text: We are not aware of any material risks from cybersecurity threats that have materially impaired or could materially impair our business, results of operations, or financial condition. However, our information security controls, no matter how well designed or implemented, will not fully eliminate cybersecurity risk. It is possible that we are unable to detect or underestimate certain vulnerabilities, or that we may not effectively implement security controls as intended. The Company does manage information security issues that are immaterial individually and in the aggregate from time to time as part of our routine operations.

companyName: QXO BUILDING PRODUCTS, INC.


text: We have implemented Cyber Incident Response Programs, which are in the scope of our ISO 27001 certifications. We have also implemented Business Continuity Programs, which are in the scope of our ISO 22301 certification. We have established comprehensive incident response and recovery plans and test and evaluate the effectiveness of those plans regularly.

companyName: PEGASYSTEMS INC

ticker: PEGA

secItem: Item 1C


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security methods and controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: Beachbody Company, Inc.

ticker: BODI


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.

companyName: Trade Desk, Inc.

ticker: TTD


text: Management is responsible for assessing and managing material risks from cybersecurity threats. The Chief Legal Officer oversees the Company's enterprise risk management function generally and relies on Lord Abbett's CISO and the Information Security Council to assist with assessing and managing material risks from cybersecurity threats. Currently, the Head of Enterprise Risk Management is serving as the Acting CISO, who has over 10 years of experience in all aspects of risk management, including managing cybersecurity risks and improving information security programs for financial services companies with complex information systems. The Acting CISO is also supported by a third party "virtual CISO" provided by a premiere cybersecurity consulting firm. The Chief Legal Officer has been responsible for this oversight function as Chief Legal Officer to the Company since its inception in 2024 and has worked in the financial services industry for over 28 years, during which the Chief Legal Officer has gained expertise in assessing and managing risk applicable to the Company. The Information Security Council is chaired by the Acting CISO and includes representatives from senior management, including the Company's Chief Compliance Officer, and is responsible for administering the firm's Information/Cybersecurity Program including key cybersecurity risks.

companyName: Lord Abbett Private Credit Fund


text: For a description of the risks from cybersecurity threats that may materially affect us, see the section titled "Risk Factors" contained in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: C3.ai, Inc.

ticker: AI


text: Risk Management, Strategy, and Governance Cybersecurity Integration with overall risk management Cleco's business operations rely on complex and evolving operational and information technology systems and network infrastructures. Digital information, information technology, and automation are essential components of Cleco's operations and growth strategy. Cleco continues to assess its cybersecurity tools and processes and has taken a variety of actions to monitor and address cyber-related risks. These cybersecurity tools and assessments are embedded in Cleco's overall enterprise risk management system. Cleco utilizes the following tools, methodologies, and standards to assess, identify, and manage material cybersecurity risks: • NERC CIP standards, which protect Cleco's operational technology, • National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which protects Cleco's operational and information technology, • Sarbanes-Oxley Act (SOX) regulations, which require Cleco to maintain access and security controls for certain systems that are essential to the completeness and accuracy of financial reporting, • internal and third-party assessments to identify and prioritize risks, • Cybersecurity Incident Response Plans (CSIRPs), and • a security operations center managed 24 hours a day by a third party.

companyName: Cleco Corporate Holdings LLC


text: Our incident response plan provides consistent guidance for preparing for cybersecurity incidents and events, establishes clear ownership of roles and responsibilities during a cyber incident, and has inter-dependent processes for detecting and responding to cyber incidents to include leveraging guidance from the legal team. We have retained a trusted and experienced third-party investigator/negotiator, and also maintain cybersecurity insurance to help mitigate the risk of a catastrophic cyber event.

companyName: Loar Holdings Inc.

ticker: LOAR


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our internal information technology systems, or those of our third parties with whom we work, may fail or suffer security breaches, loss or leakage of data and other disruptions, which could result in a material disruption of our development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability, and could adversely affect our business, results of operations and financial condition".

companyName: Turnstone Biologics Corp.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as the Audit Committee, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Audit Committee at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers that includes a diligence and contracting process depending on our assessment of each provider's respective criticality and risk profile.

companyName: Evolv Technologies Holdings, Inc.

ticker: EVLV


text: The Company's CTO provides periodic reports to the Audit Committee of the Company's Board of Directors, as well as the CIRC, as appropriate. These periodic reports include updates on the Company's cyber risks and threats, the status of projects to strengthen its information security systems, assessments of the information security program, and the emerging threat landscape. The information security program is regularly evaluated by the CTO with the results of those reviews reported to the CIRC, the Audit Committee of the Company's Board of Directors, and the Board of Directors, as appropriate.

companyName: MP Materials Corp. / DE

ticker: MP


text: Cyber Risk Management and Strategy Our cybersecurity risk management processes are being integrated into our overall risk management processes. We are making efforts to incorporate cybersecurity considerations as a part of our business processes. We engage with external cybersecurity experts, including assessors, consultants, and auditors, to enhance our cybersecurity measures and ensure compliance with industry best practices. We have established processes to oversee and manage cybersecurity risks associated with our use of third-party service providers, ensuring they adhere to our security standards. We review third-party service provider contracts to ensure they contain data privacy and security provisions, aligning with our standards and regulatory requirements. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks.

