text: The Board is responsible for overseeing the Company's enterprise risk management processes and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee, a standing committee of the Board. The Audit Committee oversees management's implementation and execution of the Company's Cyber Program and IRP. The Audit Committee receives in-depth annual reports from the CISO or the Vice President of Technology Solutions detailing relevant cybersecurity risks to the Company and, as necessary, timely periodic updates based on circumstances, regarding any significant cybersecurity incidents or developments. The Audit Committee reports to the Board regarding its activities, including those related to cybersecurity.

companyName: PIONEER NATURAL RESOURCES CO


text: Cybersecurity is integrated into our operations, including through team member engagement, technology infrastructure, data fabric, and product development. Due to the sensitive nature of our customers' data that we hold, we have a heightened focus on data security and protection. We maintain administrative, technical, and physical safeguards designed to protect confidential data. Our security team seeks to identify security risks by working with state and federal law enforcement, security information-sharing organizations, and 24/7 system surveillance through internal and external detection and response teams. Additionally, to help ensure our approach to customer privacy and security is effective and in line with industry standards, we publish Service and SOC 2 attestation reports on our risk management standards established by the Statement on Standards for Attestation Engagements 18 (SSAE-18).

companyName: HEALTHEQUITY, INC.

ticker: HQY

secItem: Item 1C


text: Our program includes a number of safeguards. These safeguards include processes for endpoint security (such as anti-malware and endpoint detection and response tools), network security (such as firewalls, intrusion detection systems, and filtering), and vulnerability management (such as vulnerability scans and patch management). Applicable personnel are provided cybersecurity awareness training and receive periodic awareness through ad hoc communications on security topics, including how to report suspicious activity or potential incidents. However, vulnerabilities or threats identified through our cybersecurity program may take time to remediate or mitigate.

companyName: Keenova Therapeutics plc


text: The Board and Audit Committee are responsible for overseeing IT and OT risks from cybersecurity threats. The Board recognizes the importance of maintaining the trust and confidence of our customers, employees, and stockholders and the need to protect information stored on our and our vendors' systems, including personal and proprietary data.

companyName: CALIFORNIA WATER SERVICE GROUP

ticker: CWT


text: Our CCO has served in various roles in information technology and information security for over 20 years, including serving as our Chief Information Officer ("CIO") and either the Chief Technology Officer or CIO of three other public companies. He holds an undergraduate degree in computer engineering. Our CDIO has served in various roles in information technology for over 20 years, including serving as our Senior Vice President of Digital Technology Experience and in similar senior roles at two other public companies. Our CISO has served in various roles in information technology and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies. He holds an undergraduate and master's degree in computer science. Our CTO has served in various roles in information technology for over 25 years and has been with us since 2011. Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large public technology companies.

companyName: ServiceNow, Inc.

ticker: NOW


text: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K, and have implemented processes for our systems taking guidance from recognized cybersecurity frameworks, such as U.S. National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") in an effort to mitigate risks. As part of these proactive measures, we maintain a Cybersecurity Incident Response and Escalation Process with defined roles, responsibilities, and reporting protocols that is periodically reviewed, tested, and updated. The Company has an Executive Cyber Response and Disclosure Committee (consisting of senior executives from the business, finance, operations and legal functions), which is responsible for determining what actions are necessary to respond to cybersecurity events, with input from the Chief Security Officer ("CSO") and other subject matter experts directly participating in incident response efforts. Furthermore, we conduct an annual full board briefing on cybersecurity, ensuring that our Board of Directors is regularly informed of the evolving landscape of cybersecurity risks and mitigation strategies.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. With regards to risks from cybersecurity threats, including as a result of previous cybersecurity incidents, we have conducted assessments and have determined that we do not believe any of the identified risks have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations or our financial conditions, like all financial institutions, we face a risks of such threats, the consequences of which could be material. See Item 1A "Risk Factors – We are subject to operational risks relating to our technology and information systems," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.

companyName: HOPE BANCORP INC

ticker: HOPE


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Chief Information Security Officer, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.

companyName: Rimini Street, Inc.

ticker: RMNI


text: SLB's Cybersecurity Director reports to SLB's Chief Information Officer and is the head of the Company's cybersecurity team. The Cyber Security Director is responsible for assessing and managing SLB's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, and private sources, including external consultants engaged by SLB.

companyName: SLB LIMITED/NV

ticker: SLB


text: Our incident response and recovery planning are overseen by the SIMT and Company personnel who become aware of an incident or potential incident are required to notify the SIMT. The SIMT is comprised of senior members of management and subject matter experts and is responsible for overseeing our cybersecurity program and our response to any cybersecurity incidents.

companyName: PubMatic, Inc.

ticker: PUBM


text: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and certify our PCI-DSS compliance.

companyName: 1 800 FLOWERS COM INC

ticker: FLWS


text: Our management, represented by our Chief Financial Officer, Ward Lyke, provides leadership for implementation and maintenance of our cybersecurity risk management processes. Mr. Lyke has served as Vice President, Chief Financial Officer, and Treasurer since January 2024, and as an Executive Vice President and Officer of the Company since 1984, including as Assistant Treasurer since 2003. Mr. Lyke currently manages the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Lyke oversees the Company's managed IT solutions service provider which includes, among other services: Business

companyName: MAYS J W INC

ticker: MAYS


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: See "Quantitative and Qualitative Disclosures About Market Risk" contained herein in Item 7A for further information. Also see "Risk Factors" included in Item 1A for additional information regarding cybersecurity risk.

companyName: Unum Group

ticker: UNM


text: The Cybersecurity Steering Subcommittee oversees teams of subject matter experts and working groups assigned to focus on specific cybersecurity risk management issues, and receives periodic status updates from those teams. This subcommittee also receives information from several specific risk-focused working groups such as an AI risk review team and a product AI and privacy working group.

companyName: Informatica Inc.

ticker: INFA


text: Our Senior Director of Information Technology, or IT, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. Our Senior Director of IT has over 25 years of experience in building, running, and managing diverse functional areas of IT, including but not limited to enterprise cybersecurity, IT infrastructure, operations, business continuity, and service delivery. He began his IT career overseeing datacenter operations for a pharmaceutical company and has held multiple IT leadership positions at biotechnology companies, including serving as the director of cybersecurity and infrastructure at a biopharmaceutical company prior to joining us over four years ago.

companyName: Generation Bio Co.

ticker: GBIO


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with our human resources and information technology functional groups. Personnel at all levels and departments are made aware of our cybersecurity policies through training. Specific training is required for users of higher-risk systems or individuals associated with specific security processes such as incident response.

companyName: Blend Labs, Inc.

