ticker: ACCS


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts in evaluating and testing our risk management systems. The partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with the third-party includes threat assessments and consultation on security enhancements. All employees are required to complete cybersecurity training at least once a year and have access to more frequent cybersecurity training through online updates.

companyName: SOCKET MOBILE, INC.

ticker: SCKT


text: c) Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures. d) Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.

companyName: ECB Bancorp, Inc. /MD/

ticker: ECBK


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management program informed by and incorporating elements of recognized industry standards, such as the National Institute of Standards and Technology Cybersecurity Framework. This program, which is integrated into our overall enterprise risk management strategy, is designed to identify, assess, and mitigate critical risks from cybersecurity threats. Our cybersecurity risk management program is overseen by our Chief Technology Officer and is supported by a third-party information technology vendor who, as appropriate, helps to assess our cybersecurity program against industry standards. Our cybersecurity program includes safeguards such as firewalls, DDoS mitigation tools, data encryption technologies, and authentication controls such as multi-factor authentication. We monitor our cybersecurity posture through periodic risk assessments and external audits, which are reviewed primarily by our Chief Technology Officers and others as needed and incorporated into our overall enterprise cyber strategy and risk management program. Additionally, we have adopted an incident response plan which has been designed to identify and manage significant events that may impact our information technology infrastructure, including those arising from or related to cybersecurity threats.

companyName: Doximity, Inc.

ticker: DOCS


text: We operate in the biotechnology sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including intellectual property theft fraud extortion harm to employees violation of privacy laws and other litigation and legal risk and reputational risk. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence to the best of our ability. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans and penetration tests.

companyName: CAPRICOR THERAPEUTICS, INC.

ticker: CAPR


text: We have 22 employees and currently use third-party vendors and service providers for certain product development and regulatory approval activities.

companyName: Microbot Medical Inc.

ticker: MBOT


text: As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions. As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase. Failure to effectively anticipate, prevent, detect, and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition. To our knowledge, we have not experienced any material cybersecurity incidents of our technology systems.

companyName: MOSAIC CO

ticker: MOS


text: Risk Management & Strategy Wesbanco generally approaches cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to Wesbanco; (ii) maintaining the confidence of its customers and business partners; and (iii) preserving the confidentiality of its customers' and employees' information. Wesbanco's Information Security and Cybersecurity program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas. The bank also partners with trusted security vendors to enhance incident response capabilities, evaluate framework and compliance assessments, provide continuous monitoring, provide guidance on strategies, evaluate compliance with existing laws and regulations, design and implement cyber policies and procedures, and provide threat intelligence services.

companyName: WESBANCO INC

ticker: WSBC


text: As of December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For an examination of cybersecurity threats that could potentially have a material impact on us, please refer to Part I, Item 1A., "Risk Factors" –"Cybersecurity incidents or other damage to the information systems and technology of us or our tenants could harm our business" in this Annual Report."

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line's activities. The Committee as a whole, consists of information security professionals with varying degrees of education and experience as well as Information Technology professionals, and audit and fraud professionals. Individuals within the Committee are generally subject to professional education and certification requirements. In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by Apollo management, in consultation with our management and our Board as applicable, in a timely manner. Technical Safeguards.

companyName: Apollo Infrastructure Co LLC


text: We utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage outside partners to gain intelligence on threats. Highlighted risks are integrated into our Enterprise Risk Management process. We take input from industry activities, third party assessments and internal simulations and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections. If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and CAO. All Pacira employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use state-of-the-art technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology and the CAO.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The board's audit committee is responsible for the oversight of risks from cybersecurity threats and receives updates on a quarterly basis from management, including representatives from our IT, finance, and legal departments regarding matters of cybersecurity. These updates include existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our board members also engage in ad hoc conversations with management on cybersecurity-related news events and updates to our cybersecurity risk management and strategy programs.

companyName: Caribou Biosciences, Inc.

ticker: CRBU


text: For our non-finance service providers, we are currently implementing cybersecurity controls, including but not limited to requiring all critical vendors to notify us should the vendor fall victim to, and become aware of a material cybersecurity incident, and reviewing any available SOC2 or similar compliance reports should they be available. Our vendor selection and management processes include the assessment of vendors' cybersecurity controls.

companyName: Third Harmonic Bio, Inc.


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a combination of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber threat intelligence, insights and assessments of its cybersecurity risk posture and governance.

companyName: EDGEWELL PERSONAL CARE Co

ticker: EPC


text: We understand the potential risks associated with third-party service providers, and we are working on implementing stronger oversight processes. While we have initiated security assessments for our third-party providers, we are in the process of enhancing these efforts to include more frequent evaluations and ongoing monitoring. This will help mitigate the risk of security incidents originating from third parties.

companyName: reAlpha Tech Corp.

ticker: AIRE


text: The Advisor 's cybersecurity risk oversight includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, (iii) confirming the Advisor has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident, and (iv) mandatory cyber security trainings for all Advisor personnel.

