text: In 2023, we did not experience a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in "Item 1A. Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships." and "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products." Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events. See "Item 1A. Risk Factors—Risks Related to Our Legal and Regulatory Environment—We may not be able to maintain sufficient insurance to cover us for potential litigation or other risks."

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. Despite our continuing efforts, our cybersecurity platform may not prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our brand, lost sales, reduced demand, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Risk Factors – Risks Related to Information Technology and Cybersecurity."

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX

secItem: Item 1C


text: The Company provides annual training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Heritage Insurance Holdings, Inc.

ticker: HRTG


text: Our cybersecurity program is managed by a dedicated team, which is led by our Chief Information Security Officer, (CISO who reports to the Chief Operating Officer and has to the ability to communicate directly to our CEO if necessary). Our CISO has over 20 years of IT experience, including over 18 years of cybersecurity experience, holds an M.S. degree in Information Security, and is a Certified Information Systems Security Professional (CISSP). Our General Counsel and Chief Privacy Officer is an attorney with 18 years of experience, including experience in privacy matters. They are also a Certified Information Privacy Professional (CIPP/US/E), a Certified Privacy Manager (CIPM), and a Privacy Law Specialist (PLS) with the International Association of Privacy Professionals (IAPP). As discussed above, our CISO and/or General Counsel and Chief Privacy Officer report to our board of directors about cybersecurity threat risks, among other cybersecurity related matters, on a quarterly basis.

companyName: Fulgent Genetics, Inc.

ticker: FLGT


text: Governance and Management's Responsibilities Our entire Board considers cybersecurity risk as part of its risk oversight function and our entire board oversees management's implementation of our cybersecurity risk management program.

companyName: KRATOS DEFENSE & SECURITY SOLUTIONS, INC.

ticker: KTOS


text: In conjunction with third-party vendors and consultants, Goldman Sachs performs risk assessments to gauge the performance of the Cybersecurity Program, to estimate its risk profile and to assess compliance with relevant regulatory requirements. Goldman Sachs performs periodic assessments of control efficacy through its internal risk and control self-assessment process, as well as a variety of external technical assessments, including external penetration tests and "red team" engagements where third parties test its defenses. The results of these risk assessments, together with control performance findings, are used to establish priorities, allocate resources, and identify and improve controls. Goldman Sachs uses third parties, such as outside forensics firms, to augment its cyber incident response capabilities. Goldman Sachs and its third-party service providers have a vendor management program that documents a risk-based framework for managing third-party vendor relationships (including those of the Trust). Information security risk management is built into the vendor management process, which covers vendor selection, onboarding, performance monitoring and risk management.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: The Company's processes also allow for the Board and the Audit Committee to be informed of key cybersecurity risks outside the regular reporting schedule. While regular meetings of the Audit Committee are scheduled on a quarterly cadence, the Audit Committee is authorized to meet with management at any time it deems appropriate to discuss matters relevant to the Audit Committee. The Company's policy is for the Board and the Audit Committee to receive prompt and timely information regarding any cybersecurity risk (including any incident) that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.

companyName: FAIR ISAAC CORP

ticker: FICO


text: The management team reports to the Board on cyber risk quarterly. Reports include: • Overall cybersecurity posture: Current state of our security controls and identified vulnerabilities. • Incident reports: Summary of recent cyber incidents, including their nature, impact, and mitigation efforts. • Risk assessments: Updated assessments of potential cyber threats and their potential impact on us. • Security budget and resource allocation: Plans and investments for maintaining and enhancing our cybersecurity program.

companyName: FORWARD AIR CORP

ticker: FWRD


text: Our information technology function, which is led by Samir Gharib, our President, Chief Financial Officer, and Chief Compliance Officer, helps identify, assess and manage the Company's cybersecurity threats and risks. Our information technology function works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, employing both automated and manual tools and controls; conducting threat and vulnerability assessments; utilizing third-party services to monitor our information technology infrastructure; and performing internal audits.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Our incident response plan sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, assessing materiality and communication or notification requirements, and reducing the likelihood of future incidents. In the event of a real or perceived cybersecurity incident the information technology team would, as soon as practicable, inform the incident response team, the members of which would then collaborate to assess a strategy and manage the risks.

companyName: SMITH MICRO SOFTWARE, INC.

