text: With respect to third-party service providers, our information security program includes conducting due diligence of relevant service providers' information security programs prior to onboarding. We also contractually require third-party service providers with access to our information technology systems, sensitive business data or personally identifiable information to implement and maintain appropriate security controls and contractually restrict their ability to use our data, including personally identifiable information, for purposes other than to provide services to us, except as required by law. To oversee the risks associated with these service providers, we work with them to help ensure that their cybersecurity protocols are appropriate to the risk presented by their access to or use of our systems and/or data, including notification and coordination concerning incidents occurring on third-party systems that may affect us. These relevant service providers are contractually required to notify us promptly of information security incidents that may affect our systems or data, including personally identifiable information. While we conduct due diligence on the security and business controls of our third-party service providers and take steps to monitor their compliance with our security requirements, we may not have the ability in all cases to effectively monitor or oversee the implementation of these control measures.

companyName: AbbVie Inc.

ticker: ABBV


text: We depend on information systems and technology in substantially all aspects of our business, including communications among our employees and with suppliers and customers. We recognize the significance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and products and protect the confidentiality, integrity, and availability of our data.

companyName: Kimball Electronics, Inc.

ticker: KE

secItem: Item 1C


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness. We periodically engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Board, the Audit Committee, and the newly formed Technology and Cybersecurity Committee, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

companyName: BLACKLINE, INC.

ticker: BL


text: Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. See "Risk Factors – Information Security and Operational Resilience" in Part I, Item 1A for more information about these and other risks related to information security.

companyName: Mastercard Inc

ticker: MA


text: The Audit Committee of the Board of Directors oversees our cybersecurity program. It considers cybersecurity risk individually and within our overall risk management framework. We obtain periodic assessments of our cybersecurity program from independent third party experts, the results of which assessments are reported to the Audit Committee. Additionally, cybersecurity threats and incidents determined through our cybersecurity program to present potential material impacts to our financial results, operations, and/or reputation are required to be immediately reported to the Audit Committee in accordance with our escalation framework.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Cybersecurity risk management is integrated within our risk management framework. See "Item 7. Management's Discussion and Analysis of Financial Condition and Results of Operations—Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.

companyName: PRUDENTIAL FINANCIAL INC

ticker: PRU


text: Our Information Security Department is led by the CIO, who reports to the President and CEO. Our CIO establishes our strategic direction and provides executive support for our information security program, and has significant experience in information systems and information security. Refer to " Item 10. Directors, Executive Officers and Corporate Governance " for more information.

companyName: Federal Home Loan Bank of Des Moines


text: Risks from Cybersecurity Threats—Likely Material Impact. See Item 1A, "Risk Factors—Risks Related to Our Intellectual Property and Cybersecurity." We do not believe any risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Manhattan.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: incident reporting directly to the Board; and to the Company's Audit Committee and Board as warranted based upon the nature of the identified issue.

companyName: PetVivo Holdings, Inc.

ticker: PETV


text: Our incident response plan provides clear communication protocols, which may include, depending on the incident's classification and other circumstances, our CEO, CFO and COO, our internal and external counsel, our management disclosure committee and the Audit and Cyber Risk Committee and the Board of Trustees. In addition, our COO and CTO/CISO generally engage with external legal counsel with respect to regulatory reporting obligations related to an incident.

companyName: LXP Industrial Trust

ticker: LXP


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies throughout our operations that are designed to address cybersecurity threats and incidents. The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks. The current CISO has over 35 years of experience in technology and information security, including operating in the role of the CISO for several large companies in the pharmaceutical and healthcare industries, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties. The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors.

companyName: REGENERON PHARMACEUTICALS, INC.

ticker: REGN


text: In 2018, in recognition of the unique nature of cybersecurity threats and the desire to apply focused oversight of cybersecurity risk, the Company's Board of Directors formed a Cybersecurity Subcommittee (the "Subcommittee") providing oversight of the Company's cybersecurity posture and reporting to the Board's Audit Committee. The Subcommittee consists of three independent directors with experience and/or expertise in cybersecurity management and oversight. The Subcommittee meets regularly on at least a quarterly basis. The Subcommittee has full access to management and consultants engaged by management and receives regular reporting directly from the Company's chief information officer, head of cybersecurity, internal audit and the legal function, as well as third-party assessments of the Company's cybersecurity processes and posture. In addition, the full Board of Directors receives a report on cybersecurity annually, or as necessary.

companyName: BELDEN INC.

ticker: BDC


text: We regularly assess our adherence to these standards and maintain programs designed to support our compliance with these requirements. External firms audit our compliance with NIST 800-171 CMMC and DFARS every three years. In addition, our cybersecurity processes have been integrated into our overall enterprise risk management system and specific cybersecurity-focused disclosure controls and procedures have been developed. Management continues to support a variety of practices that are intended to align with recognized frameworks and reflect our approach to assess, identify, and manage material risks from cybersecurity threats: • Incident response: We have adopted a Cybersecurity Incident Response Plan (IRP) that applies in the event of a cybersecurity threat or incident to provide a standardized framework for investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel and third-party contractors, vendors, and partners that perform functions or services that require access to secure our information, and to all devices and network services that are owned or managed by the Company. • Regular testing: We engage a third-party cybersecurity firm to conduct an annual network penetration test on our corporate and supervisory control and data acquisition networks. The annual penetration test enables us to assess our existing security controls to identify weaknesses and eliminate vulnerabilities to defend against cybersecurity threats proactively. Our Information Technology team also conducts rehearsals of our IRP to test and enhance our ability to respond to cybersecurity incidents. • Monitoring for risks: We engage a third party cybersecurity firm to manage our Security Operations Center (SOC) who is responsible for monitoring our network traffic 24/7. Our SOC helps to identify and respond to cybersecurity issues in real time by assessing the level of threats and making recommendations on appropriate actions. • Security controls: We incorporate physical- and software-based preventive, detective, and corrective security controls to prevent or detect unauthorized activities and proactively alert us should an unauthorized activity occur within the organization. Early detection can enable the security team to quickly contain and eradicate the unauthorized activity to reduce the time exposure window and the impact of the incident. Our Security Incident Event Management tool monitors security logs, includes detective controls, and helps to identify irregular activities. • Detection and preventative technology: We have implemented multiple technologies designed to help protect our systems from cybersecurity threats, including an intrusion prevention system, next-generation antivirus program, end point protection system, and a data loss prevention security tool. • Regular improvements: We regularly work to enhance our systems and integrate new information and technology to upgrade our systems. We review and approve software and hardware acquisitions to enhance our ability to detect and manage cybersecurity threats. We also engage the FBI, DHS, and Fusion Center for incident response support and collaborate to share critical information.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Risk Management Strategy Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Corporation, including financial, operational, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our Cyber Security Initiative ("CSI") committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization. The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.

