text: Monitor Cybersecurity Incidents The CIO and Manager of Cybersecurity are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the 24/7/365 monitoring of our information systems as well as ongoing threat assessment monitoring. The deployment of advanced security measures, regular system audits to identify potential vulnerabilities, and periodic cyber assessment exercises support these programmatic efforts. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced IRP. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: BKV Corp

ticker: BKV


text: We have a vendor management processes to manage cybersecurity risks associated with our use of these external providers that includes a risk assessment for each vendor, reviews of vendor audits and reports, and we also impose certain contractual information security obligations on vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: DELCATH SYSTEMS, INC.

ticker: DCTH

secItem: Item 1C


text: Although we have not been materially impacted by any cybersecurity incident to date, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity risks, which could result in the disclosure, theft or destruction of confidential information, disruption of our programming, damage to our brands and reputation, legal exposure and financial losses."

companyName: AMC Networks Inc.

ticker: AMCX


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from the CCO, which incorporates updates provided by the Investment Adviser regarding the overall state of the Investment Adviser's cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Investment Adviser's operations, as well as the Fund.

companyName: John Hancock Comvest Private Income Fund


text: Our VP IT and Senior ISM are responsible for assessing and managing material risks from cybersecurity threats, as well as managing and responding to material cyber incidents if any occur. Our VP IT has a bachelor's degree in management information systems and more than 25 years experience managing enterprise information-technology systems and resources. Our Senior ISM has an undergraduate degree in management information systems, an MBA and multiple professional cybersecurity certifications, has specialized in cybersecurity for more than a decade and is focused primarily on cybersecurity.

companyName: IMPINJ INC

ticker: PI


text: Under the oversight of the GDISC, members of the Company's Information Technology and Compliance departments administer the Company's cybersecurity response policies, including assessing cybersecurity incidents as they occur and determining the severity of any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's policies. These teams report to an incident response governance team, which is composed of members of the Company's senior leadership team. These teams monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report incidents to the Audit Committee, as appropriate.

companyName: Axalta Coating Systems Ltd.

ticker: AXTA


text: We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment, and mitigation of cybersecurity risks. We conduct annual cybersecurity training for all of our employees and periodically engage third-party consultants to conduct penetrating testing and vulnerability assessments. Additionally, we use automated tools designed to monitor, identify, and address cybersecurity risks. Further, we have a process to evaluate and review the cybersecurity practices of our key vendors prior to onboarding, including through a general security assessment and contractual requirements, as appropriate.

companyName: FATE THERAPEUTICS INC

ticker: FATE


text: To address cybersecurity risks facing our organization, we have adopted a "continuous risk assessment" process. We engage a third party to conduct a bi-annual National Institute of Technology-Cyber Security Framework assessment to determine the effectiveness of our program and related controls. The results of that assessment are shared with management, which drives prioritization and investment in resources to address those risks. Likewise, annual penetration tests occur to review the efficacy of our technical controls, results which are reviewed by management and resolved in a timely manner. Other factors that feed into our risk management practices are also operational events and incidents, which can lead to controls being reviewed and enhanced.

companyName: UNIVERSAL HEALTH SERVICES INC

ticker: UHS


text: Notwithstanding the investments made in mitigating our cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company. As of the date of this filing, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. For further discussion, please see Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: Capital Bancorp Inc

ticker: CBNK


text: Our Chief Financial Officer is primarily responsible for assessing and managing our material risks from cybersecurity threats with assistance from a third-party service provider. Our Chief Financial Officer supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include quarterly briefings from our third-party service provider and alerts and reports produced by security tools deployed in the IT environment. Our Chief Financial Officer has over 10 years of experience in overseeing our cybersecurity and information technology programs. We also rely on our third-party service provider for advice and expertise on monitoring evolving industry standards and best practices.

companyName: VERU INC.

ticker: VERU


text: A number of cybersecurity measures were employed to reduce the likelihood that cybersecurity incidents would materialize, including: (i) employing a variety of reputable and recognized hardware, software and other security measures in the design and maintenance of our information technology and data security systems; (ii) conducting periodic testing and verification of information and data security systems, including engaging third-party assessors to perform penetration testing of our systems to identify vulnerabilities; (iii) confirming with our critical vendors whether they experienced cyber breaches of their IT systems or otherwise involving Company information; (iv) verifying third-party IT system integrity through a review of System and Organization ("SOC") audit review reports provided by certain of our vendors; and (v) providing periodic employee security awareness training relating to phishing and other scams, malware and various cyber-related risks. We also engaged third-party vendors to assist with incident detection and monitoring and to implement and maintain other cybersecurity measures specific to our operations and portfolio properties.

companyName: EQC Liquidating Trust


text: Our cybersecurity governance program is led by the Senior Vice President and Chief Information Officer, with support from the internal information technology department. The Senior Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. The Senior Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, our cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with our Computer Security Incident Response Plan. Progress and developments in our cybersecurity governance program are communicated to members of the executive team. Our management team takes steps to remain informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including third-party consultants engaged by us; and alerts and reports produced by security tools deployed in our IT and OT environments. While our board of directors is ultimately responsible for enterprise-wide risk oversight, the board's committees assist the board in fulfilling its oversight responsibilities in certain areas of risk. In particular, the board's audit committee is responsible, among other things, for risk management relating to legal and regulatory requirements, including cybersecurity, which plays an integral role in our risk management strategy and continues to be an area of increasing focus for our board, the audit committee and our management team.

companyName: Diamondback Energy, Inc.

ticker: FANG


text: In addition, management of cybersecurity threats is shared with the chief information officer who is responsible for Dominion Energy's technology assets including hardware, software, networks, servers and telecommunications. The chief information officer has over 25 years of experience at Dominion Energy primarily in various roles within the information technology department, including information technology risk management. In addition, the chief information officer previously served on the board of the Virginia Cybersecurity Partnership, a collaboration between private industry and the Federal Bureau of Investigation.

companyName: DOMINION ENERGY SOUTH CAROLINA, INC.


