text: Our Chief Administrative Officer ("CAO") is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CAO leads our security team and coordinates with our Chief Executive Officer, Chief Financial Officer and Information Technology Manager to fully integrate our cybersecurity risk management programs with our overall enterprise risk management program. Our Information Technology Manager CAO is responsible for overseeing and managing all potential and actual incidents that are identified by our security team. Our security team regularly updates our systems with updates, anti-virus signatures, policies and security best practices. At least annually, our CAO reports to the Audit Committee of the Board updates to the Company's cybersecurity risk management program and any material cyber incidents. Our Sr Information Technology Manager has extensive expertise and experience on cybersecurity matters, including identification, remediation, and management..

companyName: 374Water Inc.

ticker: SCWO


text: The Apollo Global Management, Inc. ("AGM") Board of Directors is involved in overseeing Apollo's risk management program, including with respect to cybersecurity, which is a critical component of Apollo's overall approach to enterprise risk management (" ERM "). Apollo's cybersecurity policies and practices are ful into its ERM framework through its reporting, risk management and oversight channels and are based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Apollo Infrastructure Co LLC

secItem: Item 1C


text: We regularly assess risks related to regulatory compliance, technical operations, business operations, and product and contract deliverables. Risks are managed, documented, and tracked as part of operating the ISMS and other processes. Risks are internally assessed and categorized based on perceived likelihood and impact to system confidentiality, integrity, and availability as described by the ISO 27005 Information Security Risk Management international standard. We also engage third party penetration testers, assessors, vendors, and auditors to assist with external network vulnerability scanning, penetration testing, internal audits, external audits, threat intelligence, and employee training activities. Additionally, we utilize a variety of self-hosted and SaaS tools to assist with vulnerability identification, mitigation, and remediation.

companyName: Spire Global, Inc.

ticker: SPIR


text: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.

companyName: MERRIMACK PHARMACEUTICALS INC


text: Any failure to maintain the security of the data, including the penetration of our network security and the misappropriation of confidential and personal information, could result in business disruption, damage to our reputation, financial obligations to third parties, fines, penalties, regulatory proceedings and private litigation with potentially large costs. This scenario may also result in a deterioration of customer confidence in us and potentially other competitive disadvantages. As such, a cyberattack could have a material adverse impact on our financial condition and results of operations.

companyName: Ispire Technology Inc.

ticker: ISPR


text: The results of our SOC2 and PCI assessments are reported to the Cybersecurity Risk Subcommittee. Both the Subcommittee and the Board receive regular reports from our CISO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. The Board also oversees our annual enterprise risk assessment, where we assess key risks within the company, including security and technology risks and cybersecurity threats.

companyName: AGILYSYS INC

ticker: AGYS


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer ("CIO") and are supported by the Senior Director of Enterprise Cybersecurity. These individuals are also supported by both dedicated cybersecurity professionals and third-party security service providers. Our CIO is responsible for leading our technology organization across our global portfolio, which includes ERP, commercial, supply chain, and product development technologies, enterprise architecture, infrastructure, cyber security, technical operations, end-user services, and finance and human resources systems. Our current interim CIO has over 30 years of experience in information technology matters. Our Senior Director of Enterprise Cybersecurity has over 30 years of expanding leadership experience in information technology and 18 years of experience in information security leading and developing security programs. Our CIO provides regular updates on cybersecurity matters to our senior executives. In the event of a cybersecurity incident or incidents, our incident response plan includes detailed processes designed to ensure that information is triaged from our information technology management team to our CIO and to other members of our management team in a timely manner such that senior leadership can assure critical decision support and oversight and otherwise monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics: the Company's Information Security Policy; Information Security Incident Response Plan; HIPAA, PCI Compliance; GDPR and CCPA; Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users; and Phishing. In addition, our developers must complete Secure Code / Secure Application Development Training based on OWASP top 10 standards.

companyName: Consensus Cloud Solutions, Inc.

ticker: CCSI


text: While we have not identified any material cybersecurity threats or incidents in the last year that have had a material adverse effect on our business, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. For more information on our cybersecurity related risks, see "Item 1A. Risk Factors—Risks Related to Our Business – Any actual or perceived failure of the Exodus Platform to block malware or prevent failures or security breaches or other cybersecurity incidents could harm our reputation, cause the Exodus Platform to be perceived as insecure, underperforming or unreliable, impede our efforts to attract and retain users and otherwise negatively impact our business, results of operations and financial condition." of this report.

companyName: Exodus Movement, Inc.

ticker: EXOD


text: The objective of the Company's comprehensive cybersecurity program is to assess, identify, and manage risks from cybersecurity incidents and threats. The Company's cybersecurity program leverages the NIST Framework and it incorporates training and awareness coupled with ongoing monitoring and assessment. The cybersecurity program is an important part of the Company's enterprise risk management (ERM), with the head of the Company's ERM program sitting on the Cyber Committee, and sets forth a process for escalating certain incidents to the Company's ERM group integrated into the Company's Incident Response Plan.

companyName: MOODYS CORP /DE/

ticker: MCO


text: We strive to manage cybersecurity risks and protect sensitive information through various methods, including technical safeguards, procedural requirements, an intensive monitoring program on our corporate network, a robust incident response program, a review of the effectiveness of our security system with reference to applicable security standards by qualified third parties and regular cybersecurity awareness training for employees. We continuously monitor the performance of our apps, platforms and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

companyName: Ezagoo Ltd

ticker: EZOO


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Together with management, the Board has designated an Information Security Group ("ISG") to monitor issues relating to cybersecurity and work with the Investment Adviser's third-party Information Technology ("IT") service provider to evaluate potential cyber risk vulnerabilities. While its composition may change over time, the ISG currently consists of our Chief Financial Officer and Chief Compliance Officer. The ISG, together with the Investment Adviser's third-party IT service provider, annually reviews the cyber risks applicable to our business and the measures established by the Investment Adviser and other service providers to protect against those risks and recommends changes or enhancements, as necessary. The Investment Adviser's management and the third-party IT service provider also monitor the Investment Adviser's network to identify internal and external cybersecurity threats and vulnerabilities in order to determine any steps that should be taken to protect information stored on the Investment Adviser's network and promptly inform the ISG of any identified cybersecurity threats or vulnerabilities. The ISG also makes inquiries of the Investment Adviser's management and the third-party IT service provider regarding such efforts.

companyName: SLR Investment Corp.

ticker: SLRC


text: AGM's CISO, in coordination with the AGM Technology and ERM teams, works collaboratively across AGM to implement a program designed to protect its information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with its incident response and recovery plans. To facilitate the success of AGM's cybersecurity risk management program, multidisciplinary teams throughout AGM are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to AGM's audit committee or AGM Board of Directors, as appropriate.