companyName: FIRST UNITED CORP/MD/

ticker: FUNC


text: Our approach to managing cybersecurity risks is part of a continuous improvement process, both in the context of cybersecurity and broader operational risk management. This ongoing process, which includes personnel training, is aimed at routinely reviewing and, as necessary, improving, our oversight processes and tools to ensure they remain effective and resilient in their management of cybersecurity risk.

companyName: EQUUS TOTAL RETURN, INC.

ticker: EQS


text: Nuvera's Senior Information Technology and Transport manager and his staff have primary responsibility for identifying, assessing, and managing our exposure to cybersecurity threats and incidents, subject to oversight by the Audit Committee of the BOD of the processes we establish to assess, monitor, and mitigate that exposure. As members of Nuvera's Cybersecurity Committee, the Information Technology and Transport manager and his team bring a combined sixty years of information technology experience at Nuvera in security, incident response, and local and external network architecture. Executive, Finance and Compliance members of Nuvera's Cybersecurity Committee bring over twenty-five years of experience in risk management, regulatory and compliance. Nuvera relies on their CISO from FRSecure for recommendations and direction on strategy, policy, and process. FRSecure has a team with a combined three hundred years of experience in information security with thirty difference certifications.

companyName: Nuvera Communications, Inc.

ticker: NUVR


text: Our Head of Security & Privacy has primary responsibility for assessing and managing our material risks from cybersecurity threats in partnership with our CIO and other business leaders. The Head of Security and Privacy has served in various roles within the cybersecurity field for over 15 years, including security leadership roles in multiple organizations. The Head of Security and Privacy holds an undergraduate degree in information security and forensics and a graduate degree in information assurance and has attained various professional certifications within the field including Certified Information Systems Security Professional and Certified Ethical Hacker certifications.

companyName: Lyft, Inc.

ticker: LYFT


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: A.K.A. BRANDS HOLDING CORP.

ticker: AKA


text: Cybersecurity Risk, Management and Strategy Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. As a financial services company, cybersecurity threats are present and growing, and the potential exists for a cybersecurity incident to disrupt business operations, compromise sensitive data or both. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.

companyName: Esquire Financial Holdings, Inc.

ticker: ESQ


text: As a restaurant and public company, we are subject to Payment Card Industry Data Security Standards ("PCI-DSS") and SOX requirements and we take steps to make sure that we are compliant with those regulations. We also continue to monitor evolving laws and regulations related to security and privacy and look for opportunities to improve our systems based on evolving best practices in the IT industry.

companyName: Portillo's Inc.

ticker: PTLO


text: As the Company focuses on establishing its governance policies and procedures in all areas, in 2025, the Company plans to establish an Information Security Committee (the "ISC") comprised of the VP Infrastructure and Cybersecurity ("VP of IT"), Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and General Counsel ("GC"). The ISC will be the focal point for all information security activities throughout the Company and its subsidiaries. The ISC, led by the VP of IT will work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. The ISC will be charged with continuous improvement and implementation of policies and procedures for incident response handling, monitoring, and addressing security risks on an ongoing basis. The ISC will also be responsible for deploying technology and information security experts to monitor security risks and advise, contain, analyze, and report on security incidents, as necessary. As described above, the Company also retains a third-party cyber security firm to work hand-in-hand with the VP of IT and, once established, the ISC, to develop and oversee a program to prevent, detect, mitigate and remediate cybersecurity incidents.

companyName: TIC Solutions, Inc.

ticker: TIC


text: Our Board considers cybersecurity risk as part of its risk oversight function and is responsible for overseeing the cybersecurity and other information technology risks. Our board also oversees Yubo Beijing's management's implementation of the cybersecurity risk management program.

companyName: Yubo International Biotech Ltd

ticker: YBGJ


text: Our Board of Directors ("Board") considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee receives quarterly briefings from our Chief Information Security Officer regarding the emerging cybersecurity threat and risk landscape as well as our cybersecurity risk management program and related readiness, resiliency, and response efforts. In addition, management will update the Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Kimco Realty OP, LLC


text: Engagement of Third Parties on Risk Management We engage with external experts, including cybersecurity consultants, to support our cybersecurity risk assessment and response program. These partnerships enable us to leverage specialized knowledge and insights. Our collaboration with these third parties includes biennial cybersecurity maturity assessments and consultation on security enhancements.

companyName: BuzzFeed, Inc.

ticker: BZFD


text: We describe whether and how risks from cybersecurity threats are reasonably likely to materially affect us, including our financial performance and results of operations, under the heading "Breaches of our cybersecurity systems could degrade our ability to conduct our business operations and deliver products to our customers, result in data losses and the theft of our intellectual property, damage our reputation, and require us to incur significant additional costs to maintain the security of our networks and data" in Item 1A, "Risk Factors" of Part I of this report.

companyName: ACM Research, Inc.

ticker: ACMR


text: Under the supervision of our SVP, Engineering and our VP, Technology & CISO, the security team takes steps to stay informed about and monitor efforts to prevent, detect and respond to, as well as recovery and remediation efforts with respect to cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and participants in our vulnerability disclosure program; and alerts and reports produced by security tools deployed in our IT environment. The security team, under the leadership of the SVP, Engineering and VP, Technology & CISO, meet periodically to review the status of the cybersecurity program, including, as applicable, the status of regularly monitored cybersecurity benchmarks, responses to external or internal incidence or intelligence, oversight of third-party vendors, and progress against discrete program goals. Trends in risks, risk mitigations, long-term progress against program goals, and discrete intelligence or incidents discussed in these meetings are then shared in periodic cybersecurity reports to the Board.

companyName: Rent the Runway, Inc.

ticker: RENT


text: The Company's information security program is primarily administered at the management level by the Information Security Department, which is led by the Company's Chief Information Officer (CIO), and is supported by Chief Information Security Officer (CISO), and the Information Technology Department, which is led by the Company's Chief Technology Officer (CTO). The Company's Information Security Department is responsible for day-to-day management of the Company's information security program, including data loss prevention, access control, threat monitoring, incident response and employee education and training. The Information Security Department also maintains policies related to cybersecurity and data security that provide the required governance for the information security program. Additionally, the Company's Information Technology Department maintains policies that govern technical aspects of the Company's information security program. Each policy is reviewed and approved by the Board at least annually. The Information Security team maintains and runs the Company's security operations center and is responsible for cybersecurity event management and maintaining security tooling. The Company also maintains an Information Technology Management Committee, which is comprised of representatives from the Information Security, Information Technology, Enterprise Risk, Operations, and members of executive management. This committee meets at least quarterly to discuss and review the Company's information security program and receives qualitative and quantitative update reports from the Information Security Department, Internal Audit Department, and Information Technology Department.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: All customer and app user information is stored directly within Shopify, Amazon Seller, and Amazon Web Services platforms, which provide market-leading data security for their centralized servers. On occasion, limited amounts of customer information such as names and emails are exported from these systems solely for the purposes of accounting and filings, and is never shared outside of the Company and its contracted accounting consultants, which are under confidentiality agreements. Highly sensitive customer payment information is generally never revealed to the Company in any capacity and is hidden by payment processors for security purposes, with the sole exception being some wholesale accounts who provide written or digital copies of credit card information for payment processing on agreed upon terms. Such information is secured on locked Company computers and never distributed.