companyName: NextPlat Corp

ticker: NXPL


text: The IRT also directs and coordinates eradication and recovery efforts. Eradication and recovery activities depend on the nature of the cybersecurity incident, which may include, but are not limited to, rebuilding systems and/or hosts, replacing compromised files with clean versions, or validation of files or data that may have been affected. Containment, eradication, and recovery may be aided by third-party vendors or investigators.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Management's role in assessing and managing material risks from cybersecurity threats Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those recently acquired and non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.

companyName: Walmart Inc.

ticker: WMT


text: We score cybersecurity risks based on the likelihood and impact on our operations. Such cybersecurity risks are integrated and evaluated as part of the global Enterprise Risk Management ("ERM") program, which is managed by the ERM Director. The Governance Committee of the Board of Directors maintains oversight of the ERM program and the Audit Committee maintains oversight of the cybersecurity program to ensure risks to the Company are managed within our risk appetite.

companyName: CRAWFORD & CO

ticker: CRD-A


text: We have also employed a chief information security officer who reports to the chief executive officer. The chief information security officer is responsible for information security, information technology risk management, vendor management and business continuity programs. The chief information security officer holds a graduate degree in cybersecurity and numerous information security certifications, including certified information systems security professional, certified information security manager, certified cloud security professional and qualified technology expert. Additionally, the chief information security officer has worked in the information security field for over 20 years within several financial institutions, implementing cybersecurity strategies, programs, policies and procedures.

companyName: Sterling Bancorp, Inc.


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy, and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing, and table top exercises.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, remote wiping, threat detection, intrusion detection and prevention; conducting ( through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; and evaluating threats reported to us.

companyName: Climb Bio, Inc.

ticker: CLYM


text: Company Processes for Monitoring Cybersecurity Incidents The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The CISO works with the SPCC to implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. If a cybersecurity event involving the Company were to occur, the CDEC would be immediately engaged to initially evaluate the potential materiality of the event and the potential need for public disclosure, and the SPCC and other members of senior management would be engaged to determine the timing and extent of the response and to consider whether any future vulnerabilities are expected. As part of this evaluation, the Company, through the SPCC, would also identify immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. After an initial evaluation by the CDEC, the relevant information regarding the cybersecurity event and its potential materiality would also be promptly raised to the Company's Disclosure Committee for further review and evaluation as to whether public disclosure would be required.

companyName: Integer Holdings Corp

ticker: ITGR


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including the impact of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. In the last three years, we have not experienced any material information security breach incidents. The Company maintains cybersecurity insurance, and as part of management oversight we regularly review our policy and levels of coverage based on current risks.

companyName: DENTSPLY SIRONA Inc.

ticker: XRAY


text: We are not aware of any material cybersecurity incidents that have occurred in the last three fiscal years, and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.

companyName: GLAUKOS Corp

ticker: GKOS


text: Because we rely on third-party providers and platforms for many of our computer and technology systems and support, we use a variety of processes and tools to address cybersecurity threats related to the use of third-party technology and services, including pre-acquisition diligence, imposition of contractual obligations, and performance monitoring. As a part of our monitoring, we regularly obtain System Organization and Control Reports (SOC Reports) for key third-party financial systems.

companyName: DOLLAR TREE, INC.

ticker: DLTR


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. Our Chief Information Officer (CIO) assumes primary oversight of material risks stemming from cybersecurity threats. With over 20 years of experience across various information technology roles, our CIO also serves as the Vice President accountable for the Information Technology organization and information protection.

companyName: Rocket Lab Corp

ticker: RKLB


text: Cyber-attacks, malicious internet-based activity, online and offline fraud, administrative or technical failures and other cybersecurity threats present risks to the confidentiality, integrity and availability of our information systems, including those of the third parties upon which we rely, and our data residing in those systems. We take seriously our responsibility to protect sensitive consumer, customer and employee information.

companyName: ZILLOW GROUP, INC.

ticker: ZG


text: Our Chief Information Officer/Chief Digital Officer ("CIO/CDO"), together with the Company's security team, is responsible for assessing, monitoring, and managing our cybersecurity risks. Our CIO/CDO has significant experience in IT security, information security, and cybersecurity having served in a variety of senior roles at the Company prior to serving as CIO/CDO. Our CIO/CDO also has experience with implementing various security and infrastructure transformation and improvement programs.

companyName: CONSTELLIUM SE

ticker: CSTM


text: Our CISO leads all aspects of Accenture's global cybersecurity program, including security operations, client data protection, cyber risk reduction strategies, incident response, cybersecurity integration of acquisitions and our industry-leading behavioral change program. Our CISO joined Accenture in 1995. Prior to being appointed CISO in 2020, he helped create Accenture's information security capability and led the implementation of information security technology. Previously, he managed large technology transformations for Accenture and for clients in the United States, Japan and Australia. Our CISO reports to our Chief Operating Officer and is supported by a team of over 800 people with expertise in technical architecture and security operations; governance, risk and compliance; client data protection; behavioral change; and cyber incident response, many of whom hold cybersecurity certifications and possess deep technical knowledge and experience.

companyName: Accenture plc

ticker: ACN


text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See Item 1A. "Risk Factors" for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.