ticker: BLND


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is training employees to recognize and respond to cybersecurity threats. All new hires receive mandatory privacy and information security training. Employees must also complete mandatory ongoing annual cybersecurity and data trainings, which are supplemented throughout the year by regular phishing and other cyber-related awareness activities. Additionally, we conduct specialized training for our high-risk employees on an annual basis and specialized training for employees with access to certain sensitive information systems. These trainings and tests are tracked throughout the year for each employee and are directly tied to their overall compensation.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: The Fund's management, including the CCO of the Fund, is responsible for assessing and managing material risks from cybersecurity threats. In connection with the Fund's reliance on the Advisor and the Firms information security team, the CCO relies on the cybersecurity expertise of the Advisor's CISO and members of the CISO's staff to assist in assessing and managing the Fund's material risks from cybersecurity threats.

companyName: GUGGENHEIM CREDIT INCOME FUND 2016 T


text: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, and manage material cybersecurity risks to our IT systems and information. As a part of this process, we engaged and worked with an independent third-party specialist to review our cybersecurity environment, which included a formal review and assessment, and determined specific, actionable recommendations for improvement and implementation.

companyName: EMPIRE PETROLEUM CORP

ticker: EP


text: We use risk-based processes to prioritize the resources that manage vulnerabilities, threats, incident responses and operational changes. The risk-based approach ensures we are taking action on the threats, events and incidents that have the highest likelihood of impacting our business and members. We maintain cybersecurity incident procedures that identify the activities, responses and escalation procedures to be executed upon detection of a potential cybersecurity incident. These procedures are a critical component of CFC's Crisis Management Plan and business continuity efforts.

companyName: NATIONAL RURAL UTILITIES COOPERATIVE FINANCE CORP /DC/

ticker: NRUC


text: Key to the Audit Committee's effectiveness is its regular engagement with our cybersecurity team, as further described below, a practice that provides direct communication and alignment on cybersecurity matters. During these critical meetings, several pivotal areas are reviewed to assess the adequacy and effectiveness of our cybersecurity measures: • Incident Response: Evaluation of our readiness and response strategies to cybersecurity incidents, positioning us to quickly and effectively mitigate any potential impacts. • Cybersecurity Industry Updates: Review of recent industry developments (i.e., new threats/tactics, industry news) to comply and adapt our strategies accordingly. • Acquisition Security Integration: Discussion on the security aspects of recent or upcoming acquisitions, focusing on the integration of their cybersecurity frameworks into our broader security posture. • Key Initiatives: Reflection on the major cybersecurity initiatives undertaken in the past year, assessing their outcomes and lessons learned. • Goals: Setting forth our cybersecurity objectives for the coming year, aligning them with our overall business strategy and risk management framework. • Employee Security Awareness and Training: Results from our regular testing and training of employees is presented and discussed. • Penetration Test Results: Analysis of the findings from our regular penetration testing exercises, which help identify vulnerabilities and strengthen our defenses. • Questions and Answers: An open forum for the Audit Committee to seek clarifications and provide guidance on cybersecurity matters, fostering a culture of transparency and continuous improvement.

companyName: ALTA EQUIPMENT GROUP INC.

ticker: ALTG


text: The Company's Chief Information Security Officer (CISO), in coordination with the Company's Chief Litigation Officer, Executive Director, Privacy Officer, Corporate Controller/Chief Accounting Officer, Executive Director, Corporate Security and other internal stakeholders, is responsible for leading the team responsible for assessing, identifying and managing cybersecurity and data privacy risks, including implementation of our cybersecurity risk management program. The CISO has extensive experience working in the IT and services industry and is a subject matter expert in varied topics including cybersecurity, data integrity, IT risk, enterprise architecture, third-party risk, threat intelligence, incident response, and regulatory compliance. Management committees consisting of senior officers of the Company regularly receive briefings on cybersecurity matters, who in turn regularly report to the Board of Directors and its committees on such matters.

companyName: QUEST DIAGNOSTICS INC

ticker: DGX


text: We are occasionally subject to cybersecurity incidents and we use our IRP to respond to such incidents. Our e-commerce systems are periodically the target of directed attacks intended to lead to interruptions and delays in our service and operations. We also occasionally experience the misuse or unauthorized disclosure of personal information, other data, confidential information or intellectual property. We occasionally experience incidents unrelated to our system where bad actors attempt to take over customer accounts by using the credentials of customers. These incidents have not had a material impact on us to date, including our business strategy, financial condition, or results of operations. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, financial condition, or results of operations. For more information about the cybersecurity risks we face, see the risk factor titled "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or to otherwise protect our confidential information, could damage our reputation and brand and harm our business, financial condition, and results of operations" under Item 1A "Risk Factors" of this Annual Report on Form 10-K.

companyName: Chewy, Inc.

ticker: CHWY


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our President.

companyName: SPLASH BEVERAGE GROUP, INC.

ticker: SBEV


text: Our Trust and Security organization ("T&S") is responsible for implementing the ISP. T&S is led by our Chief Information Security Officer ("CISO"), Lonnie Benavides, who reports to our Chief Technology Officer ("CTO"), Chuck Geiger. T&S is made up of two sub-teams, each led by a director who reports to the CISO: • Information Security, which is responsible for implementing all aspects of the ISP and is structured around the following pillars: (i) Application Security, (ii) Infrastructure (Cloud) Security, (iii) Corporate IT Security, (iv) Security Operations, and (v) Governance and Risk Management. • Compliance and Privacy, which is responsible for assessing and preparing internal teams for regulatory compliance pertaining to information security, secured financial reporting, and privacy and is structured around the following pillars: (i) Privacy, (ii) Compliance, (iii) Vendor Risk Management, and (iv) Security Awareness.

companyName: CHEGG, INC

ticker: CHGG


text: We rely on information technology to operate our business. We have endpoint and other protection systems, and incident response processes, both internally and through third-party experts designed to protect our information technology systems. These established processes assist us to continuously assess and identify threats to our systems and minimize impact to our business in the event of a breach or other security incident. With our third-party consultants, the processes protect our information systems and allow us to resolve any issue which may arise in the most timely and aggressive fashion.

companyName: UR-ENERGY INC

ticker: URG


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.

companyName: KILROY REALTY CORP

ticker: KRC


text: Within the firm's global Procurement department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds. The Supplier Risk Management program performs regular assessments, including information security reviews. Ongoing monitoring is performed through our centralized risk function as well as by business line supplier managers to raise new threats or weaknesses associated with a third-party service. In accordance with our Enterprise Incident Management Policy, any third-party cybersecurity incident is reported and evaluated for further review and impact analysis.