companyName: Innovative Eyewear Inc

ticker: LUCY


text: As part of our enterprise resource planning, we also employ systems and processes designed to oversee, review, identify, and reduce the potential impact of a security incident occurring at third-party vendors and service providers with direct implications to the Company's systems and internal controls or otherwise implicating the third-party technology and systems we use.

companyName: SILVERBOW RESOURCES, INC.


text: Cybersecurity risks are overseen by the Board of Directors and the Audit Committee. The Audit Committee is central to the Board of Directors' oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any cybersecurity incident experienced by the Company has materially affected or is reasonably likely to materially affect Wiley, including our business strategy, results of operations, or financial condition. For additional information about cybersecurity risks, see Item 1A. "Risk Factors. "

companyName: JOHN WILEY & SONS, INC.

ticker: WLY


text: Over the past fiscal year, we have not identified risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition.

companyName: Zeo Energy Corp.

ticker: ZEO


text: Management's Role: Day-to-day management of cybersecurity is handled by our IT staff, who do not have specialized training in cybersecurity. We are considering enhancing this role or outsourcing to professionals with specific cybersecurity expertise.

companyName: T3 Defense Inc.

ticker: DFNS


text: The IT Security Team reports to the Cybersecurity Subcommittee on a quarterly basis to inform the committee about and monitoring, prevention, detection, mitigation, and remediation of cybersecurity incidents, and is tasked with notifying the Cybersecurity Subcommittee of a cybersecurity incident upon discovery.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: Our cybersecurity risk management program is led by our Chief Information Security Officer ( CISO), who oversees a dedicated cybersecurity and risk management team, which works in partnership across the Company, under the direction of our Chief Information Officer (CIO). Our CISO has over 20 years of experience working in defense and cybersecurity and has served in various cybersecurity leadership roles within Fortune 500 companies. He and our cybersecurity team have extensive experience in leading and addressing IT risk management, security architecture and engineering, security operations, data security, and identity and access management. Our CISO also works closely with our legal team to oversee compliance with legal, regulatory and contractual security requirements.

companyName: HOLOGIC INC

ticker: HOLX


text: Following this initial stage, we gather and update impact information and related documentation for such incident. We use an incident classification matrix to determine the initial classification of a potential information security incident, which considers users, customers, and systems affected, the sensitivity of data at risk, and the potential business impacts to the Company, including financial, legal, regulatory, operational, and reputation. The resulting classification of "Red," "Yellow," or "Green" identifies next steps for escalation and communication following initial investigation of the potential incident. Upon escalation of an incident, a member of management who is identified as an Incident Response Contact per our Information Security Program reviews and validates the initial determination of the priority of the incident prior to entering into the subsequent stage, during which a response to the incident is determined and notifications or communications are made to either additional personnel or any external entities. Depending on the specific details of any such incident, we may notify additional members of our management team, our board of directors, the Audit Committee, state and federal regulators, technology service providers, and/or the SEC. The timing of such communications varies based on the details of a particular incident and applicable regulations governing such disclosure. Following this classification and communication stage, we enter the recovery stage to determine containment and a response to the incident, assign technical staff to address such incident, implement containment, eradicate the incident source, and recover from such incident. Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our cybersecurity personnel maintain current knowledge through training, obtaining professional certifications, and participation in industry groups such as FS-ISAC, American Bankers Association and Mid-Sized Banking Coalition of America. Company cybersecurity personnel expand and test their knowledge of cyber threats and countermeasures through additional on-the-job training and periodic simulated exercises to practice their response to real-life threats. We maintain a training budget and personnel are encouraged to obtain formal training and industry-approved certifications as appropriate for their roles and responsibilities. Some of the certifications held by our information security personnel include CERT Insider Threat Program Manager, GIAC Information Security Professional, GIAC Security Leadership, GIAC Continuous Monitoring, GIAC Certified Forensic Analyst, CompTIA Security+ and ISC2 Certified Information Systems Security Professional.

companyName: HOME BANCSHARES INC

ticker: HOMB


text: Our Director of Operations & Information Technology regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management team.

companyName: ENERGY FOCUS, INC/DE

ticker: EFOI


text: We have processes in place to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers. All proposed third parties are subject to a preliminary assessment to identify those that may handle or have access to company information and scope appropriate due diligence activities relating to the engagement. Third parties that may handle or have access to company information are subject to enhanced due diligence procedures prior to onboarding and security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by third parties and information obtained through other channels. In addition, we require our providers to adhere to appropriate security requirements and controls, and we investigate security incidents that have impacted our third-party service providers, as appropriate.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: We conduct regular risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We perform internal audits of our cybersecurity procedures, review data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We received ISO 27001 certification in 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, 2023, as amended on December 29, 2023 and January 12, 2024 and followed by a Current Report on Form 8-K on May 28, 2024. On June 21, 2024, the Company received a complaint, on a class action basis, relating to the incident in the fourth quarter of 2023. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.

companyName: First American Financial Corp

ticker: FAF


text: We rely on a multidisciplinary team, including our information security organization, legal department, management, and third-party service providers, as described further below, to assess, identify, and manage cybersecurity threats and risks.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: Our chief financial officer provides an update to the Board of Directors on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Board of Directors of any material threats or incidents that arise.

companyName: Ondas Inc.

ticker: ONDS


text: We operationalize our cybersecurity program through an information security management system based on the ISO/IEC 27001:2022 standard. This does not imply that we meet any particular technical standards, specifications, or requirements - only that we use the ISO/IEC 27001:2022 standard as a guide in designing and implementing our cybersecurity program. We believe designing and building our cybersecurity program around best practices and principles helps support robust business continuity.

companyName: Clearfield, Inc.

ticker: CLFD


text: Identification of reasonably foreseeable internal and external threats Assessment of the likelihood and potential impact of identified threats Evaluation of the sufficiency of policies, procedures, and technical measures to manage risks Regular testing and auditing of our security controls All employees undergo mandatory security awareness training upon hiring and annually thereafter. This training covers best practices, emerging threats such as phishing and social engineering, and incident response procedures. We also conduct regular phishing simulation exercises to reinforce training and identify areas for improvement.

companyName: Guerrilla RF, Inc.

ticker: GUER


text: We also maintain an incident response plan, which outlines our procedures for detecting, responding to and recovering from cybersecurity incidents. The incident response plan includes processes to triage, assess severity for, escalate, contain, investigate, and remediate the cybersecurity threats and incidents, as well as to assist in complying with potentially applicable legal obligations and mitigating brand and reputational damage.

companyName: Inari Medical, Inc.


text: Material Effects from Risks of Cybersecurity Threats We do not believe any risks from cybersecurity threats, including any past cybersecurity incidents, have materially affected the Company, including our business strategy, results of operations or financial condition. There can be no assurances, however, that we or our third-party service providers will not experience a future system disruption, attack or security breach that materially impacts the Company, our business strategy, results of operations or financial condition. For more information refer to "Item 1A. Risk Factors—Risks Related to Our Business—We rely on information technology in our operations, and any material failure, inadequacy or security failure of that technology could harm our business".