companyName: Sterling Real Estate Trust


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that we will not be materially affected in the future by cybersecurity risks, threats or incidents. The potential consequences of a future material cybersecurity incident may include reputational damage, litigation with third parties, government enforcement actions, penalties, disruption to our systems or operations of our facilities, unauthorized release of confidential or otherwise protected information, corruption of data, diminution in the value of our investment in research, development and engineering, increased cybersecurity protection costs and unplanned remediation costs, which in turn could adversely affect our business strategy, results of operations and financial condition. See Item 1A under the caption "A breach of our security systems or a cyberattack that disrupts our operations or results in the breach of confidential information about us, our technology, or our customers could harm our business and reputation, and could expose us to costly regulatory enforcement and other liability." for additional information on cybersecurity risks applicable to the Company.

companyName: SkyWater Technology, Inc

ticker: SKYT


text: Our cybersecurity team is led by our Director of IT Infrastructure, who has over 20 years of experience and obtained various professional security certifications and advanced training in the field of cybersecurity and technology and reports to our CIO. Our CISO is responsible for managing and supervising our cyber risk management program and informing the CIO and senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: TIDEWATER INC

ticker: TDW


text: Our audit committee receives periodic reports from our IT Lead concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: We also have processes in place to stay informed of and monitor prevention, detection, mitigation, and remediation of cybersecurity risks, including but not limited to: employing appropriate incident prevention and detection software where appropriate; employing industry-standard encryption protocols where appropriate; conducting regular vulnerability scans; applying patches in a timely manner; conducting penetration tests and implementing recommended corrective actions in a timely manner; maintaining a well-defined incident response plan and supporting procedures; conducting regular phishing simulations and tabletop exercises; and requiring employees to complete cybersecurity training.

companyName: ACACIA RESEARCH CORP

ticker: ACTG


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Sunstone Hotel Investors, Inc.

ticker: SHO


text: Our Cybersecurity Director leads our internal Cybersecurity Council, which meets monthly to help implement management's cybersecurity strategy and to monitor and manage our cybersecurity threats and risks. Our Cybersecurity Council consists of the Cybersecurity Director, CISO, Chief Financial Officer, General Counsel and Chief Compliance Officer, Chief Technology Officer, Vice President of Internal Audit, Vice President of Global Supply Chain, Director of Security, and Sr. Manager of Contracts Operations and Compliance. The CISO and/or Cybersecurity Director report cybersecurity incidents to members of the company's senior management, including the Cybersecurity Council, and/or the Board of Directors based on the severity and type of the incident to ensure that proper external reporting is completed thoroughly and timely. Pursuant to its charter, the Cybersecurity Committee of our board of directors is responsible for reviewing, discussing, and making recommendations to the full board of directors regarding cybersecurity matters. Our CISO and Cybersecurity Director provide presentations to the Cybersecurity Committee on our cybersecurity program at each of the committee's regularly scheduled quarterly meetings. These briefings include assessments of the cyber risk and threats landscape, updates on incidents, policies and procedures, and our investments and plans in cybersecurity risk mitigation and governance. The Cybersecurity Committee also meets with members of the Cybersecurity Council to discuss various aspects of our cybersecurity program in between regular meetings. All members of the board of directors are invited to attend all meetings of the Cybersecurity Committee and the committee regularly briefs the entire board of directors regarding their oversight of our cybersecurity program.

companyName: AeroVironment Inc

ticker: AVAV


text: Related to Cybersecurity Risks Our Chief Technology Officer is responsible for the establishment and maintenance of our cybersecurity risk management processes, including the day-to-day oversight of the assessment and management of cybersecurity risks. Our Chief Technology Officer has over 15 years of experience in software development and security architecture. Our Chief Technology Officer provides reports to and meets periodically with our General Counsel to discuss and review our information security and cybersecurity risk management processes.

companyName: Doximity, Inc.

ticker: DOCS


text: Ginkgo also has a Disclosure Committee, which is composed of representatives from executive leadership from various departments across Ginkgo (e.g., legal, finance, accounting). Their role is to determine materiality of a cyber incident and provide guidance with respect to any disclosure obligations resulting from a cyber incident.

companyName: Ginkgo Bioworks Holdings, Inc.

ticker: DNA


text: Our cybersecurity risk management is based on recognized industry governance frameworks, including the International Organization for Standardization (ISO), the National Institute of Standards and Technology (NIST), the Center for Internet Security Controls (CIS), and the Cloud Security Alliance (CSA). We use these frameworks together with information collected from internal and 3rd party assessments to develop policies such as our technology acceptable use policy for information assets, our access requirements for data, systems, or technologies, and policies for the protection and use of personal information of our employees and customers. We protect our IT assets through industry-standard techniques such as multifactor authentication, malware defenses, network and endpoint monitoring, and access review processes. We also work with our business units to leverage and implement foundational cybersecurity principles, such as security by design, defense-in-depth, least privilege, and resilience-focused backups, throughout our organization. We deliver cybersecurity awareness and confidential information protection training to our employees, and we send our employees ethical simulated phishing and spear-phishing emails to test their compliance with our policies.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives quarterly reports from our Vice President and Chief Information Security Officer (CISO), in conjunction with other senior managers, on cybersecurity risks. In addition, these managers update the Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential. The Committee reports to the full Board on cybersecurity no less frequently than once annually. The full Board also receives briefings from management on our cyber risk management program on a periodic basis.

companyName: Arista Networks, Inc.