ticker: SMSI


text: All of the Company's global suppliers must comply with its Supplier Code of Conduct ("SCOC"). The SCOC contains certain data security and notification requirements, and the Company explicitly maintains the right to monitor and audit compliance with the SCOC.

companyName: SUPERIOR INDUSTRIES INTERNATIONAL INC

ticker: SSUP


text: We have established processes and policies for assessing, identifying and remediating material risks posed by cybersecurity threats. Our processes and policies are based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our processes are focused on: (i) effecting organizational education on how to manage cybersecurity risks, (ii) implementing safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident and (v) recovering from a cybersecurity incident. Additionally, we have a cybersecurity incident response plan including specific responsive protocols administered by an incident response team, led by our Vice President of Information Technology and comprised of other members of management.

companyName: Thryv Holdings, Inc.

ticker: THRY


text: Primerica institutes a three-lines-of-defense model for information security risk assurance, in which management owns the risk, our enterprise risk management team assesses the risk and oversees compliance with internal guidelines and policies, and our internal audit team reviews the effectiveness of the first two lines of defense. Management works with external assessors, consultants, auditors, and other third parties from time to time in conducting maturity and technical assessments.

companyName: Primerica, Inc.

ticker: PRI


text: To assess, identify, and manage the risks of cybersecurity threats to our information system, we maintain a cybersecurity program, including policies and controls, which are regularly reviewed through internal and external assessments.

companyName: MediXall Group, Inc.

ticker: MDXL


text: The Company also maintains a Third-Party Risk Management ("TPRM") program designed to identify, assess, and manage enterprise risks, including cybersecurity risks, inherent in or potentially associated with the Company's external service providers and other third parties in its supply chain. TPRM leaders report into and operate under the supervision of our Corporate Risk Management department. The TPRM program seeks to build into the Company's business processes an appropriate level of cybersecurity due diligence prior to engagement of, and during the relationship lifecycle with, third parties. We generally seek security-related confirmations from our third-party suppliers, including as to their adherence to appropriate information handling and asset management requirements and their provision to us of notifications in the event of any known or suspected cybersecurity incidents.

companyName: OLD NATIONAL BANCORP /IN/

ticker: ONB


text: As part of our overall risk management system, we train our staff on the safeguards we have in place to mitigate cybersecurity threats and ensure employees are able to identify potential attempts to breach our security and how to report and deal with any potential threats.

companyName: Adaptimmune Therapeutics PLC


text: Our cybersecurity risk assessment and management processes as well as our Information Security program are implemented and maintained by certain Company management, including our CTO and our CISO, who have 25 years of experience in cybersecurity and IT Operations respectively. Our CTO and CISO collaborate with a cross-functional team of seasoned professionals responsible for maintaining, improving, and promoting our Information Security program. In addition to the oversight by our Technology and Security leaders, representatives from our Information Technology, Legal, Privacy, Finance, Regulatory, Quality, and Compliance teams are integral to the successful implementation of our overall Information Security program.

companyName: Tempus AI, Inc.

ticker: TEM


text: Our cybersecurity program is designed to protect information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction.

companyName: TERADATA CORP /DE/

ticker: TDC


text: Our cybersecurity risk assessment is performed annually and includes external and internal penetration testing performed by third party vendors to test for vulnerabilities in the Company's environment.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: Cybersecurity is closely aligned with not only risk management, but also with business continuity planning and response. In addition, the importance of cybersecurity protection and its practice at the manager and employee level is frequently communicated to the staff globally. Specifically, VanEck's Chief Information Security Officer, reporting to the co-chair of the Risk Management Committee, is responsible for conducting the firm's cybersecurity risk assessment, as well as providing regular staff educations with a special emphasis on proper desktop and email security and conduct. Special training is also given to recently on-boarded staff. VanEck's Chief Administrative Officer and Chief Technology Officer, together with VanEck's Chief Information Security Officer, are responsible for the day-to-day operations of the firm cybersecurity infrastructure including normal operations as well as any remedial work required in response to an incident. The communication responsibility in the event of an incident is shared by VanEck's CEO and the General Counsel.

companyName: VanEck Bitcoin ETF

ticker: HODL


text: Our information security program is managed by the President of Enterprise Operations, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The President of Enterprise Operations provides periodic reports to the Audit Committee and the full Board of Directors (the "Board"), as well as our Chief Executive Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of key initiatives to strengthen the information security profile of our systems, cybersecurity incident response readiness, assessments of the information security program, and the emerging threat landscape. Our program is regularly evaluated by internal and external experts with the results of those reviews reported to senior management and the Board. We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: NEOGENOMICS INC

ticker: NEO


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our businesses and geographic locations.