companyName: EQC Liquidating Trust


text: We have identified and, as appropriate and when we have the budget to do so, will utilize outside consultants, including contractors and other third parties, to among other things, conduct regular testing of our networks and systems to identify vulnerabilities through penetration testing, while also measuring and advising on potential improvements to our incident prevention, response, and documentation have not encountered cybersecurity threats or experienced previously cybersecurity incidents that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: AVAX ONE TECHNOLOGY LTD.

ticker: AVX


text: Management is responsible for developing cybersecurity programs, including as may be required by applicable law or regulation. These individuals' expertise in IT and cybersecurity generally has been gained from a combination of education, including relevant degrees and/or certifications, and prior work experience. They are informed by their respective cybersecurity teams about, and monitor, the prevention, detection, mitigation and remediation of cybersecurity incidents as part of the cybersecurity programs described above.

companyName: ENCORE WIRE CORP


text: Philosophy and Strategy As part of our overall risk management strategy, we have increased our attention to cybersecurity. Responsibility for cybersecurity risk management is a team effort, with day-to-day oversight and management from our executive and information technology ("IT") teams, the Audit Committee taking a more active role in setting both proactive and reactive strategies and our Board overseeing our efforts and helping to guide our strategy.

companyName: Portillo's Inc.

ticker: PTLO


text: We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We take steps designed to ensure that such vendors have implemented data privacy and security controls that help mitigate the cybersecurity risks associated with these vendors, depending on the nature and sensitivity of the supplier and data they process on our behalf. We routinely assess our high-risk suppliers' conformance to industry standards (e.g., ISO 27001, ISO 28001, and C-TPAT), and we evaluate them for additional information, product, and physical security requirements. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.

companyName: NVIDIA CORP

ticker: NVDA


text: We perform response simulations, tabletop exercises and recovery tests on a quarterly basis. In addition, we engage external consultants to perform penetration testing at least annually. Our cyber crisis management program includes a documented plan that provides overall coordination of our response to a major cyber incident as well as a resource engagement plan. As part of our crisis management plan, our cyber crisis communication plan accounts for timely and accurate dissemination of information to stakeholders during the crisis. Other components of our crisis management plan are our business continuity plan, that documents the application of specific strategies and measures to enable core business activities to continue during a cyber event, and our disaster recovery plan, that is designed to restore data and systems to their operational state. The ongoing development and maturity of our cyber crisis management program is reported to senior management quarterly.

companyName: Reynolds Consumer Products Inc.

ticker: REYN


text: Rigorous controls are in place to mitigate risks associated with third -party service providers, including security risk assessments and contractual security requirements.

companyName: OPKO HEALTH, INC.

ticker: OPK


text: Our Information Security Officer is accountable for overseeing and directing our Information Security Program. The responsibilities include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the Information Security Officer, provides guidance, oversight, monitoring and challenge of the first line's activities. The second line of defense function is separated from the first line of defense function through organizational structure and ultimately reports directly to the Chief Risk Officer. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Information Security Officer has over ten years of information security experience and four cybersecurity related certifications.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information technology systems, our information security and compliance team utilizes a regularly updated cybersecurity incident response plan ("IRP"). The IRP has been designed taking into account a third-party cybersecurity framework focused on properly containing, investigating, and fully eradicating an incident. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing and resolving the incident as quickly and efficiently as possible, mitigating damage to the Company's systems and networks, minimizing impact on the Company's stakeholders, analyzing and executing upon reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team, including specified external forensic investigators and advisors, will depend on the particular facts and circumstances, the response team is led by the Vice President, IT Security & Compliance or his delegee. The plan also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident. Pursuant to its charter, the Audit Committee of the Board, which consists solely of independent directors and whose chair has cybersecurity experience, reviews, discusses with management, and oversees the Company's privacy, information technology and security and cybersecurity risk exposures, including: (1) the potential impact of those exposures on the Company's business, financial results, operations and reputation; (2) the programs and steps implemented by management to monitor and mitigate any exposures; (3) the Company's information governance and information security policies and programs; and (4) major legislative and regulatory developments that could materially impact the Company's privacy, data security and cybersecurity risk exposure. The Audit Committee receives quarterly updates from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team, including a detailed threat assessment relating to information technology and cybersecurity risks as well as short- and long-term plans to mitigate identified risks and invest in new technological solutions and resources to support our cybersecurity program. The Board also receives updates on cybersecurity matters from the Company's Senior Vice President, Information Technology, Vice President, IT, Security & Compliance, internal audit function, and/or other members of our executive leadership team on at least an annual basis, with periodic updates provided as needed. The Audit Committee and the Board consider cybersecurity as part of the Company's business strategy, financial planning, and capital allocation.

companyName: Playa Hotels & Resorts N.V.


text: We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies and categorizes significant cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists, developed a risk mitigation plan to address such cyber risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Our ISC members includes our Chief Information Security Officer ("CISO") and our Director of IT Security, Risk and Compliance who have a combined 20 years of risk management experience encompassing cybersecurity and technology security, such as threat assessments, risk management, cybersecurity insurance, incident response, end user awareness and vulnerability management.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: The Company has engaged a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: All employees participate in multiple information security training programs. Employees receive training on how to identify and report cyber risks and events through our cybersecurity awareness program. Additionally, we hold cybersecurity risk insurance.

companyName: MATRIX SERVICE CO

ticker: MTRX


text: We face various cybersecurity threats that could adversely affect our business, financial condition, and results of operations. We have implemented processes and procedures to assess, identify, and manage these risks, as well as to respond to and mitigate the impact of any potential or actual cybersecurity incidents to our information systems and the information residing therein. Our processes for assessing and identifying cybersecurity risks include regular network security assessments, vulnerability scans, penetration tests, and audits of our information systems, as well as monitoring and analysis of network activity and threat intelligence. We engage third-party service providers to assist us with some of these activities. We also have processes to oversee and identify cybersecurity risks associated with our use of third-party service providers, such as conducting due diligence, reviewing contracts, and verifying compliance with security standards and best practices. Our cybersecurity risk management processes have been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. We identify our enterprise risks through each member of our management team, along with counsel from our internal auditors and attorneys and we present an assessment of our enterprise risks to our board of directors on an annual basis. Our information technology management plays an integral part in the identification and communication of cybersecurity risks to our management team.

companyName: Superior Drilling Products, Inc.


text: Our Advisor has identified a Cyber Incident Response Team, or Response Team, who is responsible for providing appropriate oversight, strategic direction, and decision making for an event that potentially could cause a material impact to our business. Our Response Team includes our Chief Financial Officer, Chief Compliance Officer and General Counsel, and Vice President of Operations and these individuals are responsible for coordinating the incident response, including any required notification to our Audit Committee or our Board.