ticker: ANET


text: The Business Risk Committee, which reports regularly to the Board, oversees management's actions to identify, assess, mitigate and remediate material issues related to cybersecurity and technology risk as part of our enterprise risk management program and processes. The Cybersecurity Risk Oversight Subcommittee of the Business Risk Committee, chaired by the former chief information officer and chief transformation officer of a Fortune 50 company, assists the Business Risk Committee in discharging its oversight duties with respect to cybersecurity risk and meets on a regular basis to provide for an even deeper focus on, and governance framework around, cybersecurity risks inherent in the Corporation's business. The Business Risk Committee, Cybersecurity Risk Oversight Subcommittee, and the Board are regularly briefed on the organization's cybersecurity posture by senior management, including the Chief Executive Officer, Chief Information Officer (CIO), Chief Risk Officer, Head of Non-Financial Risk, Head of Cyber and Technology Risk, and CISO. The CISO has over 20 years of experience leading teams at financial institutions, including in the areas of risk management and information security, reports to the CIO and is responsible for identifying, managing, and, if necessary, remediating cybersecurity risk to ensure the protection of our data, network, and systems. The primary management-level committees responsible for assessing and managing cybersecurity risk are the Information Technology Oversight Committee, chaired by the CIO, who has over 20 years of experience in technology leadership roles, and the Information Technology Risk Committee, chaired by the Head of Cyber and Technology Risk, who has over 20 years of cybersecurity and risk management experience.

companyName: NORTHERN TRUST CORP

ticker: NTRS


text: Our internal information security team is led by Triton's Chief Information Officer, who has held this role for 14 years and holds over 30 years of experience in information technology, audit and risk management and holds certifications as a Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Information Security and Compliance holds over eight years of experience in cybersecurity management and oversight and over 20 years in information technology portfolio, program and application management positions. Additionally, others in our information technology team have relevant security experience and certifications. Our internal resources are augmented by external cybersecurity partners, including those described below. Our information security leadership team is responsible for assessing and managing the Company's Information Security Program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. We also take a cross-departmental approach to managing cybersecurity risk and have formed a Cybersecurity Incident Response Team ("CIRT") comprised of senior representatives from primary corporate functions as well as senior representatives from field operations to ensure a coordinated and effective response and ongoing business continuity in the face of cybersecurity threats and incidents.

companyName: Triton International Ltd

ticker: TRTN-PA


text: Our enterprise risk management program is overseen by a risk management committee comprised of senior management across key functional areas inclusive of cybersecurity and information technology matters. This committee, working with our Chief Financial Officer, provides periodic reports and updates, as needed, to our board of directors or our Audit Committee. In collecting information on enterprise risk, cybersecurity is included as a designated risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the Audit Committee and among senior management on a periodic basis.

companyName: Kyverna Therapeutics, Inc.

ticker: KYTX


text: When appropriate, we utilize independent, external service providers to assess, test or otherwise assist with certain aspects of our cybersecurity risk management program and related processes, including for penetration testing, threat monitoring and incident response. We also employ a vendor risk assessment process to mitigate risks presented by certain third-party service providers, and we require such providers to manage their cybersecurity risks in conformance to industry standards, notify us of relevant cybersecurity events and satisfy additional contractual requirements.

companyName: Broadcom Inc.

ticker: AVGO


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, the National Institute of Technology Cybersecurity Framework ("NIST CSF") and Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly prescriptive and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the NIST CSF and engages a consultant to periodically assess the Company's NIST CSF profile and maturity. DFIN also obtains System and Organization Control ("SOC") Type 2 certification demonstrating control effectiveness across multiple American Institute of Certified Public Accountants (AICPA) Trust Service Principle domains.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Risks from Cybersecurity Incidents We have not encountered, to our knowledge, a cybersecurity incident that has materially impaired, or is reasonably likely to materially impair, our business strategy, operations, or financial condition. The measures summarized above are intended to help ensure that 1st Source does not suffer a material adverse impact from security breaches, but, as cybersecurity risks evolve and increase in sophistication, we can provide no assurance that our financial condition or results of operations will not be adversely impacted. See "Item 1A. Risk Factors - Operational Risks - Technology Security Breaches."

companyName: 1ST SOURCE CORP

ticker: SRCE


text: The NEP board is responsible for the oversight of risks from cybersecurity threats and receives cybersecurity updates from NEE's chief information officer and its vice president, IT infrastructure and cybersecurity. Significant active cybersecurity incidents and threats are communicated to board personnel as they occur.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: We have developed and maintain a cybersecurity risk management program, consisting of cybersecurity policies, procedures, compliance and awareness programs to mitigate risk and to ensure compliance with security, availability and confidentiality trust principles. The cybersecurity process has been integrated into our overall risk management system and process, and is solely internally managed. Management is responsible for identifying risks that threaten achievement of the control activities stated in the management's description of the services organizations systems. Management has implemented a process for identifying relevant risks that could affect the organization's ability to provide secure and reliable service to its users. The risk assessment occurs annually, or as business needs change, and covers identification of risks that could act against the company's objectives as well as specific risks related to a compromise to the security of data. See "Item 1A. — Risk Factors — Risks Related to Our Company and Business — A material breach in security relating to our information systems and regulation related to such breaches could adversely affect us."