companyName: PRICE T ROWE GROUP INC

ticker: TROW


text: In February 2022, we determined that our Company was the subject of a targeted cyber-attack which resulted in having to shut down most of our connectivity, operating and accounting systems globally to manage the safety of our entire global systems environment, and we initiated our cybersecurity incident response plan. We had limited ability to conduct operations for a period of approximately three weeks, including but not limited to arranging for shipments of freight or managing customs and distribution activities for our customers' shipments. While we continue to incorporate learnings from the cyber-attack, we do not expect to have a further material adverse impact on the Company's business from this cyber-attack. Since the cyber-attack, we have accelerated investments in our CSRM program, strengthened the security of our systems and networks and enhanced continued monitoring of the known information security environment. We also added a Chief Information Security Officer (CISO) to our IS leadership.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: The board, as a whole and through its committees, has responsibility for oversight of risk management. In its risk oversight role, the board of directors has the responsibility to satisfy itself that the risk management processes designed and implemented by management are adequate for identifying, assessing, and managing risk. The audit committee of the board of directors of the Company is responsible for oversight of risks from cybersecurity threats.

companyName: MDU RESOURCES GROUP INC

ticker: MDU


text: The board of directors, in coordination with the Audit Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Audit Committee, as part of its risk oversight function, is responsible for overseeing our cybersecurity program. The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments and relevant internal and industry cybersecurity incidents.

companyName: CPI Card Group Inc.

ticker: PMTS


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: AUDACY, INC.


text: The Bank retains external consultants to assist in the development and monitoring processes for assessing, identifying, and managing cybersecurity incident and threat risk. The Bank engages third-party services to conduct evaluations of security controls, whether through penetration testing, independent audits or consulting on practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Bank also requires subcontractors to report on cybersecurity incidents so the Bank can assess their impact. As part of the Bank's vendor management process, the Bank undertakes due diligence of third-party systems with whom the Bank will interact, including risk profiling and classification, in addition to requiring data protection covenants in its vendor agreements. The Bank's vendor risk management program includes regular reviews and oversight of all service providers in accordance with a risk profile classification. The Bank reviews vendor performance, relevant technologies utilized by vendors and promotes escalation of any unsatisfactory reviews, as part of Bank's continuous assessment of its vendors.

companyName: Federal Home Loan Bank of Atlanta


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: employee training, access controls, data encryption, systems monitoring, regular patching of operating systems and software, a password policy, a written IT security incident response plan, and cybersecurity insurance coverage.

companyName: OmniAb, Inc.

ticker: OABIW


text: Our cybersecurity risk management program includes: • third party risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • end-user testing to assess the effectiveness of our security measures; • cybersecurity awareness training of our employees, incident response personnel, and senior management, including mandatory computer-based training, phishing awareness campaigns, and internal communications; • a cybersecurity IRP that includes procedures designed for identifying, analyzing, containing, remedying and otherwise responding to cybersecurity incidents; • testing of our incident response readiness through Disaster Recovery and Business Continuity Plan exercises; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Extra Space Storage Inc.

ticker: EXR


text: The Company recognizes the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of data we produce and collect. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes. We obtain input, as appropriate, for our cybersecurity risk management program on the security industry and threat trends from external experts. Our executive leadership team is responsible for our overall enterprise risk management system and processes and regularly consider cybersecurity risks in the context of other material risks to the company.

companyName: SpringBig Holdings, Inc.

ticker: SBIG


text: Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer. They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports. They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors as applicable and on a regular basis.

companyName: Sprout Social, Inc.

ticker: SPT


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Vice President, Information Technology. Our Vice President, Information Technology leverages her over 25 years of IT Leadership experience in pharmaceutical companies such as Endo Pharmaceuticals and multiple Johnson and Johnson companies. Our Vice President, Information Technology is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. The Vice President, Information Technology provides regular briefings for our senior management team on cybersecurity matters, including threats, events, and program enhancements.

companyName: OptiNose, Inc.


text: Cyber risk management is a critical component of our risk management framework. Processes for assessing, identifying, and managing material risks arising from cybersecurity threats are integrated in our policies and procedures, including our enterprise risk appetite, risk assessment, risk treatment, risk acceptance or exceptions, and third party risk management policies.

companyName: Citizens Community Bancorp Inc.

ticker: CZWI


text: In the event of a cybersecurity incident, we maintain incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to the Critical Threat Committee for review.

companyName: CARRIER GLOBAL Corp

ticker: CARR


text: The Company is not aware of any cybersecurity incidents in the last three years that have materially affected or are reasonably likely to materially affect the business strategy, results of operations, or financial condition of the Company. For more information regarding how cybersecurity threats could materially affect the Company, see "We Face Risks Relating to Cybersecurity Incidents and Privacy Laws." in Item 1A. Risk Factors.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Starbucks assesses, measures, and reports on cybersecurity risk at operational, program or management, and strategic or executive oversight levels. We maintain and periodically update written cybersecurity policies, standards, and controls, which are reviewed by a cross-functional management-level committee and designed to align with business objectives, regulatory requirements, and industry best practices. We train our employees through annual cybersecurity awareness training, which includes information about how to report cybersecurity concerns and incidents, as well as phishing simulations and periodic communications about timely cybersecurity topics and threats. We also implement a variety of tools to monitor our systems and network activity, and we conduct various simulated attacks and penetration tests to assess the effectiveness of these tools.

companyName: STARBUCKS CORP

ticker: SBUX


text: Our cybersecurity program is governed by the Audit Committee of our Board. The Audit Committee of the Board and the full Board will each receive quarterly updates on cybersecurity risks identified through the enterprise risk management processes described above.

companyName: BIO KEY INTERNATIONAL INC

ticker: BKYI


text: The information gleaned from these assessments, audits and reviews is used to enhance our enterprise information security program, including cybersecurity policies, standards, processes and practices. In addition, significant findings from these assessments are reported to management and the Audit Committee of our Board of Directors (the "Board").

companyName: MKS INC

ticker: MKSI


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Senior Director of Global Information Security, Compliance and Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Governance of Cybersecurity Risks From a governance perspective, our Audit Committee oversees our cybersecurity program, including the management of risks arising from cybersecurity threats. Our Audit Committee receives quarterly reports from both internal (e.g., management) and external sources (e.g., third-party consultants), which cover topics that include, but are not limited to, recent cyber devel opments, evolving cyber standards, vulnerability assessments, third-party and independent reviews, the cyber threat environment, technological trends, and other cybersecurity considerations arising with respect to our company and third parties. Our GISO and Chief Legal Officer also keep our executive team and our Audit Committee (if necessary) informed regarding any security incident that meets established reporting thresholds and provide ongoing updates regarding any such incident until it has been closed out.

companyName: Liberty Latin America Ltd.