companyName: Horizon Technology Finance Corp

ticker: HRZN


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team ("CSIRT") and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the service level agreements ("SLAs") in place with third parties, and the role third parties may play in specific response scenarios. Effective February 2, 2024, our CIO retired from employment and continued to serve as our CIO as a contractor through May 2024. During that time, he continued his existing duties including oversight and management of cybersecurity risk. In June 2024, the Company announced the hiring of a new CIO who will lead the enterprise technology team. The new CIO has over 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies.

companyName: TENNANT CO

ticker: TNC


text: Our Information Technology department works collaboratively with our third-party vendors to coordinate a mutually beneficial approach to cybersecurity in the specific context in which risk is presented. These collaborations sometimes take place on a rolling basis, and sometimes take place on a semi-annual or annual basis.

companyName: FONAR CORP

ticker: FONR


text: These reports cover a broad range of topics, including: • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards The SVP IT regularly informs our executive management group of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity environment and potential risks facing us. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: TANGER PROPERTIES LTD PARTNERSHIP /NC/


text: We have not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: HESS CORP


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we face certain ongoing risks from cybersecurity threats, that, if realized, may, among other things, cause material disruptions to our operations, which may materially affect us, including our business strategy, results of operations, and/or financial condition. For more information about these risks, see the risk factor titled, "Our business could be negatively affected by security threats, including cybersecurity threats, destructive forms of protest and opposition by activists and other disruptions" under Item 1A of Part I of this Annual Report.

companyName: Amplify Energy Corp.

ticker: AMPY


text: Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.

companyName: 60 DEGREES PHARMACEUTICALS, INC.

ticker: SXTP


text: We support the security systems by the usage of penetration testing, security audits, and ongoing risk assessments. We have a well-established incident response process that includes a rapid escalation of critical events to all senior leadership stakeholders. Our leadership team is led by our Chief Technology Officer (who is also a seasoned Chief Information Security Officer) who is responsible for implementing and maintaining a team of trained cybersecurity professionals. Senior leadership holds as needed, monthly, and quarterly governance meetings strictly focused on the management of our cybersecurity program and data practices. Our governance program includes a working team which encompasses several highly trained and experienced cybersecurity professionals as well as a steering committee including our CEO, CFO, and COO. In both the working and steering committee meetings, related and relevant risks are identified, tracked, mitigated, and reported to appropriate leaders, including the Board of Directors.

companyName: HIGH WIRE NETWORKS, INC.

ticker: HWNI


text: Our leadership team includes seasoned professionals with deep expertise in technology and security. Our CIO, Todd Weathersby, has more than 25 years of experience in global IT and cybersecurity management, and our ISO has more than 25 years of experience in cybersecurity, risk, and compliance (with certifications such as CISSP and CISM). The knowledge and experience of our CIO and ISO, along with the Board's active engagement, provides a strong oversight of our cybersecurity strategy. The Board and management also receive regular briefings and training sessions regarding emerging cybersecurity threats and regulatory developments in order to be positioned to adapt to new challenges in the cybersecurity landscape.

companyName: OSI SYSTEMS INC

ticker: OSIS


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of the Company's management. In particular, the Chief Financial Officer is responsible for hiring appropriate personnel and engaging external service providers with relevant cybersecurity expertise, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and technologies, and reviewing security assessments and other security-related reports. In addition, the Chief Financial Officer provides reports to the Audit Committee concerning the Company's cybersecurity posture and significant threats and risks and the processes to address them.

companyName: Loop Industries, Inc.

ticker: LOOP


text: We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents. However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident. The CISO coordinates the Company's response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.

companyName: EAGLE BANCORP INC

ticker: EGBN


text: Our information technology and internal audit teams utilize frameworks based on industry standards to identify and mitigate information security risks and oversee an active cybersecurity training program. For example, in January 2023, our information technology team held a tabletop exercise with senior management to consider different cybersecurity scenarios. Our information technology team also recently worked with various third-party consultants to update our incident response plan.

companyName: W. P. Carey Inc.

ticker: WPC


text: Members of the internal working group have multiple decades of experience in information security and risk management, including assessing cybersecurity threats. Furthermore, the CTO and CISO have educational backgrounds and hold professional experience and certifications relevant to management of cybersecurity.

companyName: Kayne Anderson BDC, Inc.

ticker: KBDC


text: CenterPoint Energy's CISO joined the Company in September 2024 and has over two decades of experience serving in multiple global leadership roles in cybersecurity, as well as technology and industrial systems at a Fortune 500 global industrial company, for which he was responsible for, among other things, building and maintaining enterprise programs relating to cybersecurity and managing cybersecurity risk. Our Executive Vice President and General Counsel has significant risk management, governance and litigation experience, which we believe are important leadership skills to help incorporate risk management, legal, disclosure and governance perspectives into the design of our cybersecurity program and in evaluating and responding to potential cybersecurity incidents.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Notwithstanding our efforts at cybersecurity, the Bank cannot guarantee that those efforts will successfully prevent or mitigate a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Bank, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.

companyName: RBB Bancorp

ticker: RBB


text: Our overall information security program applies an enterprise-wide, risk-based approach to information security that enables us to assess, identify, and manage risk exposures, including material risks from cybersecurity threats, in a timely manner. Our information security operations and procedures provide a comprehensive Information Security Management System ("ISMS") enabling us to maintain the confidentiality, integrity, and availability of information and systems in our environment. Our information security policies are based on National Institute of Standards and Technology Special Publication 800-171 framework and apply to the entire enterprise.

companyName: Keysight Technologies, Inc.

ticker: KEYS


text: In the event of a cybersecurity incident, the IT Department promptly reports the matter to the Board. The Board is ultimately responsible for assessing the severity and potential impact of the incident and determining the appropriate course of action. The IT Officers keep the Board informed of significant cybersecurity incidents and provides updates on the overall status of our cybersecurity program as needed.

companyName: RiskOn International, Inc.


text: Our corporate information technology, communication networks, enterprise applications, accounting and financial reporting platforms, and related systems, and those that we offer to our tenants are necessary for the operation of our business. We use these systems, among others, to manage our tenant and vendor relationships, for internal communications, for accounting to operate record-keeping function, and for many other key aspects of our business. Our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: The Corporation's Board of Directors, including the Audit Committee, oversees all risk management policies, procedures, and practices, including those related to cybersecurity. Senior management generally reports quarterly, or more frequently as necessary, to the Enterprise Risk Committee on technology risks, including those from cybersecurity threats. The Board's Audit Committee and the Board of Directors receive these reports as part of their risk management oversight responsibilities. Board members have direct access to senior management and other relevant personnel and may direct questions and request further information as needed to fulfill their oversight responsibilities.

companyName: PROVIDENT FINANCIAL HOLDINGS INC

ticker: PROV


text: We are not aware of any existent weakness in our systems or malware embedded in our systems that would materially affect, or are reasonably likely to materially affect, our operations.

companyName: MedWellAI, Inc.