companyName: My Size, Inc.

ticker: MYSZ


text: Our associates receive annual, mandatory information security training, which includes information regarding specific policies and procedures and education on cyber risks such as phishing attacks, social engineering, password management and privacy. New associates receive cybersecurity training as part of their orientation process.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: Like all companies that utilize technology, we are subject to threats of breaches of our technology systems. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management. Our IT department and our management actively oversee our risk management program, including the management of cybersecurity risks. We have contracted cybersecurity and risk assessment experts to help test our systems and guide the ongoing development of best practices policies. We have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, including those discussed in our Risk Factors. We have devoted resources to implement and maintain security measures to meet regulatory requirements and shareholder expectations, and we intend to continue to make investments to maintain the security of our data and cybersecurity infrastructure. While there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective, we believe that our company's sustained investment in these efforts and technologies have put the Company in a position to protect against potential compromises, and we do not believe that risks from prior cybersecurity threats have materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that past or future attacks will not materially affect us, including our business strategy, results of operations, or financial condition. Risk management and strategy.

companyName: cbdMD, Inc.

ticker: YCBD


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. However, we do depend on the digital technologies of third parties, as noted in Item 1A. Risk Factors of this Annual Report. Any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors oversees risk for our Company, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Annual Report.

companyName: M3-Brigade Acquisition V Corp.

ticker: MBAV


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology ("IT") environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and respond to cybersecurity incidents as needed; • cybersecurity awareness training of our employees, cybersecurity incident response team and senior management; • a cyber incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.

companyName: FIGS, Inc.

ticker: FIGS


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our ongoing efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. Please refer to the risk factor titled "We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could materially harm our business." in "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on the risks posed to us by cybersecurity threats.

companyName: STAR OPERATING COMPANIES, INC.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks that could adversely affect our business, financial condition and results of operations. Such risks may include harm to our employees or customers, violation of privacy laws, theft, fraud, extortion as well as legal and reputational risk. See Item 1A. Risk Factors, "Our networks and those of our third-party service providers and customers may be vulnerable to unauthorized or unlawful access, including cyber-attacks and other security breaches, that could have significant negative consequences. Our use of personal information could give rise to costs and liabilities arising from developing data privacy laws." for further discussion.

companyName: Globalstar, Inc.

ticker: GSAT


text: In addition, we have processes in place for assessing and managing cybersecurity risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information and systems they have access to. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider, such as due diligence questionnaires and periodic assessments, and we track the status of reported third party risks within our centralized risk governance framework.

companyName: ONITY GROUP INC.

ticker: ONIT


text: We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts, including outside legal counsel and vendors.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Jacqueline Friesner. Ms. Friesner, age 52, was appointed Controller and Chief Accounting Officer of RBI in December 2014. Prior to that time, Ms. Friesner served in positions of increasing responsibility with Burger King Corporation after joining in October 2002. Previous to Burger King Corporation, she was an audit manager at Pricewaterhouse Coopers in Miami, Florida.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: In addition, the data center where our ERP software is hosted achieves cybersecurity compliance through a multifaceted approach that encompasses various security measures and controls including: Physical Security. The data centers are highly secure facilities with strict access controls, surveillance systems, and perimeter fencing. Access to data centers is limited to authorized personnel only.

companyName: AIRWA INC.

ticker: YYAI


text: Operational staff members actively maintain, review, update, and exercise plans and procedures designed to enhance our overall business resiliency. All staff members are trained annually on current information and cybersecurity trends, techniques, and their responsibilities to keep our information confidential, accurate, and available.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. This approach includes a variety of mechanisms, controls, technologies, methods, systems, protocols and physical safeguards, along with the use of third-party consultants and experts, that are reasonably designed to protect our information, and that of our stakeholders, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. We monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and threat intelligence feeds.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Our Chief Information Security Officer (CISO) leverages vulnerability detection techniques to identify new cybersecurity risks. Our information security program is subject to periodic assessments using the ISO 27001 standard for managing cybersecurity. External security firms conduct penetration tests of our technology surface area internally and externally. Our information security program is also subject to internal and independent external audits.

companyName: Employers Holdings, Inc.

ticker: EIG


text: Cybersecurity Governance Corning's Board of Directors ("Board") plays a role in overseeing risks associated with cybersecurity threats. In particular, the IT Committee of the Board is responsible for cybersecurity governance and has information security oversight as a key component of its charter. In all meetings, the IT Committee reviews the Company's cybersecurity posture as well as significant cybersecurity events. Corning's Chief Digital and Information Officer ("CDIO"), in combination with Corning's CISO, briefs the IT Committee on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. On an annual basis, the CISO provides a cybersecurity update to the Board and participates in a joint meeting of the IT and Audit Committees to review significant cybersecurity risks and their impact, if any, on internal controls. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures. Should a cybersecurity incident rise to the level of a corporate crisis, consistent with the Company's CCRT escalation protocols, the Board would be engaged.

companyName: CORNING INC /NY

ticker: GLW


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Banzai International, Inc.