text: We have deployed various safeguards designed to protect our information technology ("IT") systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls. At the management level, these cybersecurity defense systems are overseen by our network administrator who performs services for us on a part-time basis pursuant to the compensation and services agreement. Our network administrator has more than 20 years of experience with IT systems and holds various IT certifications. Our network administrator reports to, and is in regular contact with, our Chief Financial Officer and Senior Vice President-Financial. These officers do not have formal IT or cybersecurity training. In the event of a cybersecurity incident, among other things, the network administrator and these officers would consult with one another and, as needed or appropriate, other members of management to determine the appropriate course of action (including whether such incident should be reported to other members of management and/or the audit committee and whether public disclosure should, or is required to, be made).

companyName: ONE LIBERTY PROPERTIES INC

ticker: OLP


text: We employ a range of tools and strategies to mitigate cybersecurity risks and regularly test them for effectiveness. Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates. We also have specific tools to provide real time, continuous monitoring and protection of our endpoints. To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program. Our employees receive security awareness training at a minimum on an annual basis and are subjected to phishing training and phishing tests throughout the year. Annually, we perform tabletop exercises to test our cybersecurity incident response plan. Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Howard Hughes Holdings Inc.

ticker: HHH


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board of Directors has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board of Directors takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board of Directors meeting. The Board of Directors' review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: These risks are identified, assessed and managed within the broader context of our ERM strategy, ensuring a comprehensive approach to organizational risk. We incorporate cybersecurity risk assessments into our overall enterprise risk assessment process. This integration ensures that cyber risks are evaluated and managed alongside other operational, financial, and strategic risks, offering a holistic view of our risk landscape. Our ERM strategy is overseen by an Enterprise Risk Management Committee, which is made up of representatives from our finance, legal, accounting, internal audit and global information systems functions, our business leaders and members of the Senior Leadership Team. It is led by our Chief Financial Officer and its actions are reported to our Board of Directors on a quarterly basis.

companyName: ALBANY INTERNATIONAL CORP /DE/

ticker: AIN


text: The Board, in coordination with the Audit Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of the Data Privacy and Security Committee, which includes the Company's Head of Information Technology.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: While we have experienced cybersecurity incidents in the past, based upon the information that we have as of the end of fiscal 2025, we are not aware of any cybersecurity incident that has materially affected or that is reasonably likely to materially affect our business' financial position or results of operations. However, the risks from cybersecurity threats and incidents continue to increase, and the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurances that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially impact us. We continue to invest in cybersecurity and the resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see Item 1A, Risk Factors, under the heading "Risks Related to Data Security."

companyName: Titan Machinery Inc.

ticker: TITN


text: Our advisor's Information Technology Director reports at least annually to our board of directors and to our audit committee as appropriate. These presentations include developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. Our board of directors also receives prompt and timely information regarding any cybersecurity incidents that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. These reports come from a member of our advisor's Executive Committee, comprised of our advisor's key executives and certain department leaders.

companyName: KBS Real Estate Investment Trust III, Inc.

ticker: KBSR


text: The company has not experienced any material cybersecurity incidents or incurred any material expenses resulting from a cybersecurity breach; however, we cannot provide assurance that our business strategy, results of operations and financial condition will not be materially affected in the future by such risks or any future material incidents. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, refer to the risk factors captioned "We rely on third-party vendors for key components of our business" and "We collect sensitive confidential information from our customers. A breach of this confidentiality, whether due to a cybersecurity or other incident, could result in harm to our customers and damage to our brand" set forth under the heading "Risk Factors" included in Part I, Item 1A of this Form 10-K.

companyName: CARMAX INC

ticker: KMX


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Information Security Program. The Company has an established third-party due diligence program designed to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.

companyName: M&T BANK CORP

ticker: MTB


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board maintains principal oversight responsibility for our enterprise risk management, including cybersecurity. The Board has responsibility for, among other things, oversight of the Company's information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats and the steps management has taken to monitor and mitigate such risks. The Board reviews and discusses with management, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures; • the assessment of risks and threats to our information technology systems; • the internal controls regarding information technology security and cybersecurity; and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks and to remediate the effects of any cybersecurity incidents that may occur.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT


text: Through our GPO, we deploy functional and business unit-specific approaches to data and privacy compliance sharing threat intelligence daily and collaborate closely with the Corporate Information Technology (CIT) organization to build process and playbooks for cyber-resiliency. Taking into consideration the processes established by GIS and CIT, our GPO has developed a framework of policies, procedures and other initiatives that are implemented across Unisys to help meet data privacy requirements. Our GPO is supported by a network of data protection officers, attorneys and privacy specialists; and manages privacy software that is used across Unisys to facilitate privacy impact assessments. The GPO also records data processing activities, maps data flows and follows evolving privacy regulatory guidance for countries in which we operate and adjusts standards as necessary.

companyName: UNISYS CORP

ticker: UIS


text: Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties. For high-risk third-parties, we perform rigorous due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance. We also review evidence of cybersecurity certifications and the results of independent audits. For high-risk third-parties with access to sensitive data or systems, we conduct more in-depth assessments. Our contracts with high-risk third-parties contain provisions related to data protection, confidentiality, incident reporting and compliance with all applicable laws and regulations. Throughout our engagements with high-risk third-parties, we maintain a monitoring program with respect to their cybersecurity posture. Leveraging tools such as security questionnaires, security ratings and external threat intelligence, we regularly review and update third-party risk assessments based on changes in the third-party's services or practices and the risk landscape.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Cybersecurity and data protection falls under our overall risk management and oversight. Our Board of Directors periodically receives reports from our operations committee, cybersecurity management, external professional advisors, and other relevant Company personnel regarding various types of risks faced by the Company and the Company's risk mitigation efforts related thereto, including cybersecurity risks and related mitigation efforts.

companyName: Bally's Corp

ticker: BALY


text: While we have not experienced a cybersecurity incident to date that has had a material impact on Oncor, we have experienced, and expect to continue to experience, threats and attempted intrusions into our technology systems and platforms. Our third-party vendors have been subject, and will likely continue to be subject, to acts that disrupt or attempt to disrupt the services they provide to us. Threat actors could also attempt to use our third-party vendors as a conduit to attack us. We are subject to evolving cyber risks related to adversaries attacking our technology infrastructure and platforms and the technology infrastructure and platforms of third-party vendors. See "Item 1A. Risk Factors—Cyber-attacks on us or our third-party vendors could disrupt business operations, initiate the loss or disclosure of critical operating or confidential data, have an adverse impact on our reputation, and expose us to significant liabilities." A future cybersecurity incident could potentially have a material impact on our business, operations and financial condition. In addition, non-compliance with electric industry specific regulations or violation of laws could have financial penalties, as well as impact our reputation, which could materially impact our results of operations or financial condition. Cybersecurity risk has also contributed to, and is expected to continue to contribute to, increased capital expenditures and operation and maintenance expenses, including as a result of the need for additional hardware, software, equipment, personnel, training and third-party service providers, as well as increased cyber insurance costs.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Cybersecurity threats, resulting from any previous cybersecurity incidents, have not materially affected or are not reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Axogen, Inc.