companyName: MidCap Financial Investment Corp

ticker: MFIC


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have identified and mitigated certain known cybersecurity threats, which we determined are not reasonably likely to materially affect us and have strengthened our cybersecurity ecosystem. However, cybersecurity attack techniques change frequently, and with increased volume and sophistication of such attacks, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents that could materially affect us. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors - Significant disruptions of information technology systems or cybersecurity incidents could adversely affect our business."

companyName: Protagonist Therapeutics, Inc

ticker: PTGX


text: We operate in the engineered materials manufacturing sector, which is subject to various cybersecurity risks that could adversely affect our business, financial condition, and results of operations, including: intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws; and other litigation, legal and reputational risks. We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is aligned with industry standards and best practices, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We conduct periodic risk assessments to identify the potential impact and likelihood of various cyber scenarios, including those involving third-party service providers, and to determine the appropriate mitigation strategies and controls. We use various tools and methodologies to manage cybersecurity risk, including implementation of a business continuity process that includes a comprehensive incident response plan and procedure that is tested on a regular cadence. We also monitor and evaluate our cybersecurity performance on an ongoing basis through regular vulnerability scans, threat intelligence feeds, and penetration tests by an independent third party. We require third-party service providers with access to personal, confidential or proprietary information to implement and maintain comprehensive cybersecurity practices consistent with applicable legal standards and industry best practices. The incident response team, which includes senior IT subject matter experts and security analysts, determines the apparent severity of reported potential incidents, and operationalizes the appropriate incident response plan. In addition, we continue to provide training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide feedback (and, if necessary, additional training or remedial action) to employees. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures should they occur.

companyName: Magnera Corp

ticker: MAGN


text: We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis.

companyName: MOOG INC.

ticker: MOG-A


text: Members of the Company's Information Security and Privacy team have an average of more than 20 years of information security and compliance experience, spanning diverse environments and industries, government agencies, and public and private companies. All members of the core team maintain cybersecurity certifications and attend regular training programs relating to information security, privacy and compliance.

companyName: Graham Holdings Co

ticker: GHC


text: We have established and test our disaster recovery plan and we protect against business interruption by backing up our major systems. Our cybersecurity team engages third-party security experts for risk assessment and system enhancements, including a third-party security consultant that conducts regular network security reviews, scans and audits. In addition, we maintain various preventive measures, such as protections designed to safeguard against cyberattacks, including employee training, multifactor authentication, firewalls and virus detection software, periodic scans of our environment for any vulnerabilities and penetration testing.

companyName: Progyny, Inc.

ticker: PGNY


text: For a discussion of risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors, of this Annual Report on Form 10-K.

companyName: Air Products & Chemicals, Inc.

ticker: APD


text: Our Trust Engineering team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Trust Engineering regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cybersecurity incidents are escalated to our Vice President of Trust Engineering, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.

companyName: ROKU, INC

ticker: ROKU


text: The Board of Directors has oversight of the cyber security risk management and strategy. The senior leadership, including our Chief Executive Officer and Chief Financial Officer, regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our Chief Executive Officer and Chief Financial Officer are responsible for implementing and maintaining our cybersecurity risk assessment and management processes.

companyName: TABLE TRAC INC

ticker: TBTC


text: Oversight of Board of Directors The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities. The board of directors receive updates on the Company's cybersecurity risks and protective measures periodically. Cybersecurity matters are reported to the board of directors so that the board of directors can effectively carry out their oversight role.

companyName: Global Self Storage, Inc.

ticker: SELF


text: Our information security team has designed and implemented formal processes for assessing, identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. Ball has strategically integrated its cyber incident assessment process with its well-defined incident response plan and processes.

companyName: BALL Corp

ticker: BALL


text: Upon detection, we immediately purged and rotated credentials across all critical systems, enforced company-wide multi-factor authentication, closed orphaned accounts, and moved registrar and DNS administration under centralized secure access controls. We also hardened email authentication (SPF, DKIM, DMARC), implemented registry-level domain locks and DNSSEC, and completed a secure migration of domain and DNS records to a new registrar environment.

companyName: TREASURE GLOBAL INC

ticker: TGL


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Detection and Analysis. Cybersecurity incidents may be detected through a variety of means, which include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by our security operations team, as well as notifications from employees or third-party providers. Once a cybersecurity incident is identified, including third-party cybersecurity events, our incident response team investigates the incident, determines the nature of the event and assesses the severity of the event and sensitivity of any compromised data.

companyName: FRANKLIN RESOURCES INC

ticker: BEN


text: Cybersecurity risk management is an important part of our overall risk management efforts. Our industry is prone to cybersecurity threats and attacks, and we regularly experience cybersecurity incidents of varying degrees. At any given time, we face known and unknown cybersecurity risks and threats that are not fully-mitigated, and we discover vulnerabilities in our Cybersecurity Program. We continuously work to enhance our Cybersecurity Program and risk management efforts. As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations and financial condition.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Additionally, our virtual Chief Information Security Officer ("vCISO") compiles a quarterly executive summary of third-party risk, which is presented to both management and the Board. This summary ensures that leadership is informed of the current risk landscape and can make data-driven decisions regarding third-party engagements.

companyName: TRANSCAT INC

ticker: TRNS


text: While our board of directors has oversight responsibility for risk management generally, the Audit Committee is specifically responsible for overseeing our cybersecurity risk management program to ensure cybersecurity risks are identified, assessed, managed, and monitored. Our Executive Director, Information Technology, who has over 15 years of experience in the cybersecurity field, provides periodic updates to the Audit Committee in this regard, and details our cybersecurity program supported by key performance indicators across the range of cybersecurity functions related to risk management and governance, identity and information asset protection, core security and endpoint security, and cyber threat operations. These updates include descriptions of cybersecurity incidents, including those associated with our third-party service providers. The Audit Committee is responsible for updating our full board of directors on material risks from cybersecurity incidents or threats.

companyName: ASSEMBLY BIOSCIENCES, INC.

ticker: ASMB


text: Our cybersecurity-related risks are managed through monitoring, defense and response tools, audits and assessments of the program's effectiveness, industry collaboration, and employee training and awareness. WEC Energy Group's cybersecurity risk management program utilizes the cybersecurity framework and maturity models from the National Institute of Standards and Technology and the United States Department of Energy to continually assess its maturity. This includes regular internal security audits and vulnerability assessments, as well as regular engagement with third-party security experts for external assessments of WEC Energy Group's security controls, including technical, physical, and social aspects. To better comprehend the scope and magnitude of any active threats to our industry and nation and their potential impact on our IT/OT systems, we communicate with other utility companies, government agencies, and other sectors of the economy concerning cybersecurity incidents. All employees are required to complete training annually regarding information security and acceptable use of corporate electronic resources. Annual role-based cybersecurity training as well as ongoing participation in a corporate phishing campaign program, is also required of employees and contractors. In addition, as part of the cybersecurity program, WEC Energy Group has established controls and procedures to assess the adequacy of controls in place at third-party vendors to protect our corporate information, including restricted and confidential restricted information we provide to third-party vendors, their employees, or authorized agents. These third-party vendors are also subject to a background investigation prior to being granted physical or electronic access to the company's private property, or physical access to customer premises on behalf of the company.