ticker: BNZI


text: We employ an array of controls, technologies, and other processes designed to identify, protect against, detect, respond to, and mitigate cybersecurity risks. These measures are aligned with the frameworks established by the National Institute of Standards and Technology (NIST). Our IT activities are primarily outsourced for monitoring and maintenance to third parties and are subject to independent controls over IT. These controls include but are not limited to, internal reporting, monitoring and detection tools, threat intelligence, and general and role-based training. We consistently evaluate and enhance the effectiveness of our cybersecurity program, ensuring continuous evolution and improvement.

companyName: BT Brands, Inc.

ticker: BTBD


text: Program and Incident Response Our CISO is responsible for our cybersecurity program, including risk assessments, information security activities, and controls. The CISO is responsible for establishing and maintaining corporate information security policies and overseeing our risk management activities, which prioritize vulnerability management, risk reduction, and prevention. Our CISO also leads our Cyber Defense and Incident Response ("CDIR") team which identifies, assesses, escalates, and remediates cybersecurity incidents. Our current CISO has over 25 years of experience in information security across different industries in the US, Europe, and South and Central America. Our current CISO is a member of the Information Systems Audit and Control Association and brings extensive experience and knowledge of cybersecurity risk management.

companyName: lululemon athletica inc.

ticker: LULU


text: The Company maintains a cybersecurity risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. The program is integrated within the Company's enterprise risk management framework and addresses both the corporate information technology environment and the external facing ecosystem.

companyName: ROCKET PHARMACEUTICALS, INC.

ticker: RCKT


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms including outside legal counsel, cybersecurity consultants, penetration testing firms, cybersecurity software providers, managed cybersecurity service providers and threat intelligence service providers.

companyName: Bionano Genomics, Inc.

ticker: BNGO


text: The Company periodically tests its cybersecurity policies, standards, processes, and practices. The testing conducted by our in-house security teams includes audits, assessments, tabletop exercises, threat modeling, penetration testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company also regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. Individual controls are evaluated and periodically improved through vulnerability assessments and cybersecurity threat intelligence. The Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.

companyName: TTEC Holdings, Inc.

ticker: TTEC


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Collective Audience, Inc.


text: Our Board of Directors has adopted a written statement, known as the Independent Board Candidate Qualifications and made available on our website, outlining the qualities sought in our directors. This statement, which is refreshed periodically, is used by the Nominating, Governance and Corporate Responsibility Committee ("NGCR Committee") to evaluate individual director candidates. The NGCR Committee has identified experience with overseeing and managing risk management processes, including with respect to cybersecurity, as being important to creating an effective, well-rounded and diverse Board. Directors with experience overseeing and managing risk management processes play a critical role in the Board's oversight of our enterprise risk management process.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: As part of the Program, the Company has established policies and procedures to oversee, identify and mitigate material cybersecurity risks associated with the use of any third-party service providers. The Company evaluates and risk rates third-party relationships against a defined set of minimum-security requirements under its enterprise-wide Third-Party Risk Management program. Higher-risk third party service providers are reviewed in more detail and as part of the continual due diligence process to ensure changes to the relationship and/or risk posture are identified and managed appropriately.

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: Our Information Technology team (which includes our Director of Cybersecurity) and our Technology Compliance team (which includes our Director of Technology Compliance) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.

companyName: YETI Holdings, Inc.

ticker: YETI


text: The ISO conducts training on cybersecurity risks for all new employees, and at least annually for existing employees and the Board of Directors. In addition to this training program, simulated phishing attempts are sent to employees on a regular basis to evaluate their understanding of these risks and to provide supplemental training as needed. The Corporation uses data loss prevention and web filtering software to ensure malicious data does not enter the Corporation's network, and sensitive information does not leave the network unless properly secured. Penetration tests and vulnerability scanning are performed on a regular basis. We employ an in-depth, layered, defensive strategy with respect to our products, services, and technology. We leverage people, processes, and technology to manage and maintain cybersecurity controls. We employ various preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.

companyName: ENB Financial Corp

ticker: ENBP


text: Both intentional and unintentional occurrences have caused, and could cause in the future, a variety of adverse business impacts to our information systems and data. For a discussion of whether and how any risks from cybersecurity threats have affected or, if realized, are reasonably likely to materially affect the Company, see "Risk Factors" in Item 1A of Part I above for additional information on risks related to our business, including for example, risks related to privacy and data protection, cybersecurity incidents, third-party relationships, and continuity of our information systems and networks, operational technology, and technology products or services.

companyName: MCKESSON CORP

ticker: MCK


text: We are a shell company with no business operations. As a result, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting and monitoring and detection tools.

companyName: Yale Transaction Finders, Inc.

ticker: YTFD


text: Cybersecurity remains a top financial services industry risk due to increases in the quantity and sophistication of cyberattacks, which include ransomware, supply chain, and other prevalent attack methods resulting in unauthorized access to systems or sensitive data.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: Our Board also periodically participates in tabletop exercises conducted by senior management, with the assistance of outside counsel as needed, as part of risk management and disaster-related planning to validate, test, and assess the effectiveness and adequacy of certain roles and decision-making processes in the event of a cyber-incident.