companyName: FIRST BUSEY CORP /NV/

ticker: BUSE


text: Following these risk assessments, we evaluate how to appropriately implement and maintain reasonable safeguards to mitigate identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote significant resources and designate members of our management team, including our executive staff, information technology ("IT") team, and Global Director of IT who reports to our Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), to manage the risk assessment and mitigation process. As part of our overall risk management, we collaborate cross-functionally to monitor and test our safeguards and to train our employees on cybersecurity risks and safeguards. We offer cybersecurity training programs for employees at all levels and departments.

companyName: Identiv, Inc.

ticker: INVE


text: People. PTC recognizes that technology alone cannot mitigate all security threats, so we focus on developing our most critical resource: our people. Security is the responsibility of everyone employed by PTC and is independent of departmental affiliation. PTC's corporate cybersecurity awareness activities are combined with enterprise-wide and department-specific tools and mandatory employee training, providing everyone employed by PTC with the knowledge and resources to support our efforts to mitigate security threats.

companyName: PTC INC.

ticker: PTC


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs, with active participation in the CWG. The CWG is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CWG also develops periodic reports on the Company's cybersecurity program and developments. The Company CWG is comprised of Executive team and senior management members, including the Company's President and Chief Operating Officer, Chief Financial Officer, and Vice President of Technology.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which would be used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted depending on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and utilize third parties to regularly review our response plans.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: We have experienced cybersecurity incidents in the past and will experience cybersecurity incidents in the future. Prior cybersecurity incidents have not materially affected, or are reasonably likely to affect, our business strategy, results of operations or financial condition, however, there is no guarantee that a future cybersecurity incident would not have a material adverse effect on such items. While we believe our cybersecurity program is designed to mitigate cybersecurity risks, we cannot eliminate all risks from cybersecurity threats. See Item 1A. Risk Factors for more information on our cybersecurity risks.

companyName: AeroVironment Inc

ticker: AVAV


text: In 2022, Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank. The assessment gauged the overall Cybersecurity Risk Posture of the Bank and resulted in a score of 4.8 on a scale of 0 to 5. The next independent evaluation is planned for 2025. In the last three fiscal years, the Company has not identified any material cybersecurity incidents. No specific identified cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition. See Item 1A "Risk Factors" for a further discussion of our cybersecurity risks.

companyName: BankUnited, Inc.

ticker: BKU


text: We design and assess our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: WORLD ACCEPTANCE CORP

ticker: WRLD


text: We maintain cyber insurance coverage and have tendered claims for certain expenses incurred in connection with this event. We will tender claims in future periods for costs incurred as of December 31, 2023. The extent to which our insurance will cover such expenses remains uncertain. As of December 31, 2023, we had recovered $1.7 million from our insurer. Insurance recoveries are recorded as a reduction of general and administrative expense. Refer to Note 15 to our Audited Consolidated Financial Statements for additional information concerning the incident. As a result of our cybersecurity incident in 2023, our cyber insurance premiums increased significantly following renewal and the number of insurers that submitted proposals to us for consideration during our renewal process was very limited.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: Management Oversight in Cybersecurity Governance FMC's senior management Executive Committee and Leadership Team, which includes the Chief Executive Officer and all Company vice presidents, is responsible for review and oversight of the Company's cybersecurity programs and risk assessment as well as the strategic direction of the program to address evolving risks. Specifically, Jas Sidhu, Senior Director - Core IT, serves as management's expert in cybersecurity management. He has held various positions within the Company's IT department, has an educational background in Information Systems, and contributes technical expertise to the Company's leadership team. He serves as a member of the Chemical Information Technology Center's CIO organization and the SAP Chemicals Advisory Board. Mr. Sidhu also belongs to various business associations, including industry and government associations, to ensure timely receipt of critical threat information as well as access resources useful in developing cost-effective security solutions to protect the Company's personnel and information. Additionally, Andrew Sandifer, Executive Vice President and Chief Financial Officer, has completed continuing professional education courses covering the role of management and the board of directors in cybersecurity governance. Members of the management team are encouraged to engage in education opportunities related to cybersecurity.