ticker: MWAI


text: Management's Role Managing Risk The cybersecurity risk management processes described above are managed by our CISO who reports directly to our Chief Financial Officer. Our CISO has over 25 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries. Our CISO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: Our cybersecurity risk assessment and management processes are implemented and maintained by members of management, including our Senior Director, IT & Facilities and our Senior Manager, IT Infrastructure and Operations. Our Senior Director, IT & Facilities has over 26 years of experience in systems engineering, network design and security and is a Certified Information Systems Security Professional, or CISSP. Our Senior Manager, IT Infrastructure and Operations has over 24 years of experience in network administration, security administration and incident response and remediation.

companyName: CERUS CORP

ticker: CERS


text: We employ processes for assessing, identifying, and managing material risks from cybersecurity threats that are incorporated into our overall risk management system. These items are designed to help protect our information assets from internal and external threats and protect the integrity and confidentiality of our data. Our system includes procedural and technical safeguards, response plans, and reviews of our policies. We engage various external entities, including consultants, to improve and enhance our cybersecurity oversight. We provide all employees and consultants with cybersecurity and prevention training including timely and relevant topics covering social engineering, phishing, mobile security, and data protection and the need for reporting incidents and suspicious events immediately.

companyName: TFF Pharmaceuticals, Inc.


text: In the event of a cybersecurity breach, our readiness, responsiveness and resiliency are critical. As part of our continuing efforts to assess and enhance our readiness and responsiveness, we conduct periodic mock practice scenarios in which participants at various levels of the Company — including employees responsible for responsive actions in the event of a breach, IT technical personnel and members of senior management — play out responses to various cybersecurity breach scenarios. Thereafter, we debrief and identify areas of improvement, to continually develop response capabilities and processes that are as efficient and that operate as quickly as possible in the event of a breach, to reduce potential harm that could be caused by inefficiencies and delay. Additionally, we regularly assess our systems' resiliency and recovery capabilities in case of a cybersecurity breach, both self-managed as well as by qualified third parties.

companyName: Sylvamo Corp

ticker: SLVM


text: The Company maintains comprehensive policies, procedures, and controls to protect the Company's information systems and related data from cybersecurity threats and incidents. The Company's cybersecurity program is led by its Chief Information Security Officer ("CISO") and supervised by its Chief Information Officer ("CIO"). The Company's cybersecurity program is a component of its overarching enterprise risk management program and interfaces with other functional areas within the Company, including, but not limited to, legal, accounting, risk management, human resources, internal audit, as well as external third-party partners, to identify, understand, and combat potential cybersecurity threats. Our cybersecurity program is aligned with three recognized control frameworks: ISO 27001; 2013, NIST SP 800 – 52; and the Center for Internet Security Top 20 Critical Security Controls. We conduct ongoing and robust testing of our systems, including penetration testing, internal and external audits, tabletop incident response exercises, and an annual Cyber Risk Assessment, the results of which are shared with the Audit Committee.

companyName: GMS Inc.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Star Holdings

ticker: STHO


text: External auditors regularly examine LiveRamp's security posture. We engage with auditors directly on an annual basis to assess controls specific to a particular scope and compliance standard (e.g. SOC 2 or ISO 27001). External auditors also perform assessments on behalf of our customers to validate our compliance with specific customer requirements. Furthermore, on a periodic basis, an external audit is sponsored by the Board of Directors to perform an independent assessment of the capability maturity of LiveRamp's security program.

companyName: LiveRamp Holdings, Inc.

ticker: RAMP


text: 1.Internal Expertise: Our CTO is responsible for overseeing the Company's IT infrastructure and cybersecurity and reports to our executive management team and the Technology Steering Committee of our Board.

companyName: NewtekOne, Inc.

ticker: NEWT


text: To effectively assess, identify, and manage material risks from cybersecurity threats, the Company maintains a cyber risk management program, which is led by our Chief Information Security Officer and Vice President of Infrastructure Services and Supply Chain Systems (the "CISO"). The CISO reports to the Senior Vice President and Chief Information Officer (the "CIO"), who in turn reports to the CFO.

companyName: CARTERS INC

ticker: CRI


text: Upon detection of a potentially material cybersecurity incident, such as the Previously Disclosed Cyber Incident, management will inform the Audit Committee and/or our Board of Directors and, if the incident is deemed material, will disclose the incident pursuant to SEC rules and regulations.

companyName: KEY TRONIC CORP

ticker: KTCC


text: Certain of Walmart's systems and those of our third-party service providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. Additional information about cybersecurity risks we face is discussed in " Item 1A. Risk Factors," which should be read in conjunction with the information above.

companyName: Walmart Inc.

ticker: WMT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program, including legal, compliance, strategic, operational, and financial risk areas. The cybersecurity risk management program includes: assessments designed to help identify material cybersecurity risks to our critical systems, information, and broader enterprise IT team principally responsible for managing (i) cybersecurity risk assessment processes, (ii) security controls, and (iii) response to cybersecurity incidents; use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of security controls; awareness training for users and senior management, including through the use of third-party providers for regular mandatory training;

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Cyber Risk Governance Our Cyber Risk Management Strategy described in this Item 1C. is overseen by senior executives with experience in cybersecurity and our business operations and is ultimately overseen by the Risk Committee of the Board. Our Global Security Organization is tasked with executing this strategy through the implementation of cybersecurity policies, procedures, and strategies. In the event that a cybersecurity risk is identified, as and to the extent appropriate, the Global Security Organization manages the day-to-day response to such material risk and provides regular reports to the ERM Steering Committee, or the Risk Committee of the Board, or the Board, as appropriate. The CSO is also an advisor to the Company's Disclosure Committee, which meets quarterly.

companyName: TRINET GROUP, INC.

ticker: TNET


text: Cybersecurity Risk Management & Strategy PetIQ has implemented and maintains various information security processes and systems designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including confidential information that is proprietary, strategic, or competitive in nature ("Information Systems and Data").

companyName: PetIQ, Inc.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management ("ERM") approach, which is subject to oversight by our Board of Directors (the "BOD").