companyName: Uniti Group LLC


text: Information Security Committee governs our technology and operational risk tolerances, including cybersecurity and third- and fourth-party provider risks. The management members who serve as part of the committee include the VP of IT Operations (chair), Chief Operations Officer, Chief Financial Officer, and Chief Compliance Officer. The VP of IT Operations has relevant technical experience and certifications with over 20 years of respective experience. The remaining committee members each have more than 15 years of relevant banking experience.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and reliance tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using third-party cybersecurity experts. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections. We leverage external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: FB Bancorp, Inc. /MD/

ticker: FBLA


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee, and specifically the subcommittee for cybersecurity, is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: Rigetti Computing, Inc.

ticker: RGTI


text: Board of Directors has been designated to oversee cybersecurity risk management. Its members possess diverse expertise, which enables them to effectively evaluate the adequacy of our cybersecurity measures and challenge management's approach when necessary. The Information Security Officer provides regular updates to our chief executive officer and Board of Directors on cybersecurity risks, ongoing initiatives, incidents, response activities and strategies. The Board of Directors acknowledges cybersecurity as a strategic risk and a priority for the Company. The Board of Directors is actively involved in the oversight of our cybersecurity risk management efforts, ensuring alignment with our overall business objectives.

companyName: Strawberry Fields REIT, Inc.

ticker: STRW


text: As noted above, we have experienced various types of cyber-attack incidents which thus far have been contained and not material to us. We continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event. We also maintain a cyber risk insurance policy but the costs related to cybersecurity threats or disruptions may not be fully insured. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or vendors or suppliers we engage on behalf of our clients, fall victim to other successful cyberattacks.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our global footprint exposes us to numerous and evolving cybersecurity risks that could have an adverse effect on our business, financial condition, and results of operations. To date, we have not experienced any significant impacts from cybersecurity threats. However, our safeguards may not always be able to prevent a cyber-attack from impacting our systems or successfully execute our business recovery protocol, which could have a material impact on our business, financial condition, results of operations, or cash flows. Refer to the risk factor captioned "Cybersecurity Risk – The disruption of our operations or risk of loss of our sensitive business information could negatively impact our financial condition and results of operations" in "Item 1A. - Risk Factors" of this Annual Report on Form 10-K for additional narrative on our cybersecurity risks and the potential related impacts to us.

companyName: Amcor plc

ticker: AMCR


text: As a result of ongoing monitoring, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition, or results of operations during the period covered by this filing. Notwithstanding the cybersecurity processes and procedures described above, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on our business, financial condition, or results of operations. While we maintain cybersecurity insurance, the costs related to cybersecurity incidents, including information and security breaches, or other disruptions may not be fully insured. For further information regarding the risks to us associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect the Company, see the Risk Factor entitled, "Cybersecurity incidents or information or security breaches, or those of third parties with which we do business, could have a material adverse effect on our business, financial condition, and results of operations."

companyName: FIRST SOLAR, INC.

ticker: FSLR


text: As discussed in the Risk Factors section above, our operations could be significantly and negatively impacted by cybersecurity threats and other disruptions affecting our information technology, related information systems and sensitive information. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII and proprietary and confidential business data. We utilize EHRs and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. As described above, our information systems, in turn, interface with and rely on third party systems that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability These include the ongoing monitoring of our systems, including with the assistance of third party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2023. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.

companyName: CNH Industrial N.V.

ticker: CNH


text: We use third-party service providers to assist us from time to time in identifying, assessing, and managing material risks from cybersecurity threats, including for example cybersecurity consultants and software providers, managed cybersecurity service providers, threat intelligence service providers, forensic investigators, penetration testing firms, dark web monitoring services, and professional services firms, including legal counsel and auditors. By partnering with these specialized providers, we can leverage their insights and expertise to implement cybersecurity strategies and processes that are designed to align with industry best practices.

companyName: Tenable Holdings, Inc.

ticker: TENB


text: For the year ended June 30, 2025, the Company had no material cybersecurity incidents or threats that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident. As previously disclosed, on February 14, 2025, we became aware of unauthorized third-party access to our information systems, including portions of its email systems, that resulted in misdirected vendor payments. To date, the Cybersecurity Incident has not had a material impact on our business operations or financial condition.

companyName: NIOCORP DEVELOPMENTS LTD

ticker: NB


text: Core activities supporting our strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.

companyName: BV Financial, Inc.

ticker: BVFL


text: Notwithstanding the attention the Company pays to cybersecurity risks and the processes and controls implemented, the Company may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on its business, strategy, financial condition, results of operations, cash flows, and reputation. Cybersecurity risks rapidly evolve and are complex, so the Company must continually adapt and enhance processes and controls. As the Company does this, management must make judgments about where to invest resources to protect the Company and our assets most effectively. These are inherently challenging processes, and management can provide no assurance that the processes and controls implemented will be effective.

companyName: Andersons, Inc.

ticker: ANDE


text: As part of our overall risk management system, we monitor and test our safeguards, in collaboration with human resources, IT, and management. Personnel at all levels and departments are made aware of our cybersecurity policies and educated about cybersecurity best practices through annual company-wide cybersecurity training, regular phishing simulations and cybersecurity reminders, and role-based training, as appropriate.