companyName: WISCONSIN PUBLIC SERVICE CORP


text: Our CIO and our Vice President of Information Security are principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across company. Our CIO serves as Chair of our Cybersecurity Incident Materiality Assessment Council and works in coordination with the other members of our Executive Committee.

companyName: VAIL RESORTS INC

ticker: MTN


text: Our Chief Information Officer ("CIO") is responsible for assessing and managing cybersecurity risks in collaboration with the Senior Director of IT Governance, Service Delivery and the Senior Director of Global Infrastructure, and Senior Information Security Architect, who manage our day-to-day cybersecurity-related matters and keep abreast of cybersecurity news, events and incidents through regular course monitoring and updates. These individuals average over 25 years of professional experience in various roles across multiple industries involving managing information security, developing cyber security strategy, implementing cybersecurity programs, and managing multiple industry and regulatory compliance environments (including over 15 years of collective experience working for public companies in similar roles prior to joining the Company). Our Senior Information Security Architect has several information technology-related certifications, including as a Certified Information Systems Security Professional ("CISSP").

companyName: Sotera Health Co

ticker: SHC


text: These measures are to be seamlessly integrated into our broader operational risk management framework aimed at minimizing exposure to unnecessary risks across our operations.

companyName: INSPIRE VETERINARY PARTNERS, INC.

ticker: IVPR


text: From time-to-time, we may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate. We prioritize the integrity of our data access controls to prevent unauthorized access, data breaches, and malicious activities. We regularly assess and enhance our cybersecurity posture through comprehensive risk assessments, security audits, and vulnerability assessments. is a shared responsibility requiring collaboration and cooperation across all levels of our organization.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: Part I Item 1A, 1B, and 1C establishing the security and reliability risk strategy, setting policies, monitoring controls and compliance, providing support activities, and reporting on the security program. The Chief Information Security Officer (CISO) is responsible for establishing the cybersecurity strategy and implementing physical and cyber security systems for the security program. The Chief Ethics & Compliance Officer works with the CSO to address requirements of external security-related regulations, and where applicable, incorporate them into business policies. Management is responsible for identifying and managing risk directly through execution of the security program and compliance with security policies. Entergy and the Registrant Subsidiaries' risk management model addresses compliance with certain regulatory constructs, such as the NERC Reliability Standards, the NRC Code of Federal Regulations, the Payment Card Industry Data Security Standard, and the Health Insurance Portability and Accountability Act, among other regulations. Entergy and the Registrant Subsidiaries' risk management model continuously evolves to improve and implement protections, controls, and monitoring to mitigate risks to their part of North America's electric grid, to protect sensitive information, and to maintain secure business operations. Entergy and the Registrant Subsidiaries manage cybersecurity threats as an enterprise risk with close coordination and information sharing with its federal, state, and local partners. Entergy and the Registrant Subsidiaries also engage with local, state, and federal law enforcement agencies on initiatives to share threat information and participate in a wide range of industry collaborations and classified briefings on cybersecurity developments and evolving risks.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The processes by which our Senior Director, Information Protection & Compliance and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes the following: bimonthly management committee on cybersecurity meetings, formal e-mail notifications, and CIO updates as part of regular Executive Officer meetings.

companyName: HAWAIIAN HOLDINGS INC


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Committee members receive presentations on cybersecurity topics from our Senior Vice President, Information Technology & Facilities, internal security staff or external experts as part of the Committee's continuing education on topics that impact public companies.

companyName: 4D Molecular Therapeutics, Inc.

ticker: FDMT


text: While we devote resources to implement and maintain security measures to protect our systems and data, these measures cannot provide absolute security against a cyberattack. In such an event, the insurance coverage we maintain may be inadequate to cover claims, costs, and liabilities relating to cybersecurity incidents.

companyName: Ispire Technology Inc.

ticker: ISPR


text: Our IT department and Company management work together to check and improve our safeguards as part of our overall risk management system. We also periodically provide training to our employees on these safeguards and keep them informed of our cybersecurity policies through regular communications across the Company.

companyName: 89bio, Inc.


text: Our cybersecurity policies, standards, processes, and practices are integrated across our operational risk management programs and are based on recognized frameworks. A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.

companyName: INSEEGO CORP.

ticker: INSG


text: Further, our Vendor Code of Conduct addresses our expectations with respect to data security. When our Procurement group processes a vendor relationship involving information systems, various groups will review the vendor and its systems for potential data security-related issues and risks associated with using the tools, technology, data processing and other services of such vendor. Our contracts include terms addressing the safeguarding of our data.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and provides regular updates to our Board of Directors regarding such oversight. The Audit Committee regularly meets with members of management responsible for data privacy, technology, and information security risks to discuss these risks, risk management activities, incident response plans, best practices, the effectiveness of our security measures, and other related matters.

companyName: CarGurus, Inc.

ticker: CARG


text: The Chief Technology Officer of the Manager has served in various roles in information technology and information security for over 30 years, including as one of the original architects of the business, operations, systems and information technology infrastructure in the institutional SFR homes sector with large investors in the VineBrook Companies since 2010. The Chief Technology Officer of the Manager holds an undergraduate degree in computer science/programming and a masters degree in business administration (MBA). In addition, he has been an educator, speaker, and published author on several technology related topics including cybersecurity, artificial intelligence, machine learning, geographic information systems, database architecture, and business intelligence. The Director of IT Operations of the Manager has over 25 years of experience in network designs, information technology operations management and cybersecurity and has completed various certifications from Microsoft, Fortinet, Qualys, Agile, Kaseya, Veeam, and CompTIA. In addition to our cybersecurity policies, standards, processes and practices, our Adviser maintains cybersecurity policies, standards, processes and practices that are based on recognized security frameworks such as the National Institute of Standards and Technology cybersecurity framework and the Azure Security Benchmark. Our Adviser deploys technical safeguards that are designed to protect our Adviser's information systems from cybersecurity threats and completes internal and external assessments to identify potential cybersecurity threats and vulnerabilities and to identify and oversee cybersecurity risks presented by third parties. The Adviser's Director of Information Technology, in coordination with relevant personnel of the Adviser, work to conceive, implement, and monitor the effectiveness of a program designed to protect their information systems from cybersecurity threats and to promptly respond to any security incidents. The Adviser's Director of Information Technology will promptly notify the Adviser's General Counsel and senior management, including our President, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.