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: We utilize multiple information systems, including accounting software, customer relationship management solutions, our mobile app, online ordering platforms, point-of-sale software and data warehouse. In the ordinary course of business, we collect, and our franchisees may collect confidential information.

companyName: POTBELLY CORP

ticker: PBPB


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports directly to our Chief Executive Officer.

companyName: SANMINA CORP

ticker: SANM


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • periodic comparison of our processes to standards set by the National Institute of Standards and Technology; • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual review of our consumer-facing policies and statements related to cybersecurity; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • conduct annual cybersecurity training for all employees and contractors, along with targeted training on a quarterly basis for specific subsets of employees identified through our phishing simulations; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network and endpoint monitoring and vulnerability assessments to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • conduct vulnerability scans and leverage the scan results to continuously patch and manage our network as new threats emerge; and • active monitoring by our contracted 24x7 Security Operations Center.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: • We perform risk assessments periodically at both an enterprise level and system level in addition to assessments performed by third parties; • Our information security team performs threat monitoring services; • Our Internal Audit function performs annual reviews of selected systems and applications to test certain controls; • Independent consultants evaluate selected systems and applications on an annual basis; • We perform risk assessments of third-party vendors and perform ongoing risk-based monitoring of those third parties; and • We maintain a business continuity plan for execution in the event of a cybersecurity incident.

companyName: Priority Technology Holdings, Inc.

ticker: PRTH


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's overall risk management processes include an assessment of risks posed to data that is critical to our business operations (e.g., to support financial reporting, process payroll, and collect and maintain property and lease information).

companyName: FrontView REIT, Inc.

ticker: FVR


text: Management is informed of cybersecurity risks and activities as part of the quarterly business review of the Information Technology function.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Cyber partners are also a key part of our cybersecurity infrastructure. We partner with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. We engage periodically with these partners to monitor and maintain the performance and effectiveness of cybersecurity products and services that are deployed in our environment.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: Our cybersecurity program, which is overseen by the C-ROC, is managed by an internal team that is responsible for enterprise-wide cybersecurity strategy, policies, engineering and processes. The team is led by our Chief Technology Officer, who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls. The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.

companyName: BLUE OWL CAPITAL INC.

ticker: OWL


text: The Company's cybersecurity and data privacy programs are implemented and overseen by the Company's Chief Information Security Officer ("CISO"), the Executive Vice President, Chief Digital and Technology Officer, and senior management. The information security team responsible for managing and implementing the Company's cybersecurity and data privacy programs has many years of valuable business experience managing risks from cybersecurity threats and data privacy breaches and developing and implementing cybersecurity and data privacy policies and procedures.

companyName: BRISTOL MYERS SQUIBB CO

ticker: BMY


text: The Company's Enterprise Risk Management Committee, which is a management committee consisting of certain employees of the Company, including the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Credit Officer, Chief Administrative Officer, Chief Information Officer, and Chief Risk Officer, oversees implementation and monitoring of the Information Security Policy and Program. Testing of the Information Security Policy and Program is accomplished through the use of a comprehensive Information Systems Audit that is performed, at a minimum, on an annual basis by third-party expert consulting firms, the results of which are reviewed with the Risk Oversight Committee and Audit Committee. The Company also conducts an internal and external penetration test, at a minimum, on an annual basis by outside expert consulting firms. In addition, in accordance with the Information Security Policy and Program, the Company's Enterprise Risk Management Committee assesses information security risks on at least an annual basis, or more often in response to changes in products or services that are offered, technological changes, changes in the threat landscape facing the Company, including as a result of cybersecurity incidents affecting financial institutions or their vendors generally or any change that may materially affect the Company's risk environment.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Risk Identification and Assessment The information security team conducts periodic risk assessments, which includes penetration testing and vulnerability scanning, on the Company's Information Technology ("IT") infrastructure, systems, and networks to identify potential vulnerabilities, weaknesses, and risks, and evaluates the potential impact of cybersecurity risks on the Company's operations, financials, and business.

companyName: IMAX CORP

ticker: IMAX


text: Ashland's information security program is led by the Company's Cyber Security Director who has more than 25 years of experience in information technology and 5 years of experience serving in a deputy chief information security officer role or top executive leader in cyber. Our Cyber Security Director is primarily responsible for integrating cybersecurity risk considerations into the Company's overall risk management strategy. In addition, other members of the Company's information security team also have significant experience in information security.

companyName: ASHLAND INC.

ticker: ASH


text: We have used a cybersecurity threat defense system to address both internal and external threats. This system encompasses various levels, including network, host and application security and incorporates systematic security capabilities for threat defense, monitoring, analysis, response, deception and countermeasures. We strive to manage cybersecurity risks and protect sensitive information through various methods, including technical safeguards, procedural requirements, an intensive monitoring program on our corporate network, a robust incident response program, a review of the effectiveness of our security system with reference to applicable security standards by qualified third parties and regular cybersecurity awareness training for employees. We continuously monitor the performance of our apps, platforms and infrastructure to enable us to respond quickly to potential problems, including potential cybersecurity threats.

companyName: CHINA PHARMA HOLDINGS, INC.

ticker: CPHI


text: Cybersecurity threats of all types, such as attacks from computer hackers, cyber criminals, nation-state actors, social engineering and other malicious internet-based activities, continue to increase generally in business and society. We believe that our current preventative actions and response planning provide adequate measures of protection against cybersecurity risks. While we have implemented measures to safeguard our information technology systems, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.

companyName: Salamander Innisbrook, LLC


text: As part of our overall risk management processes, our employees at all levels are trained on foundational cybersecurity practices annually, and periodically participate in various activities aimed at increasing their awareness of cybersecurity threats and reinforcing their understanding of our security policies.

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Our cybersecurity threat and risk management processes also involve assessing third-party risks. We maintain a Vendor Management Policy pursuant to which we assign a risk rating and assess third-party risks by conducting cybersecurity due diligence on our vendors, suppliers, and other entities with whom we do business. Due diligence includes, as appropriate, either requiring proof of security standard compliance or satisfactory responses to our Vendor Assessment Security Questionnaire. We also evaluate the cyber practices of, and cybersecurity risks associated with, the engagement of third-party service providers, including when we negotiate cybersecurity and data privacy contract terms, such as those relating to information security and audit rights.

companyName: Bitcoin Depot Inc.

ticker: BTM


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, our gathering and compression and water handling services, processing and recording financial and operating data, oversight and analysis of our operations and communications with the employees supporting our operations and our customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: Antero Midstream Corp

ticker: AM


text: Our cybersecurity infrastructure is based on a multi-layered defense framework, aligned with the U.S. National Institute of Standards and Technology guidelines. We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation. The scope of our evaluation encompasses risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by third-party service providers, ensuring the service providers adhere to our security standards, thereby safeguarding our integrated operations. The strategic migration of our data centers and infrastructure to secure cloud environments, coupled with the implementation of targeted technical cybersecurity measures, underscores our dedication to establishing foundational security across our users, applications, data, systems, and networks.

companyName: Inogen Inc

ticker: INGN


text: The Company has an Information Security Risk Management Program and a Technology Risk Management Program under its Risk Management Framework for the identification, assessment, measurement, mitigation, monitoring, and internal reporting of risks associated with its information systems, information assets, and third parties, including vendors and service providers. The Information Security Risk Management Program and Technology Risk Management Program align with the Company's Third-Party Risk Management Program in regard to protecting information assets.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Our CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Information Security Team conducts exercises to prepare for cybersecurity incidents, approves cybersecurity processes, and reviews security assessments and other security-related reports.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Our management team, led by our CISO and Sr. Director of Information Security, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include, among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development, and proprietary technologies ("Information Systems and Data").

companyName: Allogene Therapeutics, Inc.