companyName: AppLovin Corp

ticker: APP


text: As of February 27, 2025, we do not believe that any risks from cybersecurity threats, including as a result of past cybersecurity incidents, have had, or are reasonably likely to have, a material adverse effect on the company, including our business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity processes will prevent or mitigate cybersecurity incidents or threats and that efforts will always be successful. It is possible that cybersecurity incidents may occur and could have a material adverse effect on our business strategy, results of operations, or financial condition. See "Business and Operational Risks--We are increasingly dependent on the performance of our information technology systems and those of our third-party business partners and service providers" in Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: Marathon Petroleum Corp

ticker: MPC


text: Monitoring and Reporting Processes MWYN's cybersecurity program includes continuous monitoring of its internal IT infrastructure, including its secured servers and firewall systems. The external IT specialist conducts regular system checks, vulnerability assessments, and real-time threat monitoring to detect and respond to potential cybersecurity incidents. In the event of an identified risk or security event, the specialist reports directly to management and, where appropriate, escalates the matter to the Board of Directors. Preventive controls, incident response procedures, and remediation protocols are reviewed and updated periodically to ensure continued protection of the Company's digital assets.

companyName: Marwynn Holdings, Inc.

ticker: MWYN


text: Our CRMP is integrated into our overall enterprise risk management program. We have designated our Senior IT Manager to oversee the implementation and maintenance of the IRP for Graham Corporation. For BN, we have designated BN's IT Manager to implement and maintain the IRP for BN. Our IT personnel at Graham Corporation and BN have over 50 years of combined experience in the field of cybersecurity and are responsible for the management of our cybersecurity and data privacy programs. Among other information security duties, the Senior IT Manager and IT Manager are responsible for the following for Graham Corporation and BN, respectively: • implementing the IRP; • identifying and managing an incident response team ("IRT") principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to, appropriately escalate, make decisions regarding, and document identified cybersecurity incidents; • conducting post-incident reviews to gather feedback on identified cybersecurity incident response procedures and address any identified gaps in security measures; • providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP; and • periodically reviewing the IRP whenever there is a material change in our business practices that may reasonably affect its cybersecurity incident response procedures.

companyName: GRAHAM CORP

ticker: GHM


text: The Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks arising from cybersecurity threats. The Audit Committee receives quarterly reports, and the Board is briefed at least once annually, on cybersecurity risks from the CISO, which address a wide range of topics including the status and specific metrics on our cybersecurity program, recent developments, evolving standards and regulations, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. The Board and the Audit Committee would receive prompt and timely information regarding any future cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board and the Audit Committee discuss our approach to cybersecurity risk management with our CISO, CDIO and other members of management involved in cybersecurity risk management regularly.

companyName: Shockwave Medical, Inc.


text: Cyber threats are constantly evolving, and those threats and the means for obtaining access to information systems are becoming increasingly sophisticated. Cyber threats can come from unauthorized access, computer hackers, computer viruses, malicious code, ransomware, phishing, organized cyber-attacks and other security problems and system disruptions. The Company faces numerous attempts to access the information stored in its information systems. If successful, cyber incidents could expose the Company to loss or misuse of confidential information, including customer information, or disruptions of business operations. In addition, third-party service providers can experience breaches of their systems and products that impact the security of the Company's information technology systems and proprietary or confidential information. The Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate exposure to a particular cybersecurity risk, or if the control is not feasible or may have an adverse impact on operations. In addition, cybersecurity controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: DILLARD'S, INC.

ticker: DDS


text: We believe cybersecurity is critical to advancing our technological developments. As a biopharmaceutical company, we face a multitude of cybersecurity threats common to most industries, such as ransomware and denial of service. Our customers, suppliers, subcontractors, and business partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business strategy, performance, and results of operations. These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity.

companyName: Cardiff Oncology, Inc.

ticker: CRDF


text: All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management. Our Vice President of Information Technology earned a Bachelor of Science in Computer Science and Business and a Bachelor of Science in Business and Economics. The Vice President of Information Technology is also a Certified Public Accountant, a Certified Information Systems Auditor, and a Chartered Global Management Accountant. Our Director of Cybersecurity earned an Associates Degree in Computer Network Engineering and is a Certified Information Systems Security Professional.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: Our CISO reports directly to our Executive Vice President and Chief Information Officer ("CIO"), who reports to our CEO. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication with and reporting from the enterprise security team, many of whom hold cybersecurity certifications, and through the use of technological tools and software and results from third-party assessments. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has over 25 years of cybersecurity experience, including having served as Chief Technology Officer/CISO and co-founder of two cybersecurity companies, during which time he provided cybersecurity consulting services to Fortune 500 companies and taught a digital and network forensics course at the National Computer Forensics Institute. Prior to joining our company, our CISO served as the Director of Security Services for a large network infrastructure company, and our CIO was responsible for network security policies, technology, and operations, including intrusion detection systems and conduct penetration testing, at another large public company. The CIO periodically reports to the Audit Committee regarding cybersecurity risk exposure and risk mitigation strategies. The board of directors also may review and assess cybersecurity risks in connection with its review of our company's mission critical risks.

companyName: CROWN CASTLE INC.