companyName: FMC CORP

ticker: FMC


text: BHE's CSO is responsible for cyber and physical security across BHE and its Subsidiary Registrants. The CSO is responsible for identifying, assessing and managing cyber risk for BHE and its Subsidiary Registrants. The Executive Committee has evaluated the expertise of the CSO and determined that it possesses the knowledge and expertise necessary to oversee BHE's cybersecurity risk management processes.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: We recognize the critical importance of maintaining the trust and confidence of our patients, employees, and business partners toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our audit committee of the board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. We have taken into account recognized frameworks established by the National Institute of Standards and Technology, or NIST, when developing cybersecurity policies, standards, processes and practices among other considerations. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Our cybersecurity risk management framework includes steps for assessing the severity of a cybersecurity threat (including an escalation process for potentially material cybersecurity threats and incidents to an internal committee comprised of members of senior management), identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), and implementing cybersecurity countermeasures and mitigation strategies. The internal committee is responsible for assessing the materiality of cybersecurity threats and incidents, and it informs members of senior management and the audit committee of our board of directors of material cybersecurity threats and incidents.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: For a description of the risks from cybersecurity threats that may materially affect us, see "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: Zoom Communications, Inc.

ticker: ZM


text: We operate a security operation center to ingest threat intelligence, monitor for cybersecurity threats and coordinate incident response resources. In the event of a cybersecurity incident, the Company has developed a security incident response plan that establishes a structured approach for the Company's response. The security incident response plan includes processes through which cybersecurity incidents are escalated based on a defined incident risk rating to business stakeholders and a security incident response team, as well as to the Company's executive officers, which may result in engagement with management's risk oversight committee (the "ROC"), the Board and the Audit and Risk Committee of the Board ("ARC"), as needed. To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually. These exercises are conducted by internal personnel and with assistance from third-party experts, as needed.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: Ferguson invests in associate training and education on cybersecurity and risk management thereof. Ferguson provides annual phishing training to all associates who are issued a Company device, and our annual Code of Conduct training often features information technology subjects, such as protection of company and personal information and identifying and reporting cybersecurity and phishing incidents. In addition, we maintain a cybersecurity awareness hub on our company intranet, regularly distribute cyber newsletters and cyber tips, and conduct regular phishing email simulation tests, including customized role-based tests, to reinforce prior training and promote ongoing awareness of risks. We also periodically conduct tabletop exercises with management and other associates to practice cyber incident response and to improve our processes and strategies.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: However, it is believed that the threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens that may contain sensitive information. The threat actors released a portion of this information publicly and that of some of our vendors and customers since we had not acceded to their demand for a monetary payment. However, we do not believe that the threat actor was able to infiltrate the computer systems of any of our customers or vendors. We have taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access and bolstering our cyber defensive capabilities.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks, including oversight of management's implementation of the cybersecurity governance program.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, risk assessments, incident detection and response, vulnerability management, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, employee training, cybersecurity insurance, and asset management, tracking and disposal.

companyName: Pulmonx Corp

ticker: LUNG


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Cigna Group

ticker: CI


text: Training and Awareness Cybersecurity awareness is a foundational element of our risk management approach. We conduct recurring cybersecurity training for employees across the company, with tailored modules that address evolving threat vectors such as phishing, ransomware, and social engineering. Additional targeted training is provided to users in high-risk roles.

companyName: PETMED EXPRESS INC

ticker: PETS


text: The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. The Company has designed and implemented a cybersecurity incident response plan and related processes, which are overseen by a team of internal cybersecurity professionals, including individuals with over ten (10) years' experience handling vulnerability and security management, system upgrades, mitigation initiatives, user education and system re/accreditation. The Company provides regular desk-top educational training and incident simulation exercises to better address potential cyber security incidences and response thereto.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: We recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. Our approach to cybersecurity risk management is aligned with our risk profile and business.

companyName: Pioneer Green Farms, Inc.


text: We recognize the importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information and operational technologies and protect our data's confidentiality, integrity, and availability. Our business is dependent upon our computer systems, devices, software, and networks (operational and information technology) to collect, process, and store the data necessary to conduct almost all aspects of our business, including the evaluation of acquisition and development opportunities, the monitoring and evaluation of our existing properties, the performance of any data from our operators, and the recording and reporting of financial information.