companyName: VINEBROOK HOMES TRUST, INC.


text: Our Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our guests, business partners, associates and other stakeholders, and the processes implemented to address the risks related to cybersecurity threats are an important part of our overall risk management efforts. More specifically, we seek to address cybersecurity risks by focusing on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our cybersecurity program focuses on the following key areas: • Governance/Board-Level Oversight: Our Audit Committee is briefed on cybersecurity risks as a standing agenda item at each regularly-scheduled quarterly meeting. The Chief Information Officer ("CIO") reports quarterly to the Audit Committee and such report typically addresses an overall assessment of our compliance with our cybersecurity policies and includes topics such as risk management and control decisions, updates on our cybersecurity roadmap and self-assessment, training results, security threats, incidents (if any) and responses, and recommendations for changes and updates to our policies and procedures. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, 24x7 monitoring by a third party security operations center, and antimalware functionality and access controls, which are periodically evaluated through vulnerability assessments and cybersecurity threat intelligence. • Business Continuity and Disaster Recovery: We have established and maintain comprehensive business continuity, incident response and recovery plans that address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for our associates regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our information security policies, standards, processes and practices.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our risk assessment process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary oversight of management's enterprise risk assessment and risk management policies and practices, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.

companyName: Capri Holdings Ltd

ticker: CPRI


text: As of December 31, 2024, we have not identified an indication of a cybersecurity incident that would have a material impact on our business and consolidated financial statements.

companyName: iQSTEL Inc

ticker: IQST


text: Cyberattacks represent a potentially significant risk to the Company and our industry. We rely on subsidiaries of Cheniere through our service agreements with them, as further discussed in Note 13—Related Party Transactions of our Notes to Consolidated Financial Statements, and Cheniere's board of directors (the "Board"), which has oversight of our operations, to implement policies and procedures that are intended to manage and reduce this risk.

companyName: Cheniere Corpus Christi Holdings, LLC


text: Our CSIRP is designed to guide our incident response process for cybersecurity incidents that could affect our systems, network, or data. The CSIRP identifies the individuals responsible for developing, maintaining, and following appropriate procedures related to identified cybersecurity incidents, including a framework for identifying and addressing material cybersecurity incidents. We periodically test our CSIRP using tabletop exercises with the goal of improving our processes and preparedness.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, and our prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.

companyName: CUMMINS INC

ticker: CMI


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: Risk Assessment Procedures: We conduct periodic risk assessments to identify potential cybersecurity threats and vulnerabilities within our IT infrastructure. These assessments are conducted using various software tools and methodologies that enable us to evaluate our systems critically and comprehensively. Our risk assessment process includes the analysis of: Hardware and software configurations; Network and data access protocols; Encryption standards; and Compliance with relevant industry and regulatory standards.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the subsection titled " Our information systems, or those of others upon whom we rely (such as our CROs, contract manufacturers, contractors, consultants, service providers, collaborators and others) may fail or suffer cybersecurity breaches, loss or leakage of data or other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business, or prevent us from accessing critical information, potentially exposing us to liability that could adversely affect our business. "

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: We do not store any customer data input during the reservation process. The customer reservation systems are specified, implemented, and managed by the global hotel brands.

companyName: PROCACCIANTI HOTEL REIT, INC.

ticker: PRXA


text: Our cybersecurity risk management program is led by our Chief Information Officer ("CIO"), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. The CIO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks. We continue to secure our own manufacturing and information technology infrastructure; to train our employees throughout each year about malware, viruses, hacking, phishing, and other information security risks, including how to avoid and mitigate them; and to protect our sensitive data from failures, breaches, or cyber incidents. We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.

companyName: Kimball Electronics, Inc.

ticker: KE


text: The risk identification process includes: (i) identifying information systems and assets, including physical and virtual devices, software, data, data transfers, external systems, and cloud resources; (ii) reviewing organizational business processes, identities, access, and roles (including privileged access), asset configurations, technology policies, standards, controls, and processes; (iii) analyzing the criticality of assets and business processes and sensitivity of data; and (iv) identifying vulnerabilities and threats to the identified assets, data, and processes, from both internal and external sources, including threat intelligence, previous cybersecurity incidents, and third-party assessments.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such material risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from new features, software, and vendors; (3) a vulnerability management program designed to identify hardware and software vulnerabilities; (4) an internal red team program, which simulates cyber threats, intended to allow us to address vulnerabilities before threat actors identify them; and (5) a threat intelligence program designed to model and research our adversaries. These processes vary in maturity across the business and are processes we work to continually improve.

companyName: DROPBOX, INC.

ticker: DBX


text: The Company's Information Security Policy and Standards details a process for responding to cybersecurity events. Awareness and alertness are important components of the Company's cybersecurity program; each year employees are required to take the cybersecurity training and the Company conducts regular exercises to educate employees about best practices and help them identify and avoid potential threats.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: As part of the administration of our Cybersecurity Risk Mitigation Practices, the Committee is tasked with managing and mitigating our exposure to cybersecurity threats, creating our cybersecurity policies, and establishing short and long-term cybersecurity goals and objectives that are designed to protect our information systems. The Committee is also responsible for planning ordinary course security projects and initiatives aimed at ensuring that our organizational leaders are informing our employees about our cybersecurity policies and about cybersecurity basic practices. On a periodic basis, the Committee meets to review the performance and effectiveness of our Cybersecurity Risk Mitigation Practices.

companyName: PC CONNECTION INC

ticker: CNXN


text: The board of directors receives periodic updates from certain members of the cybersecurity team concerning the Company's significant cybersecurity threats and risk and the processes we have implemented to address them. The audit committee and board also have access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Personalis, Inc.

ticker: PSNL


text: The Board's oversight of cybersecurity risk is supported by our CISO and Cybersecurity Manager. The CISO and the Cybersecurity Manager attend Board Risk Committee meetings, periodically provides cybersecurity and other information security updates to the Board Risk Committee. The CISO also provides an annual information security program summary report to the Board, outlining the overall status of our information security program and the Company's compliance with regulatory guidelines.

companyName: FIRST BANCSHARES INC /MS/


text: Tyler is committed to remaining vigilant in an ever-changing security environment. Our public sector clients are attractive, data-rich targets for threat actors. We partner closely with our clients to assist them in following evolving best practices, and constantly evaluate our own policies and procedures to help ensure that we are implementing safeguards that protect their data and ours.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Cyber Risk Management and Strategy the oversight of the Board of Directors since we do not currently have an Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our IT security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident.