ticker: CCI


text: The Company also evaluates the integrity and security of the technology infrastructure of certain third parties that access, process or store data that the Company considers to be sensitive, significant, or legally protected. ProAssurance reviews and assesses its third-party providers' cybersecurity controls, as appropriate, and makes changes to the Company's business processes to manage these risks.

companyName: PROASSURANCE CORP

ticker: PRA


text: Our internal audit function conducts annual interviews across business groups to identify key areas of risk, including cybersecurity risk. This enterprise risk assessment helps inform the internal audit plan, and both the assessment and progress against the internal audit plan are periodically presented to the Audit Committee. Our Chief Information Security Officer also reports separately to our Audit Committee on cyber and information security risk on a quarterly basis.

companyName: Datadog, Inc.

ticker: DDOG


text: In addition, each year, we undergo System and Organization Controls ("SOC") 1 and SOC 2 audit reviews performed by an independent third-party firm to test our information technology systems internal controls. We also regularly engage additional assessors, auditors and service providers in connection with the implementation, assessment, enhancement and evaluation of our cybersecurity program, including our risk management processes.

companyName: Tradeweb Markets Inc.

ticker: TW


text: The Audit Committee of the Board of Directors has oversight responsibility for ERM, including the cybersecurity programs. The CISO provides regular updates on cyber security to the Audit Committee, including on the cybersecurity aspects noted by the ERM Committee and CPS Committee, and regularly meets with the Audit Committee in executive session. The presentations highlight the state of our cybersecurity and data security programs, as well as our progress on key initiatives in this area.

companyName: LAS VEGAS SANDS CORP

ticker: LVS


text: We have a process to appropriately identify and escalate incidents that would be considered "material" in nature and require disclosure under the SEC's reporting requirements. Our identification and escalation process requires any potentially material incidents to be escalated to the CAO, who would promptly meet with the ERM Committee to determine if the incident is considered material and trigger a reporting obligation through a Current Report on Form 8-K. We did not experience any material cyber incidents since the beginning of our last fiscal year.

companyName: UNITED FIRE GROUP INC

ticker: UFCS


text: Cybersecurity, Risk Management and Strategy Sunnova allocates significant resources to preventing, identifying, and mitigating cybersecurity threats to our technology infrastructure and data.

companyName: Sunnova Energy International Inc.

ticker: NOVAQ


text: Our cybersecurity risk management program leverages the Center for Internet Security Critical Security Framework to provide a structured methodology to help ensure the confidentiality, integrity and availability of our systems and data. We regularly assess cybersecurity risks and monitor our systems for vulnerabilities. We conduct regular reviews and tests of our systems and our cybersecurity program, both internally and using consultants and external auditors. These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.

companyName: RUSH ENTERPRISES INC \TX\

ticker: RUSHA


text: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management, which includes ensuring that the risk management process implemented within our organization is appropriate and functioning as designed. The Audit Committee of our Board of Directors oversees cybersecurity risks pursuant to its charter, and our governance framework includes oversight by the Audit Committee. The Audit Committee, with assistance from our management, including our Head of Information Technology ("IT"), periodically reports to the full Board of Directors to inform them of potential cybersecurity risks and threats, the status of projects to further develop our information security systems, and the emerging cybersecurity threat landscape.

companyName: Intellia Therapeutics, Inc.

ticker: NTLA


text: Our Board of Directors (our "Board") has charged the Audit Committee with oversight of the Company's identification, assessment and management of cybersecurity and data privacy risks. As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk. The Audit Committee receives quarterly updates from our head of information security and our Chief Technology Officer ("CTO") regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.

companyName: Bloomin' Brands, Inc.

ticker: BLMN


text: Depending on the environment, we have implemented various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, from time to time, vulnerability management, information classification and data protection, asset management, software patching processes and procedures, access control, encryption, back-up procedures, disaster recovery plans, training, executive oversight, event logging, endpoint detection, multi-factor authentication, continuous monitoring, audits and engagement of third parties to conduct analysis of our Information Systems and Data.

companyName: Akili, Inc.


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted periodically. Management conducts periodic evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: While we have not, as of the date of this Report, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, we cannot assure you that we will not experience such an incident in the future. Any cybersecurity incidents, whether or not successful, could result in our incurring additional costs related to, for example, rebuilding our internal systems, implementing additional threat protection measures, responding to regulatory inquiries or actions, paying damages or making payments to obtain access to our computer systems, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.

companyName: QDM International Inc.

ticker: QDMI


text: The Risk Committee of the BOD and ORMC are primarily responsible for monitoring management's implementation of operations and technology risk controls, including those relating to cyber security and information security. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company's information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: An annual risk assessment is performed to identify internal and external cybersecurity threats and vulnerabilities, assess the likelihood and potential impact of such threats and vulnerabilities, and prioritize the risks from such threats and vulnerabilities. The results of the risk assessment, along with professional judgment, are used to develop and implement cybersecurity risk mitigation strategies and controls.

companyName: J&J SNACK FOODS CORP

ticker: JJSF


text: The Audit Committee of the Company's Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on quarterly updates from management regarding cybersecurity and is notified between such updates regarding new cybersecurity threats or incidents. Information presented at the quarterly updates includes any emerging risks or key topics and includes training initiatives, the status of projects to strengthen cybersecurity, cyber readiness, incident tracking, mitigation efforts and response plans. The full Board of Directors receives regular reports from the Audit Committee, as well as an annual report from management highlighting key aspects of our cybersecurity risk management activities and the emerging threat landscape.