ticker: AXGN


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, legal, and management. Personnel at all levels and departments are made aware of our cybersecurity policies through trainings.

companyName: Innoviva, Inc.

ticker: INVA


text: Invesco's Board of Directors oversees cybersecurity risk and receives updates at a minimum, of twice a year regarding cybersecurity, including risks and protections. The Global Operational Risk Management Committee, one of Invesco's risk management committees, provides executive-level oversight and monitoring of the end-to-end programs dedicated to managing information security and cyber related risk. The members of this Committee include Invesco Ltd.'s Chief Administrative Officer, Chief Risk & Audit Officer, General Counsel, Chief Financial Officer, Chief Human Resources Officer, Global Head of Compliance, and Global Operational Risk Owners which includes the GCSO. The committee reports to Invesco's Enterprise Risk Management Committee which provides updates to the Invesco Board of Directors to facilitate their oversight.

companyName: Invesco Galaxy Bitcoin ETF

ticker: BTCO


text: Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks. The program includes regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our Audit Committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Director of Information Security, our Chief Financial Officer and our Chief Legal Officer.

companyName: ASPEN AEROGELS INC

ticker: ASPN


text: Our CIO has 19 years of experience in the information technology industry, including engagement with cybersecurity strategy and oversight. Our CIO reports directly to our Chief Executive Officer.

companyName: Owens Corning

ticker: OC


text: The CIO is a member of WisdomTree, Inc.'s Governance Committee and regularly reports on cybersecurity risk management to other members of the Governance Committee comprised of WisdomTree Inc.'s senior executive officers. The Governance Committee oversees the prioritization and escalation of risks from cybersecurity threats and is responsible for strategy, operations, financial management, information technology, compliance, legal, administration and corporate governance. The members of the Governance Committee collectively possess experience in these areas, including cybersecurity and risk management.

companyName: WisdomTree Bitcoin Fund

ticker: BTCW


text: Our board of directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our CISO, via our audit committee, which is assigned oversight of cybersecurity risks. In addition, the chair of our audit committee meets with our CISO periodically to discuss cybersecurity threats and incidents, as well as the business's approach to responding to them. Our incident response plans also provide that our board of directors and audit committee will be notified in the event of certain cybersecurity incidents.

companyName: Snap Inc

ticker: SNAP


text: Our cybersecurity risk management program is overseen by a cross-functional team comprised of our business-functional and IT employees. Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Our Chief Technology Officer and Head of Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: Our policies, standards, processes and practices designed to assess, identify, and manage material risks from cybersecurity threats are integrated into our overall risk management program. These policies, standards, processes, and practices are based on maintaining a security-in-depth methodology as informed by the National Institute of Standards and Technology ("IST") Cybersecurity Framework, the International Organization for Standardization ("ISO")/IEC 27001 and other applicable industry standards. Key controls include: (a) Zero trust network architecture for employee privileged and non-privileged application access (b) Mandatory employee security awareness training and phishing simulations, plus follow-up remedial training if necessary,(c)Periodic third-party network and host vulnerability scans and (d) 24/7 Security Operations Center monitoring all corporate endpoints which escalates to senior engineering resources as necessary for incident response and remediation. We also maintain a cyber insurance policy to mitigate financial exposure from any security incidents.

companyName: Skillz Inc.

ticker: SKLZ


text: This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.

companyName: Crucial Innovations, Corp.


text: Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are likely to materially affect Atkore, including our business strategy, results of operations or financial condition. For more information on risks relating to our cybersecurity threats, see Item 1A, "Risk Factors-Risks Related to Our Business-Interruptions in the proper functioning of our information technology ("IT") systems and the IT systems of those with whom we do business, including from cybersecurity threats, could disrupt operations and cause unanticipated increases in costs or decreases in revenues, or both."

companyName: Atkore Inc.

ticker: ATKR


text: The Audit Committee of our Board of Directors bears the primary responsibility for oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. Management's oversight is performed through an IT Steering Committee, a subset of executive management including our Chief Financial Officer, or CFO, and Chief Legal Officer, and relevant functional expertise, including our Senior Vice President, Information Systems, or SVP, IS. Our SVP, IS, is the primary member of the IT Steering Committee charged with responsibility for assessing, monitoring and managing our cybersecurity risks. With over 20 years of experience in information technology strategy and operations, his background includes extensive experience as an IT executive at various companies. At least annually, the SVP, IS, and the CFO provide a comprehensive report to the Audit Committee regarding cybersecurity risk assessments, emerging threats and changes to industry standards, and incident reports and remediation, if any.

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE


text: Backup Policy. The Company's Backup Policy applies to all data stored on Company systems. The Backup Policy specifies the types of data and information considered to be critical to the Company's operations and thus required to be backed up, establishes a backup schedule that is necessary for successful data recovery, and implements procedures for the off-site rotation, storage, and retention of backups. The Backup Policy also establishes the Company's data-restoration procedures and mandates the periodic testing of those procedures.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity-related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee of the board of directors oversees our risk management program, which focuses on the most significant risks to our business, including oversight of information technology, cybersecurity, and data privacy risks. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity threats. The Audit Committee reviews our cybersecurity risk profile with management on a periodic basis using key performance and/or risk indicators. These key performance indicators are metrics and measurements designed to assess the effectiveness of our cybersecurity program in the prevention, detection, mitigation, and remediation of cybersecurity incidents.