companyName: ETSY INC

ticker: ETSY


text: In the event of a cybersecurity incident, our initial focus is to contain the cybersecurity incident as quickly as possible consistent with our incident response plan. Once a cybersecurity incident is contained, we focus on remediation and recovery activities, which depend on the nature of the cybersecurity incident. We have relationships with third-party providers to assist with cybersecurity containment and remediation efforts, including for example, forensic investigations and incident response management. If a cybersecurity incident materially impacts us, or is expected to materially impact us, we promptly notify senior management, the Franklin Board of Directors ("Board") and/or Franklin Audit Committee, as appropriate based on the severity of the incident. Our response plan also addresses engagement with appropriate individuals and committees with respect to disclosure determinations related to cybersecurity incidents. We review and, if necessary, update our cyber security incident response plan at least annually.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: We maintain a risk-based third-party risk management process designed to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.

companyName: PENTAIR plc

ticker: PNR


text: IT General Controls ("ITGCs"): EQT has implemented an ITGC framework to ensure the integrity and security of its systems. This framework ensures that access to systems is appropriately granted, monitored and maintained. It also ensures that changes to systems are reviewed, approved and implemented in a controlled manner. Additionally, the framework encompasses other critical security measures including data backup procedures and ongoing monitoring to safeguard operations.

companyName: EQT Exeter Real Estate Income Trust, Inc.


text: Recovery strategies are in place and supervised by a crisis management plan to restore critical operations following a cybersecurity event. We maintain secure, redundant backups and regularly test them for integrity and availability. Our recovery strategies prioritize minimizing downtime and rapid service restoration. We strive to incorporate lessons learned from past incidents, strengthening our resilience against future threats.

companyName: SMITHFIELD FOODS INC

ticker: SFD


text: Our management team, including our Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over ten years of overseeing IT risk management and compliance, day-to-day IT operations, and coordinating with external IT security experts. Our Chief Accounting Officer also works in tandem with an external cybersecurity consultant that has experience in cybersecurity assessment, response, and mitigation.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and reputational risks. We have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such risks, including regular network and endpoint monitoring, access controls, vulnerability assessments, penetration testing, annual information security training for employees, and tabletop exercises to inform our professionals' risk identification and assessment. We have an Incident Response Plan which guides the actions we are to take in the event of a suspected or confirmed cybersecurity incident. The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage. We also maintain a Business Resumption Plan (for critical tools and applications), which provides procedures for maintaining the continuity of critical business processes in the event of business interruption, including any interruption that involves cybersecurity incidents which may significantly impact our operations. Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology ("NIST").

companyName: Warner Music Group Corp.

ticker: WMG


text: Our board of directors, in coordination with the Audit Committee, oversees the Company's processes for assessing and managing risk. Our board of directors has delegated primary responsibility for overseeing our enterprise risk management process, including oversight of information technology, cybersecurity, and data privacy risks, to the Audit Committee. Despite this delegation of primary responsibility, both the Audit Committee and the board of directors are actively involved in risk oversight. The board of directors and Audit Committee regularly review the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: LandBridge Co LLC

ticker: LB


text: CIM's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.

companyName: CIM Opportunity Zone Fund, L.P.


text: To aid in identifying and assessing material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other significant company risks as part of our overall risk assessment process. As part of this process, the Company gathers input from subject matter specialists, as necessary, to gather insights to help in identifying and assessing material cybersecurity threat risks, as well as potential severity and mitigation measures. We also have a cybersecurity specific risk assessment process, which helps identify potential cybersecurity risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.

companyName: JUNIPER NETWORKS INC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: Our Chief Operating Officer and Systems Administrator are primarily responsible for assessing and managing the cybersecurity risks we face under our policies and procedures, including those described in "Risk Management and Strategy" above. Our Chief Operating Officer is primarily responsible for reporting any material cybersecurity related incidents to our Audit Committee.

companyName: VACCINEX, INC.

ticker: VCNX


text: To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: Our Head of Security & Privacy oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. The processes and procedures by which our Head of Security & Privacy is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include our incident response process, tracking in our centralized risk repository, and our vulnerability management process. Our Incident Response policy describes and supports the activities we take to prepare for discovery, response, and recovery from cybersecurity incidents, which include processes to determine severity, escalation, and response to incidents, as well as those necessary to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: Lyft, Inc.

ticker: LYFT


text: The landscape of cyber threats is constantly evolving, making it increasingly challenging to effectively defend against them or implement sufficient preventative measures. We have observed a rise in the volume, frequency, and sophistication of cyber-attacks. There can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cyber threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. For more information regarding the cybersecurity risks that we face, see "Risks Related to Our Control Environment – Breaches of our information systems and cyberattacks could compromise our intellectual property and cause significant damage to our business and reputation" included as part of our risk factor disclosures in Part I, Item 1A of this report.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN


text: Our Board and the Audit Committee are actively engaged in the oversight of our cybersecurity and data privacy program. The Board, at least annually, and the Audit Committee, periodically throughout the year, receive regular reports from our Chief Information Security Officer ("CISO") and members of the information security team on, among other things, recent developments, the state of the information security program, assessments of risks and threats to our information security systems, information security considerations arising with respect to our peers and third parties, third-party and independent reviews, and processes to maintain and strengthen information security systems. Under the oversight of the Audit Committee, we engage third-party experts to assess the state of our cybersecurity and data privacy program. The Audit Committee also provides regular updates to the Board, and the Board would be notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: MCCORMICK & CO INC

ticker: MKC


text: The Bank has implemented an information security program that encompasses the Bank's cybersecurity efforts as part of its risk management process. Risk assessments, including Information Technology and Cybersecurity Risk, are conducted annually by the Chief Risk Officer, Information Technology Officer and Information Security Officer to identify, assess and mitigate risks. The Bank recognizes the need for sound physical and internal controls over its critical financial data, confidential information and digital assets to ensure the accuracy, integrity, and confidentiality of the processed information. As regulated financial institutions, the Company and Bank are also subject to financial privacy laws and their cybersecurity practices are subject to oversight by the federal banking agencies.