companyName: LL Flooring Holdings, Inc.


text: We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our CISO, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: Risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. Although our cybersecurity risk management program, as described above, is designed to help prevent, detect, respond to, remediate, and mitigate the impact of cybersecurity incidents, there is no guarantee that a future cybersecurity incident would not materially adversely affect the Company's business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see the headings "Our business is dependent on the efficient and uninterrupted operation of computer network systems and data centers, including third party systems" and "A cyber-attack, incident or security breach could expose us to liability and protracted and costly litigation, regulatory penalties, and could negatively impact our reputation and operating revenues" included as part of our risk factor disclosures in "Part I, Item 1A, Risk Factors," of this Annual Report on Form 10-K.

companyName: GREEN DOT CORP

ticker: GDOT


text: We have established and maintain various information security processes designed to identify, assess, and manage cybersecurity risks to our critical computer networks, third-party hosted services, communication systems, hardware, software, and vital data, such as intellectual property, confidential proprietary information, strategic assets, and nonclinical/clinical trial data ("Information Systems and Data"). Our Chief Operating and Financial Officer, Vice President of Information Technology, cybersecurity business partner and IT & Legal teams collaborate to address cybersecurity threats and risks, leveraging our risk register when needed. Our VP of Information Technology, members of our in-house IT team, and our third-party cybersecurity business partner all play an active role in monitoring and assessing risks from cyber threats through a variety of methods including automated tools, third-party testing, tabletop incident response exercises, threat actor analysis, industry risk profiling, and collaboration with law enforcement.

companyName: Olema Pharmaceuticals, Inc.

ticker: OLMA


text: Processes for Assessing Cybersecurity Threats We manage cybersecurity threats by employing a comprehensive process that is integral to our overall risk management framework. Our risk management approach is designed to be aligned with the Committee of Sponsoring Organizations of the Treadway Commission (COSO) 2017 Enterprise Risk Management ("ERM") framework. This system includes a risk assessment process specifically designed to identify information technology ("IT") and cybersecurity risks that could be material to our organization.

companyName: AH Realty Trust, Inc.

ticker: AHRT


text: In developing our cybersecurity incident response plan and assessing the maturity of our cybersecurity threat program, we utilize the National Institute of Standards and Technology Cybersecurity Framework (NIST). We use NIST as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We make it a practice to continually review the maturity of our program, utilizing the NIST standards and leveraging the feedback of both internal resources and external advisors in an effort to continuously improve our program in relation to evolving cybersecurity threats in our industry.

companyName: ATN International, Inc.

ticker: ATNI


text: Our executive team is actively involved in overseeing our cybersecurity operations to ensure that they meet industry standards. The executive team provides regular updates to the Board—specifically the audit committee—on the status of our cybersecurity efforts, including any potential risks, threats or incidents.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The identification and management of cybersecurity risk is a component of our Integrated Risk Management process, which applies adaptive process improvement to help us respond to the changing cybersecurity landscape. Additionally, we use third parties to enhance our collective capability to monitor, detect, and respond to cybersecurity incidents. Further, we maintain collaborative relationships with government officials, law enforcement, and industry peers to keep informed of trends and potential cyber tactics. Finally, we maintain cybersecurity insurance coverage that we believe is appropriate for the size and complexity of our business.

companyName: ATMOS ENERGY CORP

ticker: ATO


text: Company's cyber risk management strategy has consisted of a focus on minimizing our attack surface and leveraging industry standard cyber threat prevention, detection, and remediation tools. The Company assesses cyber security risk as follows:

companyName: BOXABL Inc.


text: Our cyber risk assessment program is managed by our Information Security & Privacy team, which is led by our Vice President of Information Security & Privacy, who has over twenty-three (23) years of experience in the cybersecurity and technology industry. The Vice President of Information Security & Privacy reports to our Chief Financial Officer. The Vice President of Information Security & Privacy oversees multiple teams that are operationally responsible for PAR's cybersecurity, including IT Security, Cloud Security, and Development, Security & Operations, each of which provides regular updates to the Vice President of Information Security & Privacy regarding threat intelligence, cyber incidents, and cyber risk mitigation strategies as part of their responsibilities. The Vice President of Information Security & Privacy works closely with the Vice President of IT, who is responsible for PAR's information technology and digital transformation strategy, and with the Chief Technology Officer (CTO), who is responsible for software engineering across most of PAR's SaaS products. Together, the three individuals have a complementing set of responsibilities to align, implement and govern cybersecurity policies, standards and technolo gy controls throughout PAR.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: Related to Cyber Security Risks The Audit Committee of the Board has oversight of management's efforts with respect to IT systems and cybersecurity. As part of this oversight, our Chief Information Security Officer ("CISO") shares quarterly updates regarding any changes around our cybersecurity defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats with the Audit Committee. During these meetings, the CISO provides the Audit Committee updates regarding any changes around our cyber defenses, ongoing IT initiatives, and emerging threats and plans to pro-actively address these threats. Our Board has delegated primary responsibility for the oversight of cybersecurity matters to the Audit Committee; however, the full Board reviews significant cybersecurity matters as appropriate. The Audit Committee provides updates to the Board on a quarterly basis on the activities that the Audit Committee oversees, including Cybersecurity.

companyName: LanzaTech Global, Inc.

ticker: LNZA


text: Our Chief Information Security Officer, who has close to two decades of experience in the cybersecurity field, including leadership roles at multiple financial services organizations, has primary responsibility for our IS Program.