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: The CTOC is responsible for the governance of the firmwide Global Technology organization, including oversight of firmwide technology strategies, the delivery of technology and technology operations, the effective use of information technology resources, and monitoring and resolving key operational risk and control matters arising in the Global Technology organization. The CTOC escalates key operational risk and control issues, as appropriate, to the GTOC or its business controls committee.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Company's Board of Directors (the "Board") is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards and are fully integrated into the Company's overall risk management processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Kayne DL 2021, Inc.


text: This coverage supports our risk management efforts by providing additional resources and expertise to help us identify, mitigate, and respond to potential threats effectively.

companyName: La Rosa Holdings Corp.

ticker: LRHC


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process.

companyName: BALL Corp

ticker: BALL


text: Our information technology providers regularly inform the COO and CFO about matters related to cybersecurity risks and incidents. Together, our COO and CFO then update our Board on significant cybersecurity matters, and strategic risk management.

companyName: First Choice Healthcare Solutions, Inc.

ticker: FCHS


text: We plan to design our risk management program to also assess third-party risks, and we plan to perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we plan to perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: The processes by which our Chief Financial Officer and our senior management are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents includes regular updates from the head of IT to the Chief Financial Officer, as well as periodic reports, as needed, from the Chief Financial Officer and the head of IT to senior management.

companyName: Oric Pharmaceuticals, Inc.

ticker: ORIC


text: The Harley-Davidson CISO meets regularly with the appropriate management to review and discuss our cybersecurity and other information technology risks and opportunities. Our cybersecurity incident response plan sets forth a security incident management and reporting protocol, with escalation timelines and responsibilities.

companyName: LiveWire Group, Inc.

ticker: LVWR


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the completion of a vendor security questionnaire and our implementation of vendor monitoring programs. We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, like other companies in our industry, we and our third-party vendors have from time-to-time experienced threats and security incidents that could affect our information or systems. See "Item 1A. Risk Factors" for additional information on the Company's cybersecurity-related risks.

companyName: BJ's Wholesale Club Holdings, Inc.

ticker: BJ


text: Primerica's senior executive leadership is actively involved in managing material risks from cybersecurity threats. Primerica's cybersecurity operations risk steering group is chaired by the Chief Operating Officer and holds quarterly meetings. It includes key executives from the Company's technology, security, privacy, and legal teams, coordinates corporate security initiatives and provides high-level guidance on technology-and security-related issues. The Chief Information Security Officer has responsibility for assessing and managing the Company's material risks from cybersecurity threats. The Chief Information Security Officer has served in various roles in information technology and information security for 35 years, including serving as the Company's Chief Information Security Officer for over 23 years.

companyName: Primerica, Inc.

ticker: PRI


text: Our risk management programs are developed, implemented, managed, and reviewed at the direction of Information Security and business segment leaders, with subsequent actions determined based on the results of these preventive and detective controls. We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Audit Committee is required. Depending on the assessed severity of the incident, the Audit Committee may be notified immediately or at its next regularly scheduled meeting.

companyName: CLARIVATE PLC

ticker: CLVT


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-nine years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.

companyName: PENNS WOODS BANCORP INC


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations or financial condition. See "Systems and information technology interruption and breaches in data security and/or privacy could adversely impact our ability to operate and negatively impact our results of operations" in "Item 1A. Risk Factors."

companyName: Southland Holdings, Inc.

ticker: SLND


text: Entergy and the Registrant Subsidiaries have incorporated certain cyber-specific response protocols and procedures into their Entergy Incident Management System framework for responding to emergency incidents. This includes the Entergy Incident Response Team Plan, which outlines Entergy's procedures, steps, and responsibilities for preparing for, detecting, containing, and recovering from an incident. The plan details the roles and responsibilities of Entergy's officers who would be engaged in such a response to an emergency incident, including key questions to be addressed, critical decision points, and sources of key information to support decision-making. Senior management and the Emergency Incident Response Team periodically review and drill on the plan.

companyName: ENTERGY LOUISIANA, LLC

ticker: ELC


text: The Board oversees the Company's risk management process, including cybersecurity risks, directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies, which includes cybersecurity, and the steps management has taken to monitor and mitigate such exposures and risks.

companyName: Veralto Corp

ticker: VLTO


text: We also conduct periodic phishing attack simulations to evaluate users' vulnerability to emerging email threats. We conduct remediation training where failures occur. On a quarterly basis, our cybersecurity team also conducts scenario-based tabletop exercises with critical business teams to simulate disasters and cyberattacks. The tabletop exercises test and fine-tune our business continuity plans and incident response procedures.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Commitment to Security Security is a foundation on which ZoomInfo builds and maintains customers' trust. We are committed to protecting our information and our customers' information from both intentional and unintentional misuse and have implemented a robust Information Security Management System ("ISMS") that meets the ISO 27001 Standard requirements as well as the ISO 27701 (Privacy) and ISO 27017 (Cloud Security) standards. We have also earned AICPA's SOC 2 attestation regarding the security, availability, and confidentiality controls around our services and meet the security requirements of the Cloud Security Alliance STAR program.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: As part of our cybersecurity risk management program, we take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor's programs. Our vendor evaluation procedures include, as appropriate, the review of vendors' SOC 2 Type 2 reports and a vendor security questionnaire.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: Cybersecurity risk management is part of our ERM Program, which includes specific controls and processes for mitigation, monitoring and reporting associated with cybersescurity and information risks. Specifically, cybersecurity controls and processes include the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The Risk Oversight committee of the board of directors oversees these controls and processes and annually recommends each for approval. The full board of directors annually reviews and approves each of our Enterprise Security Policy, Security Incident Response Plan, and Business Resiliency Management Policy.

companyName: Federal Home Loan Bank of Topeka


text: Monitor Cybersecurity Incidents We have a well-defined and tested cybersecurity incident response plan, which outlines the roles and responsibilities, procedures and protocols, tools and resources, and communication and escalation channels that will be activated and implemented in the event of a cybersecurity incident. The plan aims to detect and contain the incident, analyze and assess its nature, scope, and severity, and restore and resume the normal operations and functions of the Company.