ticker: ALLO


text: Management's Role in Cybersecurity Risk Management Management is actively involved in assessing and managing material risks from cybersecurity threats. The following processes are in place: • Responsible Positions/Committees: The Chief Information Officer, and Chief Information Security Officer are responsible for assessing and managing cybersecurity risks. The individuals in these roles possess extensive expertise in cybersecurity. Specifically, the Chief Information Officer has over 25 years in Information Technology across multiple industries, and the Chief Information Security Officer has over 25 years in Security, Risk, Audit, and Compliance across various sectors, including both public and private. • Monitoring and Response Processes: We have established processes to inform and monitor cybersecurity incidents for prevention, detection, and resolution using a 24/7 third-party SOC Managed Service. The SOC is responsible for providing alerts, updates, and remediation services as needed by monitoring all technology assets for potential signs of compromise and conducting threat hunt exercises. • Reporting to the Board: Information about cybersecurity risks is regularly reported to the Board of Directors or its relevant committee. This reporting includes updates on our cybersecurity risk profile, significant incidents, and the effectiveness of mitigation strategies.

companyName: LEE ENTERPRISES, Inc

ticker: LEE


text: We engage third parties to conduct annual penetration testing, and we use external risk assessors to measure our program to industry standard frameworks. Our information security management system is certified to the ISO/IEC 27001:2013 standard by the British Standards Institution (BSI); certificate IS 780367. We also collaborate with experts and industry partners to exchange information about threats, best practices, and trends.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Although in the periods reported we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents, including penalties and settlements, were immaterial, we may experience such incidents in the future and the scope and impact of any such future incidents cannot be predicted. To prepare for any such event, we have a full Disaster Recovery plan in place that is tested annually to ensure resilience against a myriad of threats.

companyName: R F INDUSTRIES LTD

ticker: RFIL


text: We have implemented cybersecurity practices appropriate for the size and complexity of our operations. Our IT systems are professionally managed, and access to Company data is restricted to authorized personnel using secure access protocols.

companyName: Paramount Gold Nevada Corp.

ticker: PZG


text: The Incident Response Team, or the IRT, is a functional and collaborative team consisting of the Chief Legal and Operating Officer, Chief Financial and Business Officer, Senior Vice President, People and Culture, and Director, Information Technology, or IT. The IRT, together with the wider IT, Legal, and Finance teams, as well as external cybersecurity consultants, help identify, assess, and manage our cybersecurity threats and risks.

companyName: Cidara Therapeutics, Inc.


text: Our Company's business strategy, results of operations and financial condition have not been materially affected, and we believe that they are not reasonably likely to be materially affected, by risks from cybersecurity threats, but we cannot provide assurance that the Company will not be materially affected in the future by such risks or any future material incidents. For more information about the cybersecurity risks we face, see "ITEM 1A - Risk Factors."

companyName: HIGHWATER ETHANOL LLC


text: At AvePoint, cybersecurity risk management is an important part of our overall risk management efforts. We have a policy of transparency regarding our data collection, use, retention and sharing practices, and it is our commitment to implement appropriate technical security measures to protect all AvePoint stakeholders and manage third party risk.

companyName: AvePoint, Inc.

ticker: AVPT


text: Our response process to cybersecurity incidents is designed to escalate certain incidents to members of management depending on the circumstances, including the Interim Chief Financial Officer. Our Interim Chief Financial Officer and others work with our incident response team (including our MSSP) to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting certain cyber incidents to the audit committee.

companyName: Verrica Pharmaceuticals Inc.

ticker: VRCA


text: Data Breaches: A breach of our information systems could lead to unauthorized access to customer or employee data, resulting in reputational harm and legal liabilities. Operational Disruption: Cybersecurity incidents could disrupt our operations, leading to delays in production, delivery, or fulfillment of customer orders.

companyName: LEAFBUYER TECHNOLOGIES, INC.

ticker: LBUY


text: The Risk Committee receives information on cybersecurity risk, including risk appetite utilization, breaches and emerging risks, and the control environment, directly or indirectly, from various sources, including the CIOO, CISO, and each of the Management Committees. Additionally, the Risk Committee reviews BancShares' information security policy and program with a focus on whether they are appropriate to protect data, records, and proprietary information of BancShares as well as that of its customers and employees.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Key features of the program include: • Implementation of a detailed cyber incident response plan that provides controls and procedures for identifying, assessing, containing, remediating, escalating, and reporting cyber incidents. • Cross-functional approach to addressing cybersecurity risk, with engagement among internal working groups such as Risk, Information Technology, Operations, Procurement, Legal, Compliance, and Internal Audit functions. • Information security policies and procedures that are reviewed at least annually and updated to reflect changes in law, technology, practice, and emerging threats. • Cybersecurity awareness training for employees, upon hire and at least annually thereafter; • Ongoing monitoring, and periodic assessment and testing, of our networks and systems for threats, vulnerabilities, and other cybersecurity risks, internal and external. • Periodic tabletop exercises and response readiness assessments, with participation from senior executives, led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness; results are provided to the audit committee. • Development of risk mitigation strategies that may defray costs associated with an information security breach. • Periodic cyber drills and disaster recovery tests which are designed to help ensure our business operations can continue in the event of a cybersecurity attack. • Comprehensive internal risk assessment of critical third-party service providers, including of their cybersecurity posture prior to onboarding; contractual requirements for critical third-party service providers to adhere to our standards and incidents reporting; once engaged, critical third-party service providers are required to maintain a comprehensive cybersecurity plan in conformity with industry standards. We engage industry specialists and other third parties in connection with such processes.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: We employ external cybersecurity consultants to help design and implement our cybersecurity policies and procedures, and to identify, assess, manage, and monitor cybersecurity risks. Under the supervision of senior executive management, our Head of Information Technology (IT), supported by external cybersecurity consultants, supervises and directs the implementation of our cybersecurity risk management framework.

companyName: Enliven Therapeutics, Inc.

ticker: ELVN


text: We maintain physical, technical and administrative safeguards to prevent and identify cybersecurity risks, and have implemented practices and procedures to address cybersecurity risks. To this end, among other things, we: provide annual mandatory training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; regular simulation modules for all employees to enhance awareness and responsiveness to possible threats;

companyName: CorMedix Inc.

ticker: CRMD


text: The key steps we have taken to detect, identify, classify and mitigate cybersecurity and privacy risks, include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures and undergoing cyber-incident table top exercises; • Using network and system security tools aimed at detecting and mitigating unauthorized system and data access and cyber threats; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Utilizing threat intelligence to assess potential impacts to company systems and mitigating risks, when applicable, through preventive measures including updates and patching; • Conducting cyber-maturity evaluations, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a periodic basis; • Assessing cybersecurity risk profiles of our third-party service providers, including by partnering with key providers to ensure they have appropriate security measures to safeguard their information technology systems and including robust data security provisions in our contracts with third parties that handle our data; • Providing annual security and privacy training and awareness to our employees to educate our employees on cybersecurity risks; and • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training.

companyName: Capri Holdings Ltd

ticker: CPRI


text: R ecommendations to further enhance our procedures and maturity ratings from these assessments are then presented to the Audit & Risk Committee.

companyName: NASDAQ, INC.

ticker: NDAQ