companyName: SHOREPOWER TECHNOLOGIES INC.

ticker: SPEV


text: In the ordinary course of business, our board of directors receives quarterly updates from the CISO regarding the Information Security Program and compliance with relevant regulations, as described above. Members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis. Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management. If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or Audit Committee sooner than its next quarterly update. See the section entitled "Part I, Item 1. Business—Risk Management" for additional information on the role of our board of directors and its committees in overseeing risk management.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our cybersecurity program engages third parties when necessary. In the past, we have had cybersecurity incidents and we have made, and continue to make investments, seeking to address these threats, including monitoring of networks and systems, hiring of experts to evaluate and test our systems, employee training and security policies for employees and third-party providers. All third parties that we use have been vetted and have deep experience and strong reputations in the industry. As such, controls from the third-party vendors have been deemed to be adequate prior to any goods or services having been provided.

companyName: ALLIENT INC

ticker: ALNT


text: Additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, are included in this Annual Report on Form 10-K in Item 1A, "Risk Factors".

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Risk management in software development involves identifying, assessing, and mitigating risks that could impact the project's success. This strategy begins with a thorough risk identification process, where potential issues such as technical challenges, project scope changes, and resource constraints are recognized early. Each risk is then assessed for its probability of occurrence and potential impact on the project. Based on this assessment, risk mitigation strategies are developed and implemented. These strategies might include adopting flexible project management methodologies like Agile, investing in training for team members, implementing robust testing and quality assurance processes, and maintaining open communication channels with all stakeholders. Additionally, regular risk reviews are conducted throughout the project lifecycle to ensure that new risks are identified and managed promptly.

companyName: iCoreConnect Inc.


text: Role of the Board of Directors The Audit Committee and the Board of Directors are responsible for the oversight of cybersecurity risk. The Audit Committee and Board of Directors receive periodic updates from management on the Company's cybersecurity program, threats, and defense measures implemented. Additionally, our Senior Vice President of Information Technology ("SVP - IT") provides updates to the Board of Directors on an as needed basis with respect to cybersecurity risks or any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such cybersecurity incident until it has been remediated.

companyName: Hillman Solutions Corp.

ticker: HLMN


text: Our management team has established a cybersecurity crisis management team, led by our CIO and CISO, that includes other members of management depending on the origin, severity and other factors related to any cybersecurity incident identified. The cybersecurity crisis management team is responsible for communication of significant incidents to the Board and provides updates to the Board through incident resolution. Materiality of incidents are evaluated and determined by our cyber incident disclosure committee that includes certain cybersecurity crisis management team members and which may receive input from relevant stakeholders.

companyName: HERC HOLDINGS INC

ticker: HRI


text: Management's Role Managing Risk and Reporting to the Board of Directors Our Chief Information Officer ("CIO") and Chief Executive Officer ("CEO") play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee at their meetings on a regular basis. These briefings encompass a broad range of topics, including: • current cybersecurity landscape and emerging threats; • status of ongoing cybersecurity initiatives and strategies; • incident reports and learnings from any cybersecurity events; and • compliance with regulatory requirements and industry standards. In addition to the scheduled meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. In addition, the Audit Committee conducts an annual review of our cybersecurity posture and the effectiveness of our risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: ZimVie Inc.


text: In the post-incident phase, the Bank analyzes the root cause of the incident, identifies any changes that need to be made to policies, procedures, training, documentation, and technology to protect against similar incidents in the future, and institutes a plan to implement them. In addition, the Bank undertakes any additional communication with the necessary parties and the public, if appropriate, and the Bank's legal representatives, insurance provider, law-enforcement authorities, and regulatory bodies as appropriate to fully address the impact of the incident, and fully documents the entire incident.

companyName: ESSA Bancorp, Inc.


text: We have certain processes for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our enterprise risk management processes. Specifically, we have processes for: • Identifying and Managing Cybersecurity Risks — We have implemented a cross-functional approach to assessing, identifying and managing material cybersecurity threats and incidents. We periodically review, assess, update and test our policies, standards, processes and practices in a manner intended to address cybersecurity threats and events. The results of such reviews, assessments and tests are evaluated by management and reported to our Audit Committee of the Board of Directors, or the Audit Committee, and our Board of Directors. • Technical Safeguards — We have integrated cybersecurity into our overall information technology operations and designed our processes and systems to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack as well as secure our networks and systems. • Incident Response and Recovery Planning — To better facilitate our cybersecurity program, our cybersecurity team works collaboratively across our Company to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents. We conduct periodic tabletop exercises, including incident simulations to test these plans and ensure personnel are familiar with their roles and responsibilities in a response scenario. • Third-Party Risk Management — We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties and the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems. Also, we engage certain external cybersecurity firms to enhance our cybersecurity oversight and cybersecurity breach detection over third party service providers. • Education and Awareness — We provide training regarding cybersecurity threats as a means to equip our employees and consultants with tools to make employees and consultants aware of and to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.

companyName: Akebia Therapeutics, Inc.

ticker: AKBA


text: Our framework is built around the following key principles: (i) risk assessment and threat intelligence; (ii) security controls; (iii) incident response; (iv) employee awareness and training; and (v) third-party risk management. We have integrated our cybersecurity framework into our broad enterprise risk management processes, which allows us to leverage our existing enterprise-wide experience in managing risk and adapting to change in the cybersecurity threat landscape.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: The Board of Directors and Audit Committee oversee the management of risks by the Company's management. The Audit Committee is responsible for reviewing the Company's cybersecurity program and risks, as identified by Company management, and the steps that Company management has taken to protect against threats to the Company's assets including information systems and data security. The Audit Committee provides updates to the Board approximately annually.

companyName: ORAGENICS INC

ticker: OGEN


text: We recognize the importance of effectively managing material risks associated with cybersecurity threats, as defined in Item 106(a) of Regulation S-K. Our risk management program integrates the monitoring and management of these risks and threats and is informed by applicable laws, regulations, industry standards, and best practices. We continue to invest in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats.

companyName: Hyperscale Data, Inc.

ticker: GPUS


text: As a multi-line insurance company, our business operations rely upon secure information technology systems for data processing, storage, and reporting. We maintain a cybersecurity risk management program based on recognized standards like the National Institute of Standards and Technology Cybersecurity Framework, other industry standards, and contractual requirements. The Chief Information Security Officer (CISO) oversees the cybersecurity program, which includes employee education, proactive threat investigation, prompt response to potential incidents, third party service providers, and other facets of a cybersecurity risk management program. Despite security and controls design, the information technology systems could become subject to cyberattacks. Unauthorized access to or unintentional dissemination of confidential, highly sensitive customer, employee, or company data through breach in our facilities, networks, or databases, or those of our agents or third-party information technology and software vendors, could result in loss or theft of assets or operational disruption. During the last fiscal year, we did not identify any material effect from actual or risks of cybersecurity events.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: The assessment of cyber risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our enterprise risk management program. We strive to implement cyber policies, standards, processes, and controls for assessing, identifying, and managing material risks from cyber threats and responding to cyber attacks that are aligned with industry best practices.