ticker: LILA


text: To mitigate the risk of a cybersecurity incident both internally and with third-parties, the Company's IT consultants provide mandatory cybersecurity training for all employees and contractors. They also conduct periodic training and awareness campaigns by sending employees simulated phishing attacks. Results of these simulated phishing attacks are reviewed and reported to management and the Board of Directors. In addition to training of its employees and consultants, the Company's devices and servers are equipped with cybersecurity software applications, which are continuously monitored by an expert third-party managed security service provider that has numerous certifications recognized in the IT industry and provides security services for several Fortune 100 companies and certain highly secure government agencies. Different data analytics techniques are used to detect suspicious system behavior, provide contextual information, and block malicious activity. Any detected threat or malicious activity will immediately alert the security team for further investigation and remediation.

companyName: DYNEX CAPITAL INC

ticker: DX


text: We have not identified risks from known cybersecurity threats during the year ended December 31, 2023, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: HESS CORP


text: The IS Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the IS Audit Committee, as necessary, regarding significant cybersecurity incidents.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Starwood Capital's Chief Technology Officer, an industry veteran that has been focused on technology for over 40 years and in technology leadership roles at financial institutions for 20 years, leads the overall cybersecurity function and is responsible for developing and implementing Starwood Capital's Information Security Program and managing our response to threats. In addition to its in-house cybersecurity capabilities, at times Starwood Capital also engages third parties to assist with assessing, identifying, and managing cybersecurity risks. Members of Starwood Capital's IT security team, including the third-party security firms utilized as part, of its program, have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.

companyName: Starwood Real Estate Income Trust, Inc.

ticker: SWDR


text: Our information security, security management, and risk management functions help identify, assess and manage the Company's cybersecurity threats and risks. Our information security security management, and risk management functions identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, automated tools, analyzing reports of cybersecurity threats and threat actors, evaluating our and our industry's risk profile, conducting vulnerability assessments to identify vulnerabilities, conducting scans of the threat environment, and evaluating threats reported to us.

companyName: Turnstone Biologics Corp.


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Risk Committee. The Risk Committee is responsible for reviewing our cybersecurity and the protection of data integrity policies and practices, including making recommendations for improvements in these areas. The Risk Committee oversees that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Risk Committee also reports material cybersecurity risks to our Audit Committee and material cybersecurity incidents would be reported to the full Board of Directors by management and/or the Risk Committee.

companyName: Payoneer Global Inc.

ticker: PAYO


text: The Audit Committee of the Board of Directors is responsible for overseeing the management of cybersecurity risks. The Audit Committee is informed about cybersecurity risks through quarterly reports from the Global Head of IT and Cybersecurity Services and, as necessary, to the full Board. The Audit Committee also reviews and approves the company's cybersecurity policies and the Company's Global Head of IT and Cybersecurity Services is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board. This includes our overall information security strategy, policy, security engineering, operations and cyber incident detection and response reporting in alignment with Company policies. The current Global Head of IT and Cybersecurity Services has more than 16 years of information technology and program management experience which includes information security, and others on our IT security team have extensive cybersecurity experience and certifications.

companyName: BEL FUSE INC /NJ

ticker: BELFA


text: Our current CISO has led our Data Security Department for ten years and holds more than eighteen years of experience in cybersecurity, including security operations, cloud security, and risk management. He has extensive experience with enterprise information security controls and frameworks, such as ISO 27001, PCI DSS, SOC 2 Type II, and HITRUST. Additionally, our CISO holds multiple professional certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager).

companyName: IBEX Ltd

ticker: IBEX


text: Management is responsible for the day-to-day management of the risks we face, while our Board of Directors ("Board") as a whole has responsibility for the oversight of risk management, including as to material risks from cybersecurity threats. In its risk oversight role, our Board has the responsibility to satisfy itself that the risk management processes designed and implemented by management are appropriate and functioning as designed. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Lexaria Bioscience Corp.

ticker: LEXX


text: Our executive management team, with regulatory and governance oversight from our Audit Committee, are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: The Company's risk assessment and mitigation program is centered on the following components: • Identification of material risks (primarily through enterprise risk assessments); • An evaluation of the likelihood of such risk occurring, the potential impact and the control strength, consideration for compensating controls to mitigate the risk; • Prioritization of different material risk items based on, among other things, the results of our evaluation; and • Establishment of a process for addressing those risks.

companyName: TripAdvisor, Inc.

ticker: TRIP


text: Material Impact of Cybersecurity Threats: To date, there have been no known material cybersecurity incidents that have significantly impacted the Funds' business strategies, results of operations, or financial condition. The Sponsor continues to monitor systems and processes to mitigate potential cybersecurity risks actively.

companyName: Amplify Commodity Trust

ticker: BDRY


text: The members of our information technology team actively monitor threats to the information technology environment and work with our third -party service providers to monitory cybersecurity threats. In light of the Company's current size and limited personnel, management believes relying on experienced third -party providers is the most prudent and cost-effective course.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: The program utilizes risk assessments for the identification of material cybersecurity risks to critical systems, information, products, personnel, facilities, and technology environments.

companyName: Canoo Inc.

ticker: GOEVQ


text: The Bank engages third parties on a regular basis to assess, test, audit or assist with the implementation of risk management strategies, policies, and procedures to enhance the detection and management of cybersecurity risks. Cybersecurity risk management strategies include, but are not limited to: consultants who assist with assessing risks, assessing systems alignment with NIST Cybersecurity Framework, and FFIEC, penetration testing, tabletop exercises and other regulatory agency requirements.

companyName: RBB Bancorp

ticker: RBB


text: Also using a nationally recognized vendor partner, we have continuous (24x7x365) monitoring of our cloud solutions, perimeter and internal networks in addition to sharing of threat intelligence and remediation steps. Threat intelligence is evaluated, prioritized, and remediated on a continual basis throughout the year.

companyName: SURMODICS INC

ticker: SRDX


text: Our CISO and our steering committee on information security, which includes members of our executive management as well as leaders of business functional areas, are primarily responsible to assess and manage our material risks from cybersecurity threats. Our CISO has over 20 years of experience leading in the information security field at well-known publicly traded technology companies. He also received a CIO Executive Education Certificate from Stanford University.

companyName: Cricut, Inc.

ticker: CRCT


text: Company recognizes the importance of identifying, assessing, and managing risks associated with cybersecurity threats. The Company's cybersecurity program utilizes components of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.

companyName: PERMA FIX ENVIRONMENTAL SERVICES INC

ticker: PESI


text: We recognize the significant role of information security in safeguarding our valuable intellectual property along with the confidentiality, integrity and availability of the data of our customers, employees, and suppliers. We have implemented certain policies, procedures, and systems that are designed to identify and address material risks related to cybersecurity and cybersecurity incidents.

companyName: LAM RESEARCH CORP

ticker: LRCX


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our board of directors administers its cybersecurity risk oversight function directly as a whole. Our executive management team informs the board on cybersecurity risks on a regular basis, with a minimum frequency of once per year.