companyName: AGREE REALTY CORP

ticker: ADC


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. The Contract and Procurement Security Services ("CPSS") process has several key requirements of third-party vendors who manage or control our electronic information resources to ensure they protect our interests in cybersecurity, including: adherence to cybersecurity best practices, such as the NIST Cybersecurity Framework; completion of a security assessment questionnaire prior to any contract execution; and through application of our GRC (Governance, Risk, and Compliance) Tool, which triggers automatic annual security reviews of vendors. The security compliance team within the CISO's organization actively reviews and assesses the third party's responses and takes appropriate actions based on the responses.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. In order to assess, identify, manage and address the risk of cybersecurity threats or incidents, the Company has established a Cybersecurity Risk Management Program, which uses a risk-based approach to implement multi-layered controls designed to enable the Company to maintain agility while protecting critical infrastructure and data. This program, which is an integral part of our overall enterprise risk management program, implements controls and frameworks designed to align with industry best practices, including those based on the National Institute of Standards and Technology Cybersecurity Framework, the Sarbanes-Oxley Act of 2002 and HIPAA.

companyName: Bausch & Lomb Corp

ticker: BLCO


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Vice President of Information Technology, Director of Risk Management and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: The Company relies on Oxford Funds to engage external experts, including cybersecurity assessors and consultants to evaluate cybersecurity measures and risk management processes, including those applicable to the Company. The Company relies on Oxford Funds' risk management program and processes, which include cyber risk assessments.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: Primary responsibility for assessing, monitoring, and managing cybersecurity risks rests with the CIO, who has oversight over the IT Department, including one dedicated cybersecurity staff person and select specialized contractors. This group of contractors includes a Chief Information Security Officer, Chief Technology Officer, Cybersecurity Analysts, Network Engineers, and Network Administrators.

companyName: YORK WATER CO

ticker: YORW


text: in the Southern African which is subject to various cybersecurity risks that could our business, financial condition, operations including, but not limited to, the extortion, harm to employees or customers, violation of privacy laws and other litigation and legal risk and reputational risk. ("NPS").

companyName: LESAKA TECHNOLOGIES INC

ticker: LSAK


text: Legal Overview Pursuant to the requirements of section 39 of the Federal Deposit Insurance Act (12 U.S.C. 1831p–1) and sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801, 6805(b)), the federal bank regulatory agencies adopted the Interagency Guidelines Establishing Information Security Standards (the "Guidelines"). The requirements of the Guidelines apply to all FDIC-insured depository institutions, most subsidiaries of such entities, and to state savings associations. Federal law also mandates that information security procedures and controls be routinely evaluated by the Bank's state and federal regulators as part of the standard safety and soundness examination process.

companyName: UNITED BANCORP INC /OH/

ticker: UBCP


text: Cybersecurity Governance APEI's Information Security Steering Committee, or the Steering Committee, consisting of the Chief Information Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and the Chief Human Resources Officer, provides a level of oversight over our cybersecurity program. The Steering Committee meets quarterly and is briefed, among other things, on our cybersecurity program, how we are mitigating risks, any notable events that occurred, and phishing campaign results. In addition, the Steering Committee reviews the program for the proper funding and staffing of the information technology security department as well as alignment of the program with our strategic objectives. The Steering Committee reviews and ratifies security policies and helps ensure the proper controls are in place and being followed. The Steering Committee is a critical element to review the cybersecurity program against applicable federal and state regulations and its progress for planned improvements.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: PECO's cybersecurity program is generally based on the National Institute of Standards and Technology cybersecurity framework ("NIST CSF") with the intention of preventing, identifying, detecting, and mitigating cybersecurity risks. This does not imply that we meet or comply with any particular technical standards, specifications, frameworks, or requirements including the NIST CSF, only that we use the NIST CSF as a guide. Our program focuses on people, processes, and technologies and includes training of associates, periodic workforce testing, and the deployment and monitoring of technical security solutions and controls.

companyName: Phillips Edison & Company, Inc.

ticker: PECO


text: The lead management team member responsible for cybersecurity matters is the Chief Administrative Officer, who has 20 years of experience in information technology and a B.A. in Management Information Systems. She is assisted by the Information Security Manager and the Assistant Vice President and Senior Corporate Counsel for Privacy and Governance.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Impact of Cybersecurity Risks Material Effects from Cyber Threats: To date, our operations and financial condition have not been materially affected by cybersecurity threats, due in part to our proactive measures such as employee security training programs and advanced threat detection and response capabilities. Our defensive strategies have successfully mitigated the risks of cyber incidents.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: To date, the Company has not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial condition. The Company is aware of the evolution of cybersecurity risks and is taking proactive steps by keeping up to date our information systems and educating our personnel about these risks.

companyName: HAMMER TECHNOLOGY HOLDINGS CORP.

ticker: HMMR


text: The Company leverages third parties that support various operational and technical functions, some of which require limited access to internal systems and data. The Company has implemented a comprehensive third-party risk management program that includes vendor assessments, contractual requirements and ongoing third-party monitoring to mitigate these risks and ensure compliance with security policies and industry standards. All third-party access is protected and managed by the same security controls, processes and policies used by the Company for internal accounts.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Board of Director Oversight Our Board has delegated oversight of risks from cybersecurity threats, as well as overall Enterprise Risk Management, to our audit committee. The audit committee reviews and evaluates the effectiveness of our cybersecurity frameworks, policies, programs, opportunities and risk profile, as well as our business continuity and disaster recovery efforts. Members of our audit committee have cybersecurity experience from their principal occupation or other professional experience. Members of software and business technology management, including our CISO, regularly report on our cybersecurity matters to both the audit committee of our Board and the full Board, as follows: • Management provides quarterly reports to the audit committee regarding our cybersecurity program and risks, and the audit committee in turn provides reports to the full Board as needed. All incidents with critical functional impact are escalated to the Board and audit committee. • Current information security concerns that arise during the year are escalated in real-time to leadership based on the process defined in our Incident Response Plan. All events and incidents are evaluated against our prioritization and informational impact matrices outlined the plan.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: The CIO, who acts as our chief information security officer, leads our Cybersecurity Committee. The Cybersecurity Committee is a multidisciplinary team of corporate and operational leaders who work collaboratively to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response plan. The Cybersecurity Committee reports to our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Operating Officer ("COO"), Senior Vice President, Human Resources ("SVP HR") and Senior Vice President and General Counsel. The CIO, working together with a team of cybersecurity professionals and third-party consultants, monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and reports such threats and incidents to the senior leadership team when appropriate.