companyName: RCI HOSPITALITY HOLDINGS, INC.

ticker: RICK


text: The Company uses a cross-functional approach to identify, prevent, and mitigate cybersecurity threats and incidents. We have established controls and procedures for the timely escalation of cybersecurity incidents, so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our Cybersecurity Incident Response Plan outlines the steps the Company will take to respond to a cybersecurity incident, and includes an Incident Response Team ("IRT") responsible for addressing and coordinating all aspects of the Company's response to cybersecurity events. The IRT follows established procedures for addressing unauthorized access to confidential information and may consult external experts, including legal counsel. An escalation process helps ensure appropriate reporting at both the management and Board of Directors levels.

companyName: First Financial Northwest, Inc.


text: To mitigate cybersecurity risks, the Company has designed and implemented a Cybersecurity and Information Security Program ("Cybersecurity Program"), which is managed and executed by our Chief Information Security Officer ("CISO"). Our CISO has over 20 years of experience in information technology and cybersecurity primarily focused in the financial services industry. Our CISO is an experienced professional in technology, security, risk management, and compliance principles related to most United States and global financial services related regulations. Also, our CISO holds and maintains an active Certified Information Systems Security Professional certification as well as other relevant technical certifications. The Board of Directors of the Company (the "Board") generally oversees management's processes for identifying and mitigating risks we are exposed to, including cybersecurity risks, to help align our risk exposure with our strategic objectives, and has delegated specific oversight of cybersecurity risk management to the Board's Audit Committee. At least on a quarterly basis, or more frequently as may be warranted, the Board and the Audit Committee are apprised of cybersecurity incidents, if any, and initiatives related to any identified heightened risks. In addition, the CISO provides a comprehensive annual report on cybersecurity as well as quarterly updates to the Audit Committee, the Board and Internal Technology Steering Committee ("IT Steering Committee"), which is composed of members from our Executive Management team and key Information Technology ("IT") personnel.

companyName: International Money Express, Inc.

ticker: IMXI


text: Oversight by Key Principals The Key Principals are the sole managers of ExchangeRight, which is the sole member and manager of our Trustee, and, accordingly, act as the directors of the Company. The Key Principals oversee management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. The Key Principals are acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Key Principals are committed to effective governance in managing risks associated with cybersecurity in order to uphold operational integrity and stakeholder confidence.

companyName: ExchangeRight Income Fund


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: risk assessments, incident detection and response policies, network security controls for certain systems (including as applicable data segregation, data encryption, access controls, physical security, and systems threat monitoring), disaster recovery and business continuity plans, vendor risk management program, and dedicated cybersecurity staff and employee training.

companyName: SPRUCE BIOSCIENCES, INC.

ticker: SPRB


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our chief information officer has primary oversight of material risks from cybersecurity threats. Our chief information officer has more than 25 years of experience across various engineering, business and management roles, including leading the development and implementation of information technology strategies and roadmaps for manufacturing automation.

companyName: AAON, INC.

ticker: AAON


text: The Cyber Disclosure Procedure establishes a flexible and context-dependent process for determining whether an Incident constitutes a material issue pursuant to the rules and regulations of the SEC. A committee of senior management personnel is established to assess potential Incidents. Standing members of the Cyber Disclosure Committee ("CDC") include the President and Chief Executive Officer, Chief Financial Officer, General Counsel, Global Privacy Officer and Chief Technology Officer.

companyName: ROBERT HALF INC.

ticker: RHI


text: We employ a governance framework that facilitates awareness, oversight accountabilities and risk management activities across the business. This framework includes oversight by the Privacy and Cybersecurity Committee of our Board of Directors, which reviews the effectiveness of the Company's governance and management of information technology risks, including those relating to business continuity, cybersecurity, regulatory compliance and data management. Members of the Privacy and Cybersecurity Committee have broad ranges of expertise and experience in information technology and security. Our chairman of the committee has over twenty years of experience in the field of information security management, having previously held various management and executive-level positions specializing in data center infrastructure and cloud usage, IT systems, consumer identity systems, and back office platforms, The Audit Committee of our Board of Directors is responsible for oversight of our disclosures with respect to cybersecurity incidents or breaches and related compliance matters. In addition to oversight by our Board of Directors and other committees, management meets at least quarterly to consider cybersecurity threats or incidents and the impact they may have on our results of operations. Cybersecurity threats or incidents are considered on both a stand alone and aggregate basis to properly assess the impact of such events and the need for disclosure on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity incidents. To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected our business strategy, results of operations, or financial condition.

companyName: HireRight Holdings Corp


text: Our CISO, CIO, and General Counsel collectively have over 35 years of business experience managing risks from cybersecurity threats and developing and implementing cybersecurity policies and procedures. Team members who support our information security program have relevant educational and industry experience.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors–Cybersecurity, Privacy, Intellectual Property, and Technology Risks" in this Annual Report on Form 10-K.

companyName: Remitly Global, Inc.

ticker: RELY


text: Because our business involves the collection, use, storage, and transmission of personal information, we are subject to numerous federal, state, local, and foreign laws, regulations, and other obligations relating to privacy and data security. Countries around the world have adopted or are proposing similar laws and regulations relating to privacy and data security, and we may become subject to them as we expand our operations into new geographic markets.

companyName: Unity Software Inc.

ticker: U


text: Our reliance on third-party service providers, who manage their own IT security, introduces additional vulnerabilities. These providers play a crucial role in securely handling and storing our sensitive data. Despite setting specific security requirements, we do not control their cybersecurity investments or operational security. Any security lapses on their part could potentially disrupt their services and, by extension, negatively impact our financial health and operational efficiency.

companyName: Crypto Co

ticker: CRCW


text: We are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Our criteria for determining the materiality of cybersecurity incidents includes assessing potential or actual financial impacts, reputational damage, and operational disruptions. In the event of a cybersecurity incident, all material and known facts would be recorded, including their nature, scope and financial implications; and Form 8-K filings required in relation to any material cybersecurity incident would be prepared and timely filed (with any reasons for delayed disclosures being documented in writing). The Company believes these steps will help ensure compliance with SEC requirements and maintain overall stakeholder confidence in the Company.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on our Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors," under the heading "Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures."