companyName: Hongchang International Co., Ltd

ticker: HCIL


text: Our board of directors, as a whole and through its committees, has responsibility for the oversight of risk management. The audit and risk committee of our board of directors specifically oversees critical risks and opportunities facing the Company and, in this context, reviews and provides feedback on our company-wide enterprise risk management program, which encompasses risks related to IT and cybersecurity and mitigations put in place, or to be put in place, in response to such risks and opportunities. The audit and risk committee periodically reports to the full board of directors regarding its oversight of the Company's enterprise risk management program and periodic risk assessment results. In addition, our board of directors receives periodic updates from our CIO and Vice President of Information Security on our ISMS and other information security initiatives, and on our information security governance framework.

companyName: Alkermes plc.

ticker: ALKS


text: Both the CIO and CSO regularly report to the Board's Risk Committee on the Company's identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents. In 2024, the Risk Committee reviewed the Company's cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year. With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CSO, along with the Company's senior leadership, including the finance, compliance, and legal functions. In the event of a potentially material cybersecurity incident, the Risk Committee would be immediately notified and briefed.

companyName: Bankwell Financial Group, Inc.

ticker: BWFG


text: We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has significant related experience. Our Director of Information Technology reports to our Chief Operating Officer.

companyName: LXP Industrial Trust

ticker: LXP


text: The information set forth under Part I, Item 1A. Risk Factors - Risks Related to Technologies of this Annual Report on Form 10-K is hereby incorporated by reference. As of September 30, 2025, our financial position, results of operations, cash flows or business strategy have not been materially affected by risks from cybersecurity threats. However, the Company cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents.

companyName: NEW JERSEY RESOURCES CORP

ticker: NJR


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Galera Therapeutics, Inc.

ticker: GRTX


text: Our CISO oversees a team of skilled cybersecurity professionals who have Certified Information Systems Security Professional ("CISSP") credentials, Global Information Assurance Certification from the SANS Institute, and other security and network certifications. The cybersecurity team monitors and evaluates our cybersecurity posture and performance on an ongoing basis, including through regular vulnerability scans, penetration tests, and threat intelligence feeds. The cybersecurity team uses various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence, and assesses and evaluates cybersecurity incidents, escalating certain cybersecurity incidents to the CISO according to protocol. The CISO is continually informed regarding the performance of the cybersecurity program, as well as the latest developments in cybersecurity, including potential threats and innovative risk management techniques aligned with industry standards. The CISO reports to our Chief Scientific Officer ("CSO"). Our CSO is an executive officer and leads internal research and external innovation, corporate data strategy, technology and data sciences, and reports directly to our CEO.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: We consider the risks from cybersecurity threats to include, without limitation, disruptions to our business operations, theft of protected information or intellectual property, destruction of our control systems and data, losses from remedial actions, damage to our reputation, and exposure to lawsuits and regulatory actions. In general, such risks are based on the capabilities and intent of known bad actors as well as threat information gathered from multiple sources, including industry groups, government agencies, publications and third-party service providers. Our processes for managing these risks generally involve (i) the use of tools and technologies to continuously monitor for and identify system vulnerabilities and attacks; (ii) adherence to policies and procedures designed to protect our critical IT and OT systems; (iii) the use of an employee awareness program to promote cybersecurity education and company-wide support; and (iv) periodic reassessment of areas of focus to maintain continued preparedness relative to changes in tools and technologies as well as emerging threats.

companyName: ENTERPRISE PRODUCTS PARTNERS L.P.

ticker: EPD


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on our New Manager managing these risks, see "Part 1. Item 1A. Risk Factors – Risks Related to Our Company – Security breaches and other cyber-security incidents could result in a loss of data, interruptions in our business, subject us to regulatory action and increased costs, each of which could have a material adverse effect on our business and results of operations." in this Annual Report.

companyName: Rithm Property Trust Inc.

ticker: RPT


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through assessments and other exercises focused on evaluating the sufficiency and effectiveness of our cybersecurity risk management efforts. If a material weakness in our cybersecurity risk management program is identified, it will be reported to the Audit Committee and the BOD, as appropriate, and we will make adjustments to our cybersecurity processes and practices as necessary to eliminate or compensate for that weakness.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Warby Parker Inc.

ticker: WRBY


text: The Council also includes, among other senior executives, our Chief Engineer, Chief Information Officer, Chief Aerospace Safety Officer and Chief Product Security Engineer, who each have several decades of business and senior leadership experience managing risks in their respective fields, collectively covering all aspects of cybersecurity, data and analytics, product security engineering, enterprise engineering, safety and the technical integrity of our products and services.

companyName: BOEING CO

ticker: BA


text: We rely on Hines, our Sponsor, for the implementation of cybersecurity policies, standards and practices. Hines' enterprise-wide cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards. Hines has robust cybersecurity systems and policies in place and generally approaches cybersecurity threats through a cross-functional, multilayered approach, which is described below.

companyName: HINES GLOBAL INCOME TRUST, INC.


text: Physical, Administrative, and Technical Safeguards: The Company deploys appropriate safeguards that are designed to protect the Company's information systems from cybersecurity threats, including endpoint security, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and improved through vulnerability assessments, penetration tests, and cybersecurity threat intelligence.

companyName: Matterport, Inc./DE


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" – "A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, business or results of operations."

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: Our Board of Directors has assigned specific oversight responsibility for cybersecurity to our Audit Committee. The Audit Committee reviews and discusses with management our policies, practices and risks related to information security and cybersecurity. Our General Counsel has primary responsibility for assessing, monitoring and managing cybersecurity risks.

companyName: T2 Biosystems, Inc.

ticker: TTOO


text: We have implemented incident response and breach management processes which are based on the National Institute of Standards and Technology (NIST) framework for incident response. This includes 1) defined roles and incident response initiation processes, 2) incident detection and analysis, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses and related matters of cybersecurity are overseen by leaders from our Information Technology, Manufacturing, Clinical Operations, Regulatory and Legal teams.

companyName: PROKIDNEY CORP.

ticker: PROK


text: We recognize the critical importance of maintaining the trust and confidence of all of our stakeholders. Our business depends on the efficient and uninterrupted operation of our information technology systems and those of our third-party vendors. Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our risk management and compliance program.

companyName: Passage BIO, Inc.

ticker: PASG


text: President and Chief Executive Officer and Senior Vice President of Finance are primarily responsible for assessing and managing our material risks from cybersecurity threats. In this regard, our President and Chief Executive Officer and Senior Vice President of Finance have assistance from consultants.

companyName: Ernexa Therapeutics Inc.