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: management and strategy a publicly traded ammo manufacturer and e-commerce outdoor company, we are acutely aware of the importance of robust cybersecurity measures in safeguarding our information assets, operational integrity, and reputation. Our approach to cybersecurity risk management is integrated into our broader risk management framework and overseen by our Board of Directors.

companyName: Outdoor Holding Co

ticker: POWW


text: The Information Security Department also monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Northfield Bancorp, Inc.

ticker: NFBK


text: The Company has established security practices and safeguards designed to help identify and protect against intentional and unintentional misappropriation or corruption of its information technology systems, data, and operational continuity. The Company conducts risk assessments to identify potential cybersecurity threats, which include evaluating the likelihood and potential impact of these threats, identifying system and network vulnerabilities, and assessing the effectiveness of the Company's existing controls. Upon identification and assessment of risks, the Company develops and implements what management believes to be appropriate measures in order to manage these risks, which may involve enhancing security controls, implementing new technologies, training employees, or changing business processes. The Company maintains change management processes, monitoring practices, and data protection measures designed to mitigate cybersecurity risks and regularly test its systems for potential threats. Such processes and practices to assess, identify, and manage cybersecurity incidents are integrated into the Company's overall enterprise risk assessment process.

companyName: EVI INDUSTRIES, INC.

ticker: EVI


text: The Trust faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. The Trustee has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on the Trust's business, financial condition, results of operations, or cash flows. See Item 1A. Risk Factors – The Trust may be subject to attempted cybersecurity disruptions from a variety of sources including state-sponsored actors.

companyName: HUGOTON ROYALTY TRUST

ticker: HGTXU


text: Management and Strategy recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. We primarily rely on expert third-party managed IT service providers to protect our IT systems from cybersecurity threats.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: Management is ultimately responsible for assessing and managing the Company's cybersecurity risk. The information security program is overseen by the Chief Financial Officer. The Audit Committee of the Board is then briefed each quarter on the occurrence of any cybersecurity incidents. The Board will also be provided an overview of the information security program on an annual basis, including updates on the IT team, IT training, implementation of IT controls, cybersecurity testing, the incident response process and the cybersecurity assets of the Company.

companyName: Gaucho Group Holdings, Inc.


text: In the normal course of business, we experience cybersecurity threats and attempted breaches of our systems and network. We classify and track these events based on significance and implement remediation actions that we consider appropriate to address the risks relating to such incidents. We have not experienced any cybersecurity incident, and the risks presented by cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, even well-designed and implemented cybersecurity programs cannot completely eliminate cybersecurity threats, and we cannot guarantee that such events or material impacts will not occur in the future.

companyName: HAWKINS INC

ticker: HWKN


text: Our cyber security consultants continuously monitor our environment for issues and alerts. The security tools that are installed in our systems and devices give them insight into possible suspicious behaviors. When warranted, the cyber security consultants will work with the IT support team to respond to possible security incidents as rapidly as possible.

companyName: ARTELO BIOSCIENCES, INC.

ticker: ARTL


text: On a monthly basis, the cross functional team meets to discuss current trends in cybersecurity threats and the response required to eliminate the threats.

companyName: Eiger BioPharmaceuticals, Inc.


text: In the last three fiscal years, the Company has not experienced any material cybersecurity incidents. We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations, and cash flows, under the heading "Cyber-attacks and other disruptions, security breaches, and incidents could have an adverse effect on our business, harm our reputation, and expose us to liability" included as part of our Item 1A. "Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.

companyName: Nuburu, Inc.

ticker: BURU


text: Our management team, including our CISO in consultation with our Chief Technology Officer and Chief Financial Officer, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents, which may include: briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity consultants; and alerts and reports produced by security tools deployed in our IT environment. However, as indicated above, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.

companyName: Arista Networks, Inc.

ticker: ANET


text: The CISO has served in various roles in information security and information technology for over 20 years for global travel, hospitality, casino, and energy companies along with consulting for both the U.S. Department of Defense and intelligence community. He holds an undergraduate degree in computer information systems, a master's degree in business administration, and has attained the Certified Information Systems Security Professional certification. The CTO holds an undergraduate degree in computer science and a master's degree in business administration and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as the Chief Technology Officer for Qatar Airways Group and Chief Information Officer for MGM Resorts International.

companyName: Travel & Leisure Co.

ticker: TNL


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: J.P. Morgan has a cybersecurity incident response plan designed to enable J.P. Morgan to respond to attempted cybersecurity incidents, coordinate as appropriate with law enforcement and other government agencies, notify clients and customers, as applicable, and recover from such incidents. In addition, J.P. Morgan actively partners with appropriate government and law enforcement agencies and peer industry forums, participating in discussions and simulations to assist in understanding the full spectrum of cybersecurity risks and in enhancing defenses and improving resiliency in J.P. Morgan's operating environment.

companyName: J.P. Morgan Real Estate Income Trust, Inc.