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: Reporting to Board of Directors The CISO regularly informs the Cybersecurity Executive Steering Body of cybersecurity risks and incidents. Accordingly, the highest levels of management are informed of the cybersecurity position and risks, and significant cybersecurity matters are elevated to the Audit Committee of the Board of Directors.

companyName: MSA Safety Inc

ticker: MSA


text: Our cybersecurity risk management processes are integrated into our overall risk management system. Our Board of Directors is responsible for the overall supervision of our risk management activities. The Board's oversight of the material risks faced by us occurs at both the full board level and at the committee level. In addition, the Audit and Compliance Committee has primary oversight responsibility regarding our information security, data security, data privacy, and other cybersecurity programs, procedures and risks. Further, the Audit and Compliance Committee and our Board of Directors receive updates at least quarterly from management, including our Chief Information Security Officer, or the CISO, covering our programs for managing cybersecurity risks, including data privacy and data protection risks. Additionally, the Audit and Compliance Committee and the Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.

companyName: COMMUNITY HEALTH SYSTEMS INC

ticker: CYH


text: Our operations are highly dependent on the information systems and technology of Fortress, the indirect affiliate of our Adviser, which has implemented a cybersecurity management program. Below are details Fortress has provided to us regarding its cybersecurity program that are relevant to us. The Company uses Fortress's cybersecurity program to assess, identify and mange material cybersecurity risks affecting the Company and its operations.

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: The Board, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by the Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.

companyName: HERON THERAPEUTICS, INC. /DE/

ticker: HRTX


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives period reports from management or Connetic on our cybersecurity risks and cybersecurity risk management program. Our Board receives presentations on cybersecurity topics from Connetic as part of the Board's continuing education on topics that impact public companies.

companyName: Peakstone Realty Trust

ticker: PKST


text: Our IT Lead is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: Tempest Therapeutics, Inc.

ticker: TPST


text: To support our preparedness, we have constituted a Cybersecurity Review Committee ("CRC") and adopted a written cybersecurity incident response plan ("CIRP"). In the event of a cybersecurity incident, our CRC refers to our CIRP and existing management internal controls processes. Pursuant to these prescribed processes, designated personnel are responsible for assessing the severity of the incident and any associated threats, containing and resolving the incident as quickly as possible, managing any damage to the Company's systems and networks, minimizing the impact on the Company's stakeholders, analyzing and executing upon reporting obligations, escalating information about the incident to senior management and potentially representatives from the Board, as appropriate, and performing post-incident analysis and program enhancements, as needed. We perform tabletop exercises to test our incident response procedures, identify cybersecurity gaps and vulnerabilities and improvement opportunities and exercise team preparedness.

companyName: RELIANCE, INC.

ticker: RS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Director of Information Technology/Information Security, internal legal counsel, Chief Compliance Officer ("CCO"), and Chief Financial Officer ("CFO"). Our Senior Director of Information Technology/Information Security has over ten years of experience in information technology and security, and previously held positions such as Associate Director of Informational Technology and Operations, Senior Manager of Informational Technology, and similar roles at other companies.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and current industry recognized cybersecurity certifications.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: installation of updates and patches as they are available and maintaining the current versions of major software to reduce the exposure necessary, the use of third-party security experts if and when an incident is detected are not aware of having experienced any material cybersecurity incidents. We are no t aware of any existent cybersecurity threats that would materially affect, or are reasonably likely to materially affect, our business strategy, results of operations or financial conditions.

companyName: Nano Nuclear Energy Inc.

ticker: NNE


text: Index to Financial Statements We also maintain an Incident Response Plan/Policy to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The Incident Response Plan/Policy is tested with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis. We utilize a third party Security Information and Event Management ("SIEM") service to collect, analyze, and correlate security logs and events from various sources across the Piedmont corporate and property networks to detect and respond to cyber threats in real-time. This service coordinates with the IT support team to contain threats and reduce impact. Verified cybersecurity incidents, should they occur, are reported to IT management and trigger response protocols detailed in the Incident Response Plan/Policy.

companyName: Piedmont Realty Trust, Inc.

ticker: PDM


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. Delek collaborates with third-party vendors to leverage managed security services, enhancing Delek's cybersecurity capabilities. Delek possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.

companyName: Delek US Holdings, Inc.

ticker: DK


text: Management has appointed a Cybersecurity Incident Response Team (the "CSIRT") which is operationally responsible for coordinating, executing, and managing cybersecurity incident response activities. The CSIRT is comprised of experienced information security personnel from our Information Technology team. The CSIRT's responsibilities include, among other things, incident identification and escalation to designated members of management. Among the designated members of management who are required to be notified are our Chief Executive Officer and our Chief Financial Officer.

companyName: SUPERNUS PHARMACEUTICALS, INC.

ticker: SUPN


text: We rely heavily on our information technology ("IT") systems across various aspects of our operations, from product development to customer relations. Given the innovative nature of our business, particularly in the realms of smart glass and fiber optics, ensuring the security, integrity, and availability of data is paramount. We operate in an environment where the protection of intellectual property and sensitive data, including proprietary technology information and customer data, is critical. We are therefore committed to a comprehensive cybersecurity strategy that encompasses not only compliance with relevant privacy laws but also proactive risk management.

companyName: Crown Electrokinetics Corp.

ticker: CRKN


text: Both the CIO and CISO regularly report to the Audit Committee, Board and Governance and Compliance Committee, on the company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2023, the Board reviewed the company's cybersecurity program and maturity assessment, while the Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks at five committee meetings during the course of the year. With respect to specific incidents, the company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CISO, along with the company's senior leadership, including the finance and legal functions. In the event of a potentially material cybersecurity incident, the Audit Committee would be immediately notified and briefed.

companyName: Corteva, Inc.

ticker: CTVA


text: Selected Management and Director Qualifications The HIS and HIT have both served in various roles in information technology and information security for many years, including serving in similar roles at other publicly traded companies. The HIS holds several industry accreditations, including being a certified Chief Information Security Officer, and has worked in the information technology field for over 25 years, specializing in Information Security for the last 15 years. The HIT has an undergraduate degree in computer science and business administration and has worked in healthcare information technology for over 20 years. Our CEO, CFO and General Counsel each hold undergraduate and graduate degrees in their respective fields, and each have over 20 years of experience managing risks at VirBio and at similarly situated companies, including risks arising from cybersecurity threats. For example, our CFO has been responsible for leading and managing Information Technology departments at two separate publicly traded companies, including our Company, and has leadership experience in business continuity planning in various roles. Additionally, one of our directors formerly served as the United States Secretary of Homeland Security, in which capacity she had ultimate responsibility for the cybersecurity of the critical infrastructure of the United States of America, and as President of the University of California with responsibility for cybersecurity matters related to the university's various networks.