ticker: ERNA


text: In 2023, the Company engaged a HITRUST Authorized External Assessor and AICPA member firm `, which completed independent assessments of MSP Recovery's system. These independent assessments verified that we met the healthcare industry's highest standards in protecting healthcare information and mitigating this risk, including compliance with the HIPAA Security Rule. On October 13, 2023, HITRUST certified that the platforms, facilities, and supporting infrastructure of our organization meet the HITRUST CSF v11 Implemented, 1-year (i1) certification criteria. For our cloud computing services, we currently use Amazon Web Services ("AWS") which is also HITRUST certified. On June 14, 2024, an Independent Service Auditor provided MSP Recovery a report opining that our data recovery system's commitments and system requirements meet or exceed the stringent SOC 2 Type II applicable trust services criteria.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We continuously strive to surpass industry best practices by implementing risk-based controls aimed at safeguarding both our partners' and the Company's information systems. In order to protect both commercial and defense-related businesses and support our production operations, the Company has adopted security principles in accordance with the National Institute of Standards and Technology Cybersecurity Framework, contractual requirements and other global standards. We conduct annual security assessments, including external and internal penetration tests, social engineering attacks, and vulnerability assessments. These assessments provide critical insights into our security posture and help us identify and seek to address potential weaknesses proactively. We leverage multiple vendors and their diverse perspectives as means to enhance the effectiveness of our security measures. Furthermore, as we implement solutions, we engage with industry-leading partners to receive guidance on best practices for solution use and overall security. This collaboration seeks to align our cybersecurity strategies with the latest industry standards and best practices. We also maintain regular communication with external partners to stay abreast of current cybersecurity trends and emerging threats. This proactive approach enables us to seek to enhance our security posture and adapt our defenses to evolving cyber risks.

companyName: ASTRONICS CORP

ticker: ATRO


text: We are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect BBSI, including our business strategy, results of operations, or financial condition. Despite our efforts to ensure the integrity of our computer systems, software, networks, third-party relationships, and other technology assets, we may not be able to anticipate, detect, or recognize threats to our systems and assets, or to implement effective preventative measures against all cyber threats, given the sophistication of the techniques used. For further discussion, see Item 1A. "Risk Factors – Risks Related to Technology."

companyName: BARRETT BUSINESS SERVICES INC

ticker: BBSI


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company's information security program is managed by its CEO, who is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: MIAMI BREEZE CAR CARE INC

ticker: MIBE


text: As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division ("ISD"), led by the Chief Information Security Officer (the "CISO"), that is responsible for the day-to-day management of risks from cybersecurity threats. ISD's responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats. ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management. Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors. Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below. In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon's policies and procedures. The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises. In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness. BNY Mellon has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon's cybersecurity risk management and incident response processes.

companyName: ECA Marcellus Trust I

ticker: ECTM


text: Additionally, the Company's CyberSmart Defender Network, which is a multi-disciplinary team that includes representatives from across the Company's various departments, is responsible for raising awareness of cybersecurity issues, sharing learnings, and gaining access to advanced cybersecurity information and training.

companyName: APA Corp

ticker: APA


text: Our Board of Directors (the "Board") considers cybersecurity risk as part of its risk oversight function. In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. Our Audit Committee will receive periodic reports from our Interim Chief Financial Officer or our Chief Legal Officer on our cybersecurity risks. In addition, our Interim Chief Financial Officer or our Chief Legal Officer will update our Audit Committee, as necessary, regarding any significant cybersecurity incidents impacting our information systems. Our entire Board will also receive briefings from our Interim Chief Financial Officer or Chief Legal Officer on our cybersecurity risk management program as part of our overall business risk updates.

companyName: Seritage Growth Properties

ticker: SRG


text: The Audit Committee regularly receives information and reports from the Senior Director - Information Security and other executives responsible for identifying and assessing the scope, nature and impact of cybersecurity risks, incidents and mitigation efforts. In addition to the Audit Committee, the full Board of Directors receives reports on the status of our cybersecurity risks, incidents and mitigation efforts either from the Audit Committee or from the Senior Director – Information Security and other executives. We utilize a technology-based reporting system to identify and log data-related events.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: The CFO and CCO of the Company oversee the Company's oversight function generally and rely on GC Advisors' CIO and cybersecurity team to assist with assessing and managing material risks from cybersecurity threats. The Company's CFO has been responsible for this oversight function as CFO to the Company for over three years and has worked in the financial services industry for more than eighteen years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The Company's CCO has been responsible for this oversight function as CCO to the Company since the Company commenced operations on July 1, 2021 and has worked in the financial services industry for more than twenty years, during which time the CCO has gained expertise in assessing and managing risk applicable to the Company. The Advisors' CIO has been responsible for her function for over four years and has worked in the financial services industry for more than fifteen years, during which time the CIO has gained expertise in assessing and managing risk applicable to the Company.

companyName: GOLUB CAPITAL DIRECT LENDING CORP


text: Impact of Cybersecurity Risks and Threats As of the date of this Annual Report on Form 10-K, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that a material cybersecurity incident will not occur in the future. Additional information on cybersecurity risks are discussed in " Item 1A. Risk Factors," which should be read in conjunction with the foregoing information.

companyName: PYXUS INTERNATIONAL, INC.

ticker: PYYX


text: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business. As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company. New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition. In addition, future cybersecurity incidents could materially affect our strategy, results of operations, reputation or financial condition. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.

companyName: CONDUENT Inc

ticker: CNDT


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures, including an incident response team, that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Senior leadership also briefs the Board on information security matters with quarterly updates.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. A material cybersecurity incident could have material adverse effect on the Company's financial condition, results of operations, or cash flows. The Company is committed to addressing cybersecurity risks in an ever-evolving technological landscape. Management will continue to evaluate and enhance its cybersecurity measures to adapt to emerging threats and comply with evolving regulatory requirements.

companyName: Science Applications International Corp

ticker: SAIC


text: We maintain a data protection and cybersecurity risk management program to assess, identify and manage cybersecurity risks. We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents. In the event of an incident, we intend to follow our incident response plan, which provides a step-by-step framework to follow from incident detection to mitigation, recovery and notification, including notifying senior leadership and the Board of Directors, as appropriate. As part of our risk management program, we regularly conduct vulnerability assessments, as well as internal user training and tabletop exercises. We also conduct self and third-party assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with industry standards and best practices. As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.

companyName: HIGHWATER ETHANOL LLC


text: While all vendors are subject to our vendor management process, those with access to our data and data centers are subject to more rigorous initial and ongoing due diligence. This includes the reviews of Service Organization Control 2 ("SOC 2") reports, financial information, and other policies and procedures related to such third party vendors and their various programs, including vendor management.

companyName: CSB Bancorp, Inc.

ticker: CSBB


text: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely the Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager. The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high rated incidents, to help align our risk exposure with our strategic objectives. The ISC meets quarterly and receives additional ad-hoc briefings from the CISO as and when required.

companyName: Information Services Group Inc.