companyName: Home Federal Bancorp, Inc. of Louisiana

ticker: HFBL


text: The oversight of our cybersecurity risk is integrated into our enterprise-wide risk management process. We have a dedicated global cybersecurity team that monitors potential cyber threats and leads our business continuity risk management. We have business continuity plans that identify our critical business systems, establish recovery objectives and create methods for implementing such plans within our business. Our business continuity plans encompass disaster recovery at our data centers such that business operations continue with no or minimal impact. Our business continuity plans will continue to evolve, with the goal of enabling us to operate and maintain our essential functions in the event of a crisis.

companyName: MATERION Corp

ticker: MTRN


text: We also maintain a Cyber Incident Response Team, which includes a board representative and an executive officer representative and is chaired by our COO/IT Manager. The Cyber Incident Response Team is charged with developing and implementing incident response and recovery plans to guide our employees, management and the Board in their response to a cybersecurity incident.

companyName: Bank7 Corp.

ticker: BSVN


text: Management and Board Oversight of Cybersecurity Risks Our Information Security Program is managed by a dedicated Chief Information Security Officer ("CISO"), who leads our Information Security team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our CISO holds a BSc degree in the combined studies of Computer Science & History of Science from Herriot-Watt University and a graduate of the Carnegie Mellon University's Heinz College of Information Systems and Public Policy + Software Engineering Institute's Chief Risk Officer Executive Education and Certificate Program. He holds the following professional certifications from the Information Systems Audit and Control Association: Certified Information Systems Auditor (CISA), Certified in the Governance of Enterprise IT (CGEIT), and Certified in Risk and Information Systems Control (CRISC). Additionally, he has more than 20 years of experience in financial services, including management experience with Globally Systemically Important Banks, as well as experience in cybersecurity, information security & information technology risk management, governance, risk, and compliance.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: We use processes, technologies, and controls to assist in our efforts to assess, identify, and manage material cybersecurity-related risks. We also employ a range of tools and services, including network monitoring, vulnerability assessments, and tabletop exercises to inform our risk identification and assessment processes. We maintain an incident response plan that outlines the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes designed to triage, assess the severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with relevant legal obligations. Additionally, we conduct cybersecurity awareness and sensitive information protection training for our employees, and we periodically test the effectiveness of our training and policies through simulations, which may include simulated phishing emails and tabletop exercises.

companyName: ETSY INC

ticker: ETSY


text: Our officers and our IT vendors help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: The Manager's Director of Information Technology has served in various roles in information technology and information security for 25 years, including serving as Global Technology Manager at a multi-national publicly traded broker-dealer, and 15 years as the Director of Information Technology at a privately held financial services firm. The Manager's Director of Information Technology holds an undergraduate degree in biochemistry and has attained numerous information technology certifications over the years including Microsoft Certified Systems Engineer (MCSE) and Cisco Certified network Professional (CCNP). The Manager's Senior Infrastructure Engineer has over 20 years industry experience, holds an undergraduate degree in radiology, and has completed various Microsoft related information technology certifications. Combined, our Manager's information technology team has over 50 years of experience covering all major aspects of network architecture and management.

companyName: NexPoint Real Estate Finance, Inc.

ticker: NREF


text: We have a dedicated cybersecurity team led by our Vice President of Information Security ("CISO"), who reports directly to our Chief Technology Officer ("CTO"). Our CISO has more than 10 years of experience in cybersecurity and IT compliance, is a member of InfraGard, a national non-profit organization serving as a public-partnership between U.S. businesses and the Federal Bureau of Investigation, and is a member of the Cal Poly Pomona Cyber Security Advisory Council. He has also obtained the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified Cloud Security Professional (CCSP), and Certified Chief Information Security Professional (CCISO). Our CTO has over two decades of experience in establishing, administering, and enhancing effective cybersecurity programs for multiple publicly-traded companies. Our CTO and CISO conduct quarterly cybersecurity reviews for our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), and Chief Legal Officer ("CLO"). Our CISO reports to our CTO, who reports to our CFO.

companyName: American Homes 4 Rent

ticker: AMH


text: The Company's Board of Directors (the "Board") through its audit committee (Audit Committee) is responsible for overseeing the Company's risk management program. The Company integrates cybersecurity risk management into its broader risk management framework to ensure that cybersecurity considerations form an integral part of our risk management program. Our Information Technology (IT) department works closely with the risk management team to evaluate and address cybersecurity risks. The Company's cybersecurity strategy and risk management processes align with the National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework.

companyName: V2X, Inc.