companyName: Vir Biotechnology, Inc.

ticker: VIR


text: Our Company is proactive in managing the material risks from cybersecurity threats, which is reflected in the establishment of a dedicated committee responsible for overseeing such risks. This committee is composed of the following individuals: Kamran Shamaei, Chief Technology Officer, who provides technical leadership and strategic direction for all technology-related decisions, including cybersecurity.

companyName: Monogram Technologies Inc.

ticker: MGRM


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.

companyName: scPharmaceuticals Inc.


text: The Company recognizes the importance of managing cybersecurity risks to protect its information systems and data. We do not currently engage any third-party cybersecurity service providers.

companyName: Naploy Corp.


text: The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee regularly reviews and discusses with management the strategies, processes and controls pertaining to the management of our information technology operations, including cyber risks and cybersecurity. Our Chief Information Officer (CIO) and other internal members of our technology team provide regular reports to the audit committee regarding the evolving cybersecurity landscape, including emerging risk, as well as our processes, program and initiatives for managing these risks. The audit committee, in turn, periodically reports on its review with the board of directors.

companyName: HAVERTY FURNITURE COMPANIES INC

ticker: HVT


text: Our risk management strategy encompasses a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our risk management and control framework include Information Technology ("IT") policies and procedures, employee training, annual disaster recovery tests, and penetration tests performed by third-party experts. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors. The Company has established robust IT policies and procedures governing the use, access, and protection of our digital assets. These policies serve as a foundation for secure operations, outlining best practices and compliance standards for our employees. The Company recognizes the crucial role of employees in maintaining a secure environment and conducts regular cybersecurity training programs. These initiatives are designed to empower our staff with the knowledge and skills necessary to identify and respond to potential threats, reducing the risk of human error in cybersecurity matters. To test the preparedness of our operations in the face of unforeseen events, the Company conducts annual disaster recovery tests. These tests evaluate our ability to recover critical systems and data in the event of a disruption, contributing to our overall business continuity and risk mitigation efforts. As part of our commitment to maintaining a strong defense against cyber threats, the Company engages third-party experts to conduct regular penetration tests on our network. These tests are intended to simulate real-world cyber-attacks, allowing us to identify vulnerabilities and address them proactively.

companyName: INVESTORS TITLE CO

ticker: ITIC


text: NSP-Wisconsin is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: NORTHERN STATES POWER CO /WI/


text: We have established procedures for evaluating, recognizing, and managing significant risks stemming from potential unauthorized events occurring on or through our electronic information systems. These procedures comprise an important part of our overall enterprise risk management system and are aimed at preventing, detecting, or mitigating data breaches, theft, misuse, unauthorized access, or any other security incidents or vulnerabilities affecting digitally stored data. Internally we have an Internet, Email and Computer Use Policy and all of our employees have been trained on the policy and related tools. Additionally, we employ processes to manage and identify risks arising from cybersecurity threats linked to supplier and customer relationships and our utilization of third-party technology and systems. Our operations involve collecting and storing information in cloud systems, such as Google Drive, and we rely on third-party providers, such as Google, whose systems may encounter interruptions and/or cybersecurity incidents.

companyName: ENDRA Life Sciences Inc.

ticker: NDRA


text: Relevant Regulations As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies. In addition, in 2023 the SEC recently enacted rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.

companyName: Community West Bancshares

ticker: CWBC


text: The Bank's CIO has over 35 years of experience in Financial IT and has overseen Information Security programs in large financial institutions since 2003.

companyName: Federal Home Loan Bank of New York


text: We have processes to oversee and identify material risks from cybersecurity threats associated with its use of third-party service providers. Such processes include evaluating service providers to ensure coverage of key cybersecurity risks have appropriate mitigations. We also monitor for threats impacting key service providers and assesses identified threats for potential impacts to services, data, and systems.

companyName: Orion Properties Inc.

ticker: ONL


text: At Vista Credit Strategic Lending Corp., we recognize the importance of assessing, identifying and managing risks associated with cybersecurity threats. These risks include operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws, and other litigation and legal, financial and reputational risks.

companyName: VISTA CREDIT STRATEGIC LENDING CORP.


text: The potential consequences of a material cybersecurity incident include remediation and restoration costs, reputational damage, and litigation with third parties, which in turn could adversely affect our competitiveness and results of operations. Accordingly, cybersecurity is an important part of the Company's enterprise risk management program, and the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach.

companyName: TILE SHOP HOLDINGS, INC.

ticker: TTSH


text: The board of directors has overall responsibility for risk oversight, including, as part of regular board meetings, general oversight of executives' management of risks relevant to the Company. The VP of IT Security and Compliance provides an annual cybersecurity update to the board. While the full board has overall responsibility for risk oversight, it is supported in this function by various committees, including principally its audit committee.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: See "Risk Factors — If we or our service providers do not maintain the security of information relating to our customers, employees and vendors and our music, security information breaches through cyber security attacks or otherwise could damage our reputation with customers, employees, vendors and artists, and we could incur substantial additional costs, become subject to litigation and our results of operations and financial condition could be adversely affected. Moreover, even if we or our service providers maintain such security, such breaches remain a possibility due to the fact that no data security system is immune from attacks or other incidents."

companyName: Warner Music Group Corp.

ticker: WMG


text: Our operations utilize multiple information systems, including accounting software, human resources management software, back of house systems, supply chain software, our brands' mobile apps, online ordering platforms, in-restaurant kiosks, point-of-sale software, and back-of-house software. In the ordinary course of our business, we collect, process, transmit, disclose, and retain personal information regarding our employees, our franchisees, vendors, contractors, and guests (which can include social security numbers, social insurance numbers, banking and tax identification information, health care information for employees, and credit card information) and our franchisees collect similar information.

companyName: Restaurant Brands International Limited Partnership

ticker: RSTRF


text: We provide regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.

companyName: Xencor Inc

ticker: XNCR


text: A critical component of our cybersecurity strategy is the integration of a third-party Security Operations Center support, which monitors our global network environment on a 24/7/365 basis, and is designed to rapidly identify and respond to threats. This program monitors both internally detected and externally reported vulnerabilities that could impact our products, which are then evaluated for their cybersecurity implications according to Company protocols. We also utilize third-party service providers as part of our cybersecurity risk management program and maintain a framework for managing cybersecurity risks presented by our third-party Service Providers. This framework governs the third party's security management system and mandates that the program (i) adhere to certain information handling and asset management protocols and (ii) promptly notify us of any cybersecurity incidents that impact its systems.

companyName: ADTRAN Holdings, Inc.

ticker: ADTN