ticker: III


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Risk Committee. The Risk Committee is responsible for reviewing our cybersecurity and the protection of data integrity policies and practices, including making recommendations for improvements in these areas. The Risk Committee oversees that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and implements processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Risk Committee also reports material cybersecurity risks to our Audit Committee, as the case may be, and material cybersecurity incidents would be reported to the full Board of Directors by management and/or the Risk Committee.

companyName: Payoneer Global Inc.

ticker: PAYO


text: Furthermore, we are consistently broadening our scope of training and awareness practices to alleviate potential risks associated with human error, including mandatory computer-based training, internal communications and frequent phishing awareness campaigns.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: Oversight of cybersecurity risk is formally overseen by the Audit Committee of our Board of Directors. The Audit Committee receives regular briefings from management on cybersecurity topics, including strategy, threats, incident trends, remediation activities, and updates on material developments, as appropriate.

companyName: PETMED EXPRESS INC

ticker: PETS


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, with a goal of ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: 1stdibs.com, Inc.

ticker: DIBS


text: We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers, such as those that may have access to restricted systems and data, including through review of System and Organization Controls (SOC) reports prior to onboarding. As appropriate, we also include contractual requirements regarding cybersecurity practices in third-party contracts.

companyName: Doximity, Inc.

ticker: DOCS


text: The IRadimed board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which serves and functions as the Board's primary oversight body to monitor the Company's cybersecurity and related information technology risk and assists the Company's board of directors in fulfilling its oversight responsibilities regarding the Company policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing our information security policies and internal controls regarding information security; and reviewing the annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the cybersecurity program and receives regular updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends. The Audit Committee oversees the Company's disclosure of any cybersecurity incident deemed material (and such materiality determination will be made by the Board upon recommendation of the Audit Committee) as required by the SEC or any other governmental authority, as applicable. In addition to managing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers. Risk assessments are performed against third-party service providers with a specific focus on any sensitive data that is to be shared with them. The internal business owners of vertical applications are required to document user access reviews regularly. We request a System and Organizational Controls ("SOC") 2 report from the vendors of our enterprise cloud applications. If they do not provide us with a SOC 2, we seek additional compensating risk assurance in our contract language with them. Risks associated with the use of third-party service providers are managed as part of our overall cybersecurity risk management framework.

companyName: IRADIMED CORP

ticker: IRMD


text: Our cybersecurity risk management and strategy processes are led by our CIO, who reports directly to our President and Chief Financial Officer. Our CIO meets with the Audit Committee of our Board as part of the governance process described above. This individual has prior work experience in various roles involving managing information security and risk management, developing cybersecurity strategies, and implementing cybersecurity programs. The IT subject matter experts meet quarterly to review the cybersecurity framework provided by the National Institute of Standards and Technology and evaluate current cybersecurity processes and procedures.

companyName: Local Bounti Corporation/DE

ticker: LOCL


text: Our board of directors is responsible for oversight over its risk management system, including review and approval of the risk management system and processes implemented by management to identify, assess, manage and mitigate cybersecurity risks. The Board is responsible for monitoring and assessing material risk exposure to cybersecurity risks, and our management is responsible for the day-to-day supervision of the material risks we may face.

companyName: AmeriCann, Inc.


text: The Company strives to conduct periodic assessments of the Company's policies, standards, processes and practices. Summary results of such assessments are evaluated by the CISO to assist the Company in adjusting its cybersecurity policies, standards, processes and practices; the CISO reviews critical results with the TIS Committee.

companyName: ALTISOURCE PORTFOLIO SOLUTIONS S.A.

ticker: ASPS


text: Cybersecurity Risks For information related to whether risks from cybersecurity threats have materially affected or are reasonably likely to materially affect ZoomInfo, see "Risk Factors—Cyber-attacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: Led by the Cybersecurity team with oversight by the Audit Committee of the Board and executive management, the program incorporates teams across the organization including Information Technology, Compliance, Legal and Product.

companyName: Canoo Inc.

ticker: GOEVQ


text: Although the Company has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that the Company will not experience such an incident in the future.

companyName: MainStreet Bancshares, Inc.

ticker: MNSB


text: The Company faces risks from cybersecurity incidents that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. Cybersecurity incidents may target and compromise our systems, as well as confidential consumer, employer, and agent information that we store and manage in connection with some of our services. Any cybersecurity incidents affecting our computer networks, databases, third-party services or facilities could lead to potential interruptions of our operations or our ability to manage and report our operating results. Cybersecurity incidents may also result in the inappropriate use or disclosure of personal information, which could adversely affect consumers' confidence in our or our agents' business and expose us to liabilities. As a result, we are required to expend significant capital and other resources to protect us against these security breaches or to alleviate problems caused by these breaches. Intermex has experienced, and may continue to experience, cybersecurity threats in the normal course of its business. To date, however, these events have not had a material adverse effect on the Company's business, financial condition, results of operations, cash flows or reputation. See Item 1A. Risk Factors for additional information on how risks could materially affect the Company.

companyName: International Money Express, Inc.

ticker: IMXI


text: Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Risk Assessment Framework to strengthen our program effectiveness and reduce cybersecurity risks.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Our cybersecurity risk management program includes: • physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and tenant, employee and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other • cyberersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; • a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; • cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; • a security team responsible for managing our cybersecurity risk assessment processes and security controls; • the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; • annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information; and • a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: REGIONAL HEALTH PROPERTIES, INC

ticker: RHEP


text: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially and adversely affected the Company (including our business strategy, results of operations or financial condition), nor are such threats reasonably likely to materially and adversely affect the same.

companyName: STAG Industrial, Inc.

ticker: STAG


text: Our management team, including Vroom's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, VP of Human Resources, and Chief Technology Officer, stays informed and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: Vroom, Inc.

ticker: VRM


text: We are highly dependent on information technology in the operation of our various businesses. Cybersecurity is an integral part of our operations and is a focus of all employees, including senior management, and our board of directors.

companyName: Fidelity National Financial, Inc.

ticker: FNF


text: As of the date of this Annual Report on Form 10-K, the Company is not aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: HYCROFT MINING HOLDING CORP

ticker: HYMC


text: Our Manager's team, including its Head of Risk Management and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.

companyName: Star Holdings

ticker: STHO


text: We use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service (SaaS) providers and web hosting companies. We employ a vendor management program to oversee the cybersecurity practices of our third-party service providers. This includes periodic user access reviews and evaluations of System and Organization Control ("SOC") 1 reports from certain of our SaaS vendors, focusing on their data protection measures. Depending on the sensitivity of the data and the nature of the services provided, our vendor management process involves varying levels of risk assessment and contractual cybersecurity obligations.

companyName: Avid Bioservices, Inc.