ticker: VVX


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our director of IT and senior executives including our chief executive officer, chief financial officer and general counsel, and our executive vice president who is also the Contran chief information officer. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT team is responsible for categorizing cybersecurity incidents, and those deemed high-risk or critical are escalated to the CIDAC for review and response coordination. Incidents are evaluated to determine materiality and for operational, financial and reputational impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. As needed, we collaborate with external cybersecurity experts and legal advisors to help ensure a robust response strategy.

companyName: COMPX INTERNATIONAL INC

ticker: CIX


text: We have a Cybersecurity Incident Disclosure and Controls Committee (CIDAC) which is central to the response and evaluation of cybersecurity incidents. Our CIDAC is comprised of our director of IT, the Contran chief information officer (who provides services to us under our intercorporate services agreement with Contran), and senior executives including our chief executive officer, chief financial officer and general counsel. Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. The IT team is responsible for categorizing cybersecurity incidents, with incidents evaluated to be high or critical security risks brought to our CIDAC for review and evaluation. Incidents are evaluated to determine materiality as well as operational and business impact. Our CIDAC performs simulations and tabletop exercises at a management level to evaluate our readiness and response to cybersecurity incidents. External resources and advisors are incorporated as needed.


text: We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the ability to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: FIRST OF LONG ISLAND CORP


text: Cybersecurity risks and updates are reported and discussed on a regular basis within various Old National and Old National Bank management committees that have operational business or information technology oversight or day-to-day implementation, monitoring, and governance responsibility for information security matters. Those include Old National Bank-level committees such as the Information Security and Technology Risk Management Committee (the "ISTRM"), the Risk Executive Committee, the Security Technology Council and the Cyber Threat Management Council. The ISTRM has direct oversight of the ISP. It is chaired by the CISO and meets regularly (generally bi-monthly and no fewer than five times per year) to review the ISP and related cybersecurity matters as outlined in its charter. Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company's Information Security department. Coordination among these committees, and with other business management committees operating outside the auspice of the Company's Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: Our Enterprise Risk Management Committee, which includes the company's Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), independently assesses and monitors the effectiveness of the company's cybersecurity risk management programs and strategies. The company's internal audit function also performs independent reviews and validation of the various programs, including policies and procedures as determined by their annual risk assessment.

companyName: Corteva, Inc.

ticker: CTVA


text: To its knowledge, the Company has not experienced a material cybersecurity breach within the last three years, nor identified any risks from cybersecurity threats that have materially affected us, including our business strategy, results of operations or financial condition.

companyName: ZW Data Action Technologies Inc.

ticker: CNET


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure including cybersecurity risk, and our executive officers are responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Audit Committee.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: To prevent, detect and respond to information security threats, the Sponsor maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO"), with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Sponsor, receives regular reports from the CISO on, among other things, the Sponsor's cyber risks and threats, the status of projects to strengthen the Sponsor's information security systems, assessments of the Sponsor's security program and the emerging threat landscape.

companyName: Grayscale Zcash Trust (ZEC)

ticker: ZCSH


text: To our knowledge, cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition; however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see

companyName: Carlyle Group Inc.

ticker: CG


text: While the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee oversees our cybersecurity risk management, our management also plays an integral role in cybersecurity oversight. Our management is responsible for day-to-day risk management processes. This includes periodic updates from the Executive Director of Information Technology who has over 23 years of work experience in the life science industry, and holds an undergraduate degree in Industrial Technology. The Executive Director of Information Technology is responsible for managing the daily measures of safeguarding the information technology infrastructure from potential threats and vulnerabilities, which includes monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents. Additionally, we have established a Crisis Management Team (CMT), which is a team of cross-functional participants who are prepared to review and assess any potential cybersecurity incidents. The CMT team is led by our CFO and our General Counsel who will advise the Corporate Governance, Healthcare Compliance Oversight, and Nominating committee of the Board accordingly in the event of any incident. We believe this division of responsibilities is the most effective approach for addressing our cybersecurity risks and that the Board leadership structure supports this approach.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: Pursuant to our Audit Committee Charter, our Audit Committee is responsible for reviewing and assessing our risk assessment and risk management policies, including oversight of cybersecurity risk. Our risk assessment policy is utilized in making decisions with respect to company priorities, resource allocations, and oversight structures. Our Board of Managers, with the assistance of our Audit Committee and Technology Committee, regularly reviews our cybersecurity program with management and reports to the Board of Managers. Cybersecurity reviews generally occur at least annually, or more frequently as determined to be necessary or advisable. We have an escalation process in place to inform senior management and the Board of Managers of material issues.

companyName: Shepherd's Finance, LLC


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO and IT manager. Our CFO has overseen and been responsible for the Company's information technology and cybersecurity programs since 2018, and before that held equivalent responsibilities at another public company. Our IT manager has approximately seven years of experience with testing, implementing and maintaining our information technology systems and security.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: Security Awareness Program to Train and Test Personnel We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on best practices for cyber-hygiene including: multifactor authentication and single sign-on use for cloud applications; ways to identify social engineering techniques, policy and process awareness, periodic phishing simulations and other preparedness testing.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Item 1.A – Risk Factors – Risks Related to Our Business Operations – Our business and operations would suffer in the event of computer system failures, cyber-attacks Governance

companyName: InspireMD, Inc.

ticker: NSPR