companyName: SOUTH DAKOTA SOYBEAN PROCESSORS LLC

ticker: SDSYA


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy, managing our cybersecurity threat detection and response plan, and assessing and managing material risks from cybersecurity threats. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our senior management team oversees our cybersecurity strategy and has the overall responsibility for assessing and managing our exposure to cybersecurity risk, with the audit committee of the board of directors providing board level oversight of the activities conducted by management to monitor and mitigate cybersecurity risks. Our corporate strategy for information security is led by the Chief Technology Officer ("CTO") of our primary operating company, P.A.M. Transport, Inc., who develops and directs our information security strategy and policy. He also oversees the engineering and operations related to cybersecurity and issues the proper response when a cyber threat is detected. Our CTO has 23 years of experience in technology and 17 years in compliance and cybersecurity management. Cybersecurity strategy and updates are reviewed by our senior management team on a periodic basis. The audit committee periodically receives a report on cybersecurity matters and related risk exposure from our CTO or senior management and discusses this exposure and our risk management strategies and related controls with management and the internal and external auditors. When covered during an audit committee meeting, the chair of the audit committee reports on its discussion to the full board.

companyName: PAMT CORP

ticker: PAMT


text: The Company's Vice President of Information Systems has been with the Company for over 19 years and has overseen the Company's information systems, including its cyber risk management program, for the last six years. He is a member of the Global Information Assurance Certification Advisory ("GIAC") Board and has received various GIAC certifications in the areas of information security governance and technical controls focused on protecting, detecting and responding to cybersecurity issues. The Company's Chief Financial Officer has over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.

companyName: EPR PROPERTIES

ticker: EPR


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.

companyName: ARDELYX, INC.

ticker: ARDX


text: All security measures shall be reviewed at least annually, or whenever there is a material change in our business practices that may reasonably implicate the security or integrity of records containing personal information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws and implement changes to our compliance processes; annual cybersecurity assessments for employees who use our system to evaluate training needs; onboarding and cyber security training for all employees on an ongoing basis;

companyName: CVD EQUIPMENT CORP

ticker: CVV


text: Currently, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's operations. However, the nature of potential cybersecurity risks and threats are uncertain, and any future incidents, outages or breaches could have a material adverse effect on the Company's business strategy, results of operations or financial condition.

companyName: Spirit Aviation Holdings, Inc.

ticker: FLYYQ


text: The Board Enterprise Risk Management ("ERM") Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls. The Chief Information Officer ("CIO") manages the IT Department and reports to the Board Risk Committee and Chief Risk Officer ("CRO") on these matters. The CIO also supervises the Information Security Officer ("ISO") who is responsible for implementing and maintaining the Company's Information Security Program. The Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. Additional cybersecurity training to the ERM Committee is provided and overseen by the CRO and CIO. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Company and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing. The CIO is a member of various management committees, chairs the Company's management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company's ERM Working Group, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company. The ERM Working Group is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank's corporate strategies, and ensuring compliance with applicable laws and regulations. The Bank's IT Steering Committee in conjunction with the Bank's PMO oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Risks from Cybersecurity Threats We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches through cyber-attacks, cyber-intrusions, or other methods could disrupt our information technology networks and related systems", for additional discussion about cybersecurity-related risks.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Our information security program is designed to generally align with recommended practices in security standards issued by ISO, AICPA (SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.

companyName: CORPAY, INC.

ticker: CPAY


text: we utilize collaboration mechanisms established with other entities, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks;

companyName: Sky Harbour Group Corp

ticker: SKYH


text: Our Audit Committee provides oversight of our cybersecurity program and receives quarterly cybersecurity updates from our Chief Information Security Officer (CISO) through written reports and presentations. Our CISO has over 20 years of experience in cybersecurity, and has held senior leadership positions at publicly traded companies in the technology industry, bringing extensive expertise in managing cybersecurity risks. The CISO's leadership team consists of seasoned information security professionals with experience at globally recognized organizations, ensuring a robust and comprehensive approach to cybersecurity oversight.

companyName: SentinelOne, Inc.

ticker: S


text: Cybersecurity threats, including those related to previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect us, our business strategy, operations, or financial condition.

companyName: TRUPANION, INC.

ticker: TRUP


text: Board Oversight of Risks from Cybersecurity Threats Our Board of Directors has delegated to the Audit Committee oversight of risks from cybersecurity threats. The management team provides quarterly reports to the Audit Committee which cover cybersecurity and other information technology-related risks, based on our ERM framework. These quarterly updates keep the Audit Committee apprised of our ongoing cybersecurity enhancements and any emerging global threats. The Audit Committee keeps the remaining Board of Directors apprised of material risks from cybersecurity threats. The Board and management have made cybersecurity education and training a part of our overall corporate objectives, setting the tone for the organization about the importance of cybersecurity.