text: Our Chief Financial Officer periodically provides reports to the Audit Committee, and, together with our Chief Technology Officer and Director of Cybersecurity, leads the Company's overall cybersecurity function. The Audit Committee receives regular reports on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity, IT and data protection topics.

companyName: SIMON PROPERTY GROUP L P


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: Goldman Sachs has a series of committees that oversee the implementation of the cybersecurity risk management strategy and framework. These committees are informed about cybersecurity incidents and risks by designated members of Technology Risk and Operational Risk teams, who periodically report to these committees about the Cybersecurity Program, including the efforts of the Technology Risk and Operational Risk teams to prevent, detect, mitigate and remediate incidents and threats. These committees enable formal escalation and reporting of risks, and the CISO and other members of Technology Risk provide regular briefings to these committees.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: Our incident response plan, as implemented by management, coordinates the activities we take to prepare for, detect, contain, eradicate, and recover from cybersecurity incidents as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response plan also outlines the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Chief Technology Officer escalates material events, including to the Chief Executive Officer and Board.

companyName: Talkspace, Inc.

ticker: TALK


text: We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems and our products. Our Board of Directors, our internal Risk Steering Committee, in conjunction with our Chief Security Officer ("CSO"), have direct oversight of our management of cybersecurity risks.

companyName: HARTE HANKS INC

ticker: HHS


text: Roivant and the Vants implement multiple levels of cybersecurity measures, including standard malware detection and prevention software, email security programs, privileged access management, vulnerability detection and remediation software, security patching management, security event logging and reviews and special isolation and access controls for data repositories that may contain sensitive information, including protected health information.

companyName: Roivant Sciences Ltd.

ticker: ROIV


text: As of the filing of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect, Alto Ingredients, Inc.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our executive management team along with our Chief Information Security Officer (CISO) are responsible for managing cybersecurity risk, including assessing cyber maturity and development of short and long-term strategies. Our CISO has extensive leadership and experience within the cybersecurity space. We invest in the growth and development of our security team's expertise through hands-on training, technical industry certifications and security domain specific conferences. Security is approached as a unified company strategy, where everyone in the organization plays a key role in the success of our programs. Through required phishing training and awareness campaigns, policy and procedures training, and periodic multi-level tabletop exercise scenarios, we continue to improve identification, reporting, response, recovery, and prevention of threats. We engage in penetration testing, provided by external entities to ensure our internal processes and controls are validated.

companyName: CONMED Corp

ticker: CNMD


text: In today's digital world, protecting our systems and data from cyberattacks and unintentional or malicious breaches is a priority for our leadership and Board of Directors. Our cybersecurity team is overseen by our Senior Vice President and Chief Technology Officer, who is directly supported by our Vice President of IT and Station Operations and our Senior Director of IT Security and Compliance. This leadership team has decades of experience leading cybersecurity oversight and managing our organization's cybersecurity risks. Team members who support our information security program have relevant educational, industry experience, and technical certifications. The technical leadership team provides quarterly and annual cybersecurity updates to our Board of Directors, briefing the Board on our cyber program, industry trends and risks, and any incidents the Company has experienced. Directors with experience in cybersecurity and technology play crucial roles in strategy, innovation, and oversight of the Company's technology investments. The Board oversees our annual enterprise risk assessment, where we assess key risks within the Company, including security and technology risks and cybersecurity threats.

companyName: TEGNA INC

ticker: TGNA


text: Education and Awareness Our policies require each of our employees to contribute to our cyber and data security efforts. We regularly remind employees of the importance of handling and protecting data, including through annual privacy and security training to enhance employee awareness on how to detect and respond to cybersecurity threats.

companyName: PGT Innovations, Inc.


text: We, Kronos and CompX face a number of cybersecurity risks. To date, such risks have not materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any breaches, we have encountered occasional attempts, albeit of minor significance, targeting our data and systems, including instances of malware and computer virus infiltration. Thus far all such incidents have been minor. For more information about the cybersecurity risks we face, see the risk factor entitled "Technology failures or cybersecurity breaches could have a material adverse effect on our operations." in Item 1A- "Risk Factors".

companyName: NL INDUSTRIES INC

ticker: NL


text: We and our MSP/MSSP also utilize processes designed to reduce cybersecurity risk from a third-party vendor and technology. For example, we may conduct upfront diligence of the third-party's cybersecurity, employ contracts that address cybersecurity risk, and monitor vendors compliance with their representations regarding cybersecurity. The MSSP utilizes a Security Information and Event Management (SIEM) system to monitor the IT Infrastructure. The SIEM and other third-party security tools/applications provide reports that include but are not limited to endpoint protection, employee security scores, phishing reports, Dark Web scanning and vulnerability scanning.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Information Technology Security Policy that is available to all employees through our Quality Management System. We also conduct regular cybersecurity awareness and training campaigns for existing employees. Stakeholders can access Jasper's Information Technology helpdesk 24/7 online or by phone, to report any security incidents for escalation.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: Our cybersecurity risk management program includes: • a data security incident response policy and a security incident response plan that include detailed procedures for responding to cybersecurity incidents, determining severity of cybersecurity incidents and notifying appropriate internal and external parties; • third-party and internal risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team consisting of members of our information technology department, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • periodic tabletop exercises involving the security team, the data security incident management team, and members of management, with special sessions expected to occur for the Board of Directors; • annual audit by a Payment Card Industry ("PCI") qualified security risk assessor to validate our PCI compliance; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • regular cybersecurity awareness training, including social engineering and phishing testing of our employees, incident response personnel, and senior management; • deployment of external tools designed to detect and protect against spam, malware and other cybersecurity threats and train personnel; and • third-party security event monitoring.

companyName: LANDS' END, INC.

ticker: LE


text: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, we have not identified any risks from cybersecurity threats or incidents, including as a result of previous cybersecurity incidents, that we believe have materially impacted, or are reasonably likely to materially affect, the Company, including our business strategy, operational results, and financial condition.

companyName: Aquestive Therapeutics, Inc.

ticker: AQST


text: We provide data security and privacy awareness and training to all associates upon hire and on an annual basis, with additional customized, role-based training provided to targeted internal audiences. In addition, we conduct periodic awareness campaigns and regular phishing email simulation tests to reinforce our new-hire and annual training and promote ongoing awareness of risks.

companyName: HOME DEPOT, INC.

ticker: HD


text: Item 3. Legal Proceedings. From time to time, we may be party to various claims and legal actions arising in the ordinary course of our business. We do not believe that we have any pending litigation that, separately or in the aggregate, would have a material adverse effect on our results of operations, financial condition or cash flows. We hereby incorporate by reference Note 10 (Commitments and Contingencies) to the Consolidated Financial Statements included in Part II, Item 8. "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K.

companyName: Cars.com Inc.

ticker: CARS