companyName: GRANITE CONSTRUCTION INC

ticker: GVA


text: Our cybersecurity program focuses on the following areas: • Vigilance – We maintain cybersecurity threat operations with the goal of proactively identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established cybersecurity incident response procedure plan. We recognize that the sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence technologies. • Systems Safeguards – We implement layered systems safeguards to enable the protection of our information systems from cybersecurity threats. These safeguards include network security, vulnerability management, and threat detection. • Collaboration – We utilize collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management – We actively manage cybersecurity risks posed by third parties and their systems that could impact our operations. We monitor and assess the security posture of our third-party vendors. We require third-party service providers with access to sensitive information to maintain cybersecurity practices aligned with industry standards and applicable laws. In addition, we proactively monitor public information regarding our vendors for security incidents, investigate potential impacts, and take appropriate action to mitigate risk. • Training – We have implemented and maintain a comprehensive cybersecurity training program to educate personnel about evolving threats and reinforce security best practices. This program includes: i. Monthly phishing awareness campaigns with mandatory remedial training for those who fail. ii. Annual security and acceptable use awareness training.

companyName: GREENBRIER COMPANIES INC

ticker: GBX


text: The Company also has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: Management's Role Managing Risk The Vice President of IT, Chief Legal Officer ("CLO") and the Director of IT Infrastructure and Security, play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide briefings to the Audit Committee on a regular basis, with a minimum frequency of once per year. The current Vice President of IT, who is responsible for assessment and management of cybersecurity risks, has over 20 years of experience in information and technology security, including senior roles at several companies in the pharmaceutical industry, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards.

companyName: Arcturus Therapeutics Holdings Inc.

ticker: ARCT


text: conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: The Board of Directors is responsible for overseeing our enterprise risk management program. The Audit Committee, which consists solely of independent directors, has been designated by our Board to oversee cybersecurity risks and our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee receives quarterly updates, or more frequently as needed, on cybersecurity and information technology matters and related risk exposures from our Chief Financial Officer ("CFO").

companyName: ITERIS, INC.


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected our company. For further discussion of risks from cybersecurity threats, see the section captioned "Risks Related to Operational Matters" in Item 1A. Risk Factors.

companyName: Northwest Bancshares, Inc.

ticker: NWBI


text: We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry ("PCI") compliant where required. We also maintain incident response procedures and business continuity and contingency plans and periodically hire third parties to conduct vulnerability analyses. We also compare our processes to standards set by the National Institute of Standards and Technology ("NIST") and/or International Organization for Standardization ("ISO"), as appropriate.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Cybersecurity risks are considered within our broader enterprise risk management ("ERM") framework as part of our overall risk assessment process. We maintain a comprehensive Information Security Program and controls that are designed to assess, identify, manage, contain, and recover from material cybersecurity risks. The Information Security Program is also designed to identify emerging cybersecurity and information security risks and apply safeguards to the Company, our assets, customer, and employee data. The Information Security Program also addresses cybersecurity risks associated with our use of third-party service providers through systems and processes that are designed to assess, identify, and reduce the potential likelihood and impact of a cybersecurity incident at our third-party service providers. The Information Security Program is based on Center for Internet Security ("CIS") Controls, a cybersecurity framework that is acknowledged worldwide and is designed to comply with applicable laws and guidelines.

companyName: UNIVERSAL CORP /VA/

ticker: UVV


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: BORGWARNER INC

ticker: BWA


text: The Company's Board of Directors recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, internal information technology risks; system security risks; data protection; risks to proprietary business information; intellectual property theft; fraud; extortion; harm to team members, partners, or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. The Company has implemented a cybersecurity risk management program that aligns with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to manage such material risks and to safeguard the Company's information systems, protect the confidentiality, integrity, and availability of the Company's and its customers' data, and maintain the trust and confidence of our customers, business partners and team members.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Cyber security is an inherent consideration for our data and AI-led digital solutions. There is heightened focus on institutionalizing a Responsible AI framework that includes periodic Secure AI assessments to proactively identify and mitigate data protection and privacy risks.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: The above cybersecurity risk management processes are integrated into the Partnership's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.

companyName: CSI Compressco LP


text: To defend, detect and respond to cybersecurity incidents, we, among other things, invest in and deploy industry leading cybersecurity tools and platforms; conduct proactive cybersecurity and privacy reviews of software, systems, applications and third party vendors; develop applicable policies and processes; perform independent penetration testing to evaluate and test security controls; conduct employee training and testing; monitor emerging laws and regulations related to data protection and information security though a dedicated team of in-house attorneys with experience in privacy and security matters; and monitor and respond to emerging threats, implementing appropriate mitigating controls as necessary.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Related to Cybersecurity Risks Our board of directors has delegated cybersecurity risk management to our Audit Committee as part of the Audit Committee's general risk oversight function. The Audit Committee, through the oversight of the General Administrative Leadership team, is responsible for overseeing the Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.

companyName: Septerna, Inc.

ticker: SEPN


text: Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, the Company has implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan. See Item 1A. " Risk Factors " for more information on cybersecurity risks.

companyName: ELITE PHARMACEUTICALS INC /NV/

ticker: ELTP


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").

companyName: Liberty Broadband Corp

ticker: LBRDA


text: The audit committee of the Board (the "Audit Committee") is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing these risks. Senior IT leadership regularly informs the Audit Committee, the Chief Financial Officer and other members of the Company's senior leadership of cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Cohen & Steers also uses third-party service providers to perform a variety of functions throughout its business, such as application providers, hosting companies and supply chain resources. Cohen & Steers maintains a risk-based approach to identifying and overseeing cybersecurity risks and vulnerabilities presented by its engagement of third parties, including key vendors, service providers and other external users of its information systems, as well as the information systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue and the identity of the provider, Cohen & Steers' vendor risk management program may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider. Cohen & Steers' vendor risk management program may entail: (i) vendor risk assessments; (ii) security questionnaires; (iii) vendor audits; (iv) vulnerability scans relating to vendors; (v) security assessment calls with the vendor's security personnel and Cohen & Steers' review of the vendor's written security program, security assessments and other reports; (v) provision from the vendor of a System and Organization Controls ("SOC") 1 or SOC 2 report to evidence cybersecurity preparedness; and (vi) the imposition of contractual obligations on the vendor.

companyName: Cohen & Steers Income Opportunities REIT, Inc.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part I. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our information technology systems or sensitive data, or those of our third-party CROs or other contractors or consultants, may fail or suffer security incidents, loss or leakage of data, and other disruptions, which could result in a material disruption of our product candidates' development programs, compromise sensitive data related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business."