companyName: AMARIN CORP PLC\UK

ticker: AMRN


text: The Company's policies and practices are based on frameworks and standards that address risks through a comprehensive, cross-functional approach that assess, identify, monitor, and mitigate material risks from cybersecurity threats as part of the overall enterprise risk management ("ERM") process. This includes the collection and storage of data, and being responsive to incidents as they occur. Further, the Company's processes and technology are utilized to develop, implement, and maintain appropriate measures to safeguard information systems in protecting the integrity, availability, and confidentiality of data. Additionally, the Company engages certain third parties to assist in network monitoring and control testing, among other functions of similar capacity.

companyName: Perma-Pipe International Holdings, Inc.

ticker: PPIH


text: Cybersecurity risks are identified through the enterprise risk management (ERM) program as key risks we face. These risks could include use of malicious code, employee theft or misuse, advanced persistent threats, vulnerabilities, fraud attempts, and phishing attacks that could cause, among others, an information technology system failure, or breach or loss of sensitive information. The potential impact of cybersecurity risks on our business operations, results of operations or financial condition is discussed in the " Risks Related to Business Operations " section of Item 1A " Risk Factors." We have not had any material cybersecurity breaches or incidents and have not incurred any material expenses, penalties or settlement costs related to any cybersecurity breaches or incidents. However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.

companyName: WISCONSIN POWER & LIGHT CO


text: Our information security program incorporates a robust cybersecurity risk management strategy. This strategy prioritizes continuous improvement and ensures the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: TurnOnGreen, Inc.

ticker: TOGI


text: We maintain an incident response plan that outlines the steps to be taken in the event of a cybersecurity incident. Pursuant to the incident response plan, the identifying party is required to notify the Company's Chief Financial Officer ("CFO") and Board of Directors of certain cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The incident response plan also includes procedures for: Gathering information about the cybersecurity incident. Consulting with cybersecurity consultants and other parties to assess the cybersecurity incident.

companyName: PERPETUA RESOURCES CORP.

ticker: PPTA


text: Additional Information For additional information on the risks we face related to cyber and information security threats, please see the risk factors in Item 1A. Risk Factors titled "Production at our manufacturing facilities, or at our suppliers', could be disrupted for a variety of reasons, which could prevent us from producing enough of our products to maintain our sales and satisfy our customers' demands" on page 19 and "We are subject to information or operational technology cybersecurity threats that could materially affect our business" on page 22.

companyName: Celanese Corp

ticker: CE


text: Our board of directors has approved management committees including the ITAC, which focuses on technology impact, and ERM, which focuses on business impact while the ITSC is an internal management committee providing direction and priorities to information technology strategies. These committees provide oversight and governance of the technology program and the information security program. The ITAC and ERM are chaired by certain members of the board of directors with senior management participation including the Chief Finance/Information Security Officer, Chief Information Officer, Senior Technology/Cybersecurity Officer as well as other key departmental managers from throughout the organization. These committees meet periodically to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Senior Technology/Cybersecurity Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the ITAC on a quarterly basis (or more frequently as may be required by the IRP).

companyName: First Seacoast Bancorp, Inc.

ticker: FSEA


text: The Company has implemented a set of controls to manage information risk, utilizing controls from multiple security frameworks, specifically ISO 27001, and the Payment Card Industry Data Security Standard (PCI-DSS). The Company also conducts various internal and external information risk assessments each year, which are based on nationally accepted standards, including annual compliance required assessments, such as PCI and SOX audits, as well as ad-hoc assessments driven by emerging risks, changes in the Company's environment, or benchmark/roadmap needs. Risks identified in such assessments are considered for inclusion in the Company's risk portfolio and are then prioritized and addressed as needed through the Company's broader information security programs and policies. The risk assessment along with risk-based analysis and judgment are used to select security controls to address risks. During this process, the following factors, among others, are considered: likelihood and severity of risk, impact on the Company and others if a risk materializes, feasibility and cost of controls, and impact of controls on operations and others. Specific controls that are used to some extent include endpoint threat detection and response (EDR), identity and access management (IAM), privileged access management (PAM), logging and monitoring involving the use of security information and event management (SIEM), multi-factor authentication (MFA), firewalls and intrusion detection and prevention, encryption, and vulnerability and patch management.