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: We assess and test our cybersecurity policies and practices on an annual basis. These efforts include tabletop exercises, vulnerability and penetration tests, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We also engage third parties to assess and test our cybersecurity measures.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: Company's Board of Directors possesses a foundational understanding of cybersecurity matters, reflecting the company's ongoing commitment to safeguarding its financial technology infrastructure. While board members may not currently hold formal cybersecurity certifications such as CISSP or CISM, several directors have prior experience in managing technology-driven businesses where data security and regulatory compliance were integral to operations. The Board remains actively engaged in cybersecurity oversight through regular updates from senior management, including the Chief Technology Officer and other executives responsible for information security. These updates typically cover threat assessments, system vulnerabilities, incident response protocols, and regulatory developments. This communication ensures that the Board is informed of emerging risks and can provide appropriate strategic guidance in alignment with the Company's overall risk management framework.

companyName: FDCTECH, INC.

ticker: FDCT


text: Reporting to Board of Directors The CISO, in his capacity, periodically informs the Information Security Committee, Corporate Risk Committee and Board's Risk Committee of cybersecurity risks and incidents. This enables the highest levels of management to be kept abreast of the Company's cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the Risk Committee of the Board of Directors, where appropriate.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: Our Global CISO, who reports to our Chief Operating and Legal Officer ("COLO"), has principal management-level responsibility for our cybersecurity program, which includes assessing and managing our cybersecurity risks, along with developing and implementing cybersecurity processes, policies, and controls that are used for managing cybersecurity risk across the Company. Our Global CISO is supported by the CISO of Cyber Defense and the CISO of Cyber Governance – both of whom have extensive experience in private sector cybersecurity roles – and a team of cybersecurity professionals with relevant educational and industry experience. The Global CISO periodically meets with the Cyber Governance and Incident Disclosure Committee, our enterprise risk management function and chief-level executives to discuss cybersecurity risks, as well as related mitigation and remediation activities. The CDC monitors the prevention, detection, investigation, mitigation, response to, and remediation of cybersecurity incidents, and regularly reports to our CISO of Cyber Defense, who then subsequently reports to the Global CISO.

companyName: Hewlett Packard Enterprise Co

ticker: HPE


text: We maintain comprehensive internal protocols to mitigate cybersecurity threats associated with our use of third-party service providers. We are currently enhancing these protocols to further strengthen our defenses and reduce potential vulnerabilities.

companyName: FingerMotion, Inc.

ticker: FNGR


text: In its risk oversight role, our Board of Directors focuses on understanding the nature of our enterprise risks, including our operations and strategic direction, as well as the adequacy of our risk management process and overall risk management system. The Board of Directors evaluates risks over the short-term and over the long-term. Risk evaluation over the short-term includes the assessment of multiple inputs, including (i) receiving management updates on our business operations, financial results and strategy and discussing risks related to the business at each regular board meeting, (ii) receiving regular reports on all significant committee activities at each regular board meeting and (iii) evaluating the risks inherent in significant transactions, as applicable. In connection with risk evaluation over the long-term, the Board of Directors also seeks out the input of subject matter experts and consultants. Accordingly, a formal, enterprise risk assessment, which includes numerous members of Company management, is performed annually as part our strategic plan process.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Incident Response and Recovery Plan: The Company has an incident response and recovery plan, which details the steps to be taken from the initial internal reporting of a potential cybersecurity incident.

companyName: BORGWARNER INC


text: Our CISO is primarily responsible for the assessment and management of the Company's material cybersecurity risks and the related cybersecurity risk management policies and procedures. Our CISO oversees our cybersecurity risk management and information security programs and provides quarterly status reports to the ISSC and the Audit Committee. Our CISO possesses over 25 years of experience in various technology, cybersecurity operations, and engineering roles, holds a bachelor's degree in computer information science and a master's degree in technology management, earned a CISO Certificate from Carnegie Mellon University, and is ISC2 CISSP certified.

companyName: STEVEN MADDEN, LTD.

ticker: SHOO


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenants, loss of tenant or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. As our advisor has elected to outsource our information technology functions to third-party providers, we bear the risk of having less direct control over the security and performance of those systems.

companyName: Strategic Realty Trust, Inc.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Executive Vice President of Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Traeger, Inc.

ticker: COOK


text: The Cybersecurity Committee receives regular reports from Company management regarding the Company's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents, including those that may be particularly relevant to the Company's industry or operations. In addition, in exercising its oversight responsibilities, the Cybersecurity Committee has full access to Company management and may inquire into any matter that it considers to be of material concern to the committee or the full Board of Directors.

companyName: APA Corp

ticker: APA


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of tools and processes to identify, protect against, detect, respond, recover from, and govern the cybersecurity risks and threats. We have tools configured to block, prevent, detect, and monitor for suspicious activity providing real time monitoring and alerts for anomalous and nefarious activity, as well as advanced persistent threats. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third parties, external service providers and our supply chain. We also actively monitor our email traffic for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies.

companyName: SunPower Inc.

ticker: SPWR


text: Our Board has primary responsibility for overseeing risks associated with our information technology, including cybersecurity. Our Board receives regular reports from our Chief Information Officer ("CIO") regarding our information systems and technology and associated policies, processes and practices for managing and mitigating cybersecurity and technology-related risks. Our Audit Committee oversees our SEC reporting process generally, including with respect to any required disclosures relating to a material cybersecurity event.

companyName: SANMINA CORP

ticker: SANM


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. Refer to Risk Factors in Part I, Item 1A for a disclosure of our cybersecurity risks. We have not experienced a material information security breach and as a result, we have not incurred any material expenses. We continue to monitor cybersecurity risks to prevent and mitigate materially negative impacts on the Company's reputation, financial performance, customer or vendor relationships and potential litigation or regulatory investigations or actions.

companyName: CBL & ASSOCIATES PROPERTIES INC

ticker: CBL


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team composed primarily of members of management, including our Director of IT Operations, that is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to maintain, assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training — including phishing and malware simulations — of all of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes relevant procedures for evaluating the materiality of identified cybersecurity incidents, and reporting and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Offerpad Solutions Inc.

ticker: OPAD


text: The Cybersecurity and Privacy team, which maintains our cybersecurity function, reports to our Chief Technology and Digital Officer, who reports directly to our Chief Executive Officer. The Cybersecurity and Privacy team is led by our Chief Information Security Officer ("CISO"), who is responsible for developing and implementing our cybersecurity program and reporting on cybersecurity matters. The CISO and Chief Technology and Digital Officer report to the Audit and Risk Committee on a quarterly basis. Our CISO has been a cybersecurity leader for 20 years, maintains appropriate security certifications, and has extensive experience in building and maintaining cybersecurity risk and compliance programs. The cybersecurity team includes members who also have various levels of cybersecurity experience and maintain relevant cybersecurity certifications. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security controls and technologies and ongoing scanning and testing of Company information systems by internal teams as well as third-party organizations to identify potential vulnerabilities. To maintain knowledge of the latest developments in cybersecurity, evolving threat landscape, and cyber defense techniques, our CISO regularly attends cybersecurity related conferences and events hosted by cybersecurity experts, subscribes to cybersecurity threat intelligence communications and newsletters, and meets with cybersecurity vendors.

companyName: UPBOUND GROUP, INC.

ticker: UPBD


text: Our domestic Chief Technology Officer, Christian Aaselund, oversees the integration and security of the Company's digital products, infrastructure and all user-facing technology. Mr. Aaselund has over two decades of experience in technology leadership. His career reflects a broad spectrum of expertise, from spearheading technology solutions in startups to executing strategic initiatives in large enterprises.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: We have developed an enterprise-wide cybersecurity risk management system and strategy to safeguard our assets and operations, including the protection of the confidentiality of nonpublic, sensitive personal and business information and the integrity and security of our information systems, as follows: Assessment, Identification, and Management of Material Risks:

companyName: NewtekOne, Inc.

ticker: NEWT


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. We and our subsidiaries depend on the accuracy, capacity, and security of our information technology systems and those used by our third-party service providers. To protect the confidentiality, integrity, and availability of our critical systems and information, we have developed and implemented a cybersecurity risk management program that includes a cybersecurity incident response plan. Our operating subsidiaries operate and manage on a decentralized basis, and their software is not integrated with each other or with us. Our cybersecurity risk management program covers our businesses and is crafted following frameworks established by the National Institute of Standards and Technology (NIST). While using these frameworks guides our approach to identifying, assessing, and managing cybersecurity risks relevant to our business, it does not imply compliance with any specific technical standards, specifications or requirements. The program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. In addition, our program emphasizes the maintenance of controls and procedures for the prompt escalation of certain cybersecurity incidents, conducting cybersecurity risk assessments, regularly assessing and deploying technical safeguards, establishing incident response and recovery plans, and mandating annual privacy and cybersecurity training for employees to enhance awareness and response to cybersecurity threats.

companyName: ICAHN ENTERPRISES L.P.

ticker: IEP


text: At the management level, our CISO leads our enterprise-wide cybersecurity program in partnership with other business leaders, including our General Counsel and Chief Operating Officer. These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above. In December 2023, our CISO retired after three years in the position, and a career spanning over twenty-five years as an industry-recognized leader in cybersecurity, information technology, and risk management. Her replacement has served in various roles in information technology, security and risk management for over 15 years, including having previously served as the CISO of two other publicly traded technology companies. In September 2024, our current CISO began transitioning to a new role within the Company, and as a result, we have appointed an interim CISO while we conduct a search for his permanent replacement. Our interim CISO has over 25 years of experience in technology and information security operations across a diverse range of business sectors.

companyName: F5, INC.

ticker: FFIV


text: Our board of directors is responsible for overseeing our strategy and risk management process and discharges its duties both as a full board and through its committees. As reflected in the audit committee charter, our board has delegated to the audit committee oversight of our risk assessment and management process, including processes related to cybersecurity. The audit committee meets at least annually with management, our internal auditor and our contracted Chief Technology Officer to discuss our cybersecurity program in regards to potential significant financial or operational risk exposures and the measures implemented to monitor and address those risks, including those that may result from cybersecurity threats. As necessary or appropriate, these discussions may include our risk assessment and risk management policies. In addition to our multidisciplinary management team, we rely on our internal audit function in collaboration with a third-party information security service provider to lead our cybersecurity risk assessment and management processes and oversee their implementation and maintenance. We have a longstanding relationship with our third-party information security service provider, which includes services from our contracted Chief Technology Officer. The contracted Chief Technology Officer has approximately 16 years of information technology experience, including nine years in the finance and real estate sectors, and our Head of Internal Audit, has approximately 31 years of audit experience, including 21 years in the real estate and financial services sectors.

companyName: Easterly Government Properties, Inc.

ticker: DEA


text: Internally, we have developed a cybersecurity awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The cybersecurity awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: Riley Exploration Permian, Inc.

ticker: REPX


text: Risks from Cybersecurity Threats The CISO, in coordination with our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and CIO monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Management Committee when appropriate.

companyName: EQUITY BANCSHARES INC

ticker: EQBK


text: Our management team, including our Executive Director of IT with supervision by our Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Executive Director of IT has previous experience managing information technology infrastructure and cybersecurity, as well as responding to cybersecurity incidents, at other biopharmaceutical companies.

companyName: Immuneering Corp

ticker: IMRX


text: Oversee Third-party Risk To manage the risks associated with third-party service providers, AppTech conducts weekly calls with its providers to monitor compliance on an ongoing basis. Issues that arise are addressed immediately with mitigating measures added to avoid future problems.

companyName: AppTech Payments Corp.

ticker: APCX


text: Our cybersecurity risk management program is built on a foundation of monitoring, proactive risk mitigation and adherence to industry best practices. Over the past year, we have implemented several key enhancements to further bolster our cybersecurity defenses. A security awareness training program has been introduced across our company to educate employees on cybersecurity threats and best practices. Additionally, we have expanded our asset management capabilities, improving visibility into our technology infrastructure and evaluating advanced solutions for more comprehensive oversight.

companyName: ENTRAVISION COMMUNICATIONS CORP

ticker: EVC


text: The audit committee receives periodic reports from the CISO concerning any significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Sprinklr, Inc.

ticker: CXM