companyName: Uniti Group LLC


text: Board of Directors' Oversight of Risks from Cybersecurity Threats The Board of Directors oversees risks from cybersecurity threats. The Board of Directors delegates oversight of our operations risk, including quarterly reviews of cybersecurity and data protection, to the Finance/Risk Management Committee, and delegates compliance with cybersecurity policies to the Audit Committee. Both the Finance/Risk Management Committee and the Audit Committee report to the full Board of Directors on cybersecurity matters. Additionally, on an annual basis, management reviews results from tests of key cybersecurity systems with the full Board of Directors and the steps taken to mitigate new cybersecurity risks which have been identified.

companyName: GROUP 1 AUTOMOTIVE INC

ticker: GPI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. Accordingly, the company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the company's Information Security functional team, senior management, and our board of directors in coordination with the Technology and Information Security ("T&IS") Committee and the Audit Committee of our board of directors. Our cybersecurity risk management function is a component of our overall approach to risk management, including coordination with our Enterprise Risk Management Committee.

companyName: Huron Consulting Group Inc.

ticker: HURN


text: Cybersecurity is among the risks identified by our ERA for Board-level oversight. The Audit Committee of the Board has oversight of information technology controls related to financial reporting, while the Compliance Committee of the Board has oversight of technology-related risk, including privacy and cybersecurity. The Audit Committee and Compliance Committee meet jointly at least annually to review cybersecurity risks and programs, and they are updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile. The chairs of the Audit Committee and Compliance Committee provide updates to the Board after each committee meeting. The CIO/CTO and CISO provide regular updates to the Board, Audit Committee, or Compliance Committee about material risks from cybersecurity threats. The CIO/CTO or CISO also provide regular updates to the Board, Audit Committee or Compliance Committee about cybersecurity trends and regulatory updates, data governance and usage, technology infrastructure, our training and compliance efforts, and implications for our business strategy. In addition to the information provided in these meetings, members of our Board have access to continuing education, which includes topics relating to cybersecurity risks.

companyName: MCKESSON CORP

ticker: MCK


text: Our Board plays a role in overseeing risks associated with cybersecurity threats and has delegated to the Audit Committee primary oversight of the Cybersecurity Program. Our executive officers report on our Cybersecurity Program to both the Board and the Audit Committee at least four times per year (including as part of our discussions regarding enterprise risk management). In addition, quarterly reports to the Audit Committee include our internal auditor's reviews of our information security programs and controls. As part of the incident response plan discussed above, in the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, our executive officers (who are also a part of the Cybersecurity Management Committee) will review the incident with the Audit Committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.

companyName: Sila Realty Trust, Inc.

ticker: SILA


text: We utilize various risk assessment tools and technologies to identify potential cyber and information security threats and risks, including engaging a third-party information technology services provider to perform risk evaluation and testing. In addition, the Company is in the process of implementing a program for all team members to participate in ongoing training and awareness programs that include periodic assessments to drive adoption and awareness of cybersecurity processes and controls.

companyName: KORU Medical Systems, Inc.

ticker: KRMD


text: A primary element of our cybersecurity program is the implementation of controls that are aligned with industry guidelines and applicable regulations to identify threats, deter attacks, and protect our information security assets. We have procedures in place for selecting and managing our relationships with third-party service providers and other business partners, including to monitor compliance with our agreements and regulatory and legal requirements. We also actively engage with industry participants and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: The Board of Directors has oversight responsibility for the Company's strategic and operational risks. The Board has delegated oversight responsibility for certain risks to its committees, including delegation to the Board's Nominating and Governance Committee oversight of the Company's major non-financial reporting enterprise risk assessment and management processes not retained by the Board. However, given the broad and important role of cybersecurity oversight, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board routinely receives reports from the Company's Chief Executive Officer, with the assistance of the Company's IT department, concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.

companyName: BUTLER NATIONAL CORP

ticker: BUKS


text: We engage in an annual enterprise-wide risk assessment process which includes an evaluation of cybersecurity risks. We recognize the critical importance of securing the information of the Company's customers, vendors, and employees and maintaining the security of our systems and data and have developed a comprehensive cybersecurity incident response plan.

companyName: Amcor plc

ticker: AMCR