text: Cybersecurity risk management has been integrated into the Company's overall enterprise risk management program (the "Enterprise Risk Management Program") through policies and processes that implement a risk management framework designed to identify, manage, and monitor business unit risks throughout the organization. The Enterprise Risk Management Program is overseen by an executive committee (the "Executive Risk Committee"), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer. Every year, as a part of the Enterprise Risk Management Program, the top risks affecting the Company are identified. For 2023, cybersecurity was identified as a top risk. The applicable subject matter experts brief the Company's Board of Directors on the status of all top enterprise risks at least once per year. Finally, the Nuclear and Operating Committee of the Company's Board of Directors provides ultimate oversight of cybersecurity risk and also receives briefings at least twice per year from the Cybersecurity Group, and notable audit findings relating to cybersecurity are aggregated and provided to the Board of Directors' Audit Committee.

companyName: ARIZONA PUBLIC SERVICE CO


text: The Company's Senior Director of Information Technology is primarily responsible for assessing and managing our material risks from cybersecurity threats, monitoring the effectiveness of our cybersecurity detection and response processes in countering current threats and providing updates to the executive team.

companyName: AVIAT NETWORKS, INC.

ticker: AVNW


text: This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Plymouth Industrial REIT, Inc.


text: We employ a "Defense in Depth" strategy to protect the Company, segmenting our systems and networks so that an attack on one segment does not allow for easier compromise of other systems and networks. Within the Company, administrative access to various systems is limited so that there is no universal access if an administrator-level account is compromised.

companyName: Portillo's Inc.

ticker: PTLO


text: In addition, our Enterprise Risk Management Committee ("ERMC") considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is a cross-functional committee that reports to the Executive Leadership Team and is chaired by our Chief Financial Officer. The ERMC meets during the year at least quarterly and receives periodic updates on cybersecurity risks from the CIO, who is a member of the committee.

companyName: United Parks & Resorts Inc.

ticker: PRKS


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the VP of Technology and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. The VP of Technology is also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.

companyName: Smart Sand, Inc.

ticker: SND


text: We are establishing incident response, business continuity, and disaster recovery plans designed to address our response to a cybersecurity incident.

companyName: HUMBL, INC.

ticker: HMBL


text: Cybersecurity risk is the risk of adverse impacts to the confidentiality, integrity, and availability of data owned, stored, or processed by the Bank or the accompanying information systems. The number and sophistication of attempts to disrupt or penetrate our systems, and those of our suppliers — sometimes referred to as hacking, cybersecurity fraud, cyberattacks, or other similar names — continues to grow.

companyName: ZIONS BANCORPORATION, NATIONAL ASSOCIATION /UT/

ticker: ZION


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring to detect and prevent significant cybersecurity threats. Magnolia uses a leading email and spam filtering solution and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: The Board, in coordination with the ERC, oversees our ERM process, including specifically the management of risks arising from cybersecurity threats. The Board and the ERC each receive periodic presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment and information security considerations that may arise with respect to our peers, key vendors and other relevant third parties. If a cybersecurity incident meeting established reporting thresholds should occur, the Board and the ERC would also receive timely information regarding such incident, plus appropriate updates until the situation has been sufficiently resolved.

companyName: Ameris Bancorp

ticker: ABCB


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.

companyName: Monroe Capital Income Plus Corp


text: We maintain processes for conducting internal and external cybersecurity risk assessments to identify cybersecurity threats that may adversely impact the confidentiality, integrity, or availability of our information systems or data residing therein. We generally conduct internal cybersecurity risk assessments and audits on at least a quarterly basis, which may include penetration testing and vulnerability assessments. We also regularly conduct cybersecurity simulation exercises, including in connection with our disaster recovery procedures. Additionally, we engage third-party service providers to support these efforts, including to conduct security testing on an annual basis.

companyName: Absci Corp

ticker: ABSI


text: Our board of directors is acutely aware of the critical nature managing risks associates with cybersecurity threats. Our board of directors has delegated authority to the Audit Committee to serve as the cybersecurity oversight body. The Audit Committee is composed of board members with diverse expertise including, risk management, technology, and finance.

companyName: Enveric Biosciences, Inc.

ticker: ENVB


text: Our IT manager's skills are further enhanced by MCSA and MCSE certifications and a foundation in Computer Engineering studies at university. Our IT manager has a strong track record of working with major vendors' security, firewall, identity management, and other platforms, ensuring robust and resilient IT infrastructures.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Managing Material Risks & Integrated Overall Risk Management Cybersecurity is a critical part of our enterprise risk management. To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Information Officer ("CIO") leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks. Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans. Components of our program include: • a continuous, four-phase Enterprise Risk Management (ERM) process of risk program development, risk assessment and prioritization, risk response, and risk validation and monitoring designed to help identify cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • the periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, such as penetration (pen) testing, and to otherwise assist with aspects of our cybersecurity processes and controls; • focused, annual, and mandatory risk management education for our employees and leaders, including cybersecurity awareness training, multiple cybersecurity and phishing awareness campaigns throughout each year, and tabletop exercises; • regular assessments of the design and operational effectiveness of the program's key processes and controls by management, our internal audit team, and third-party experts; and • a risk management process for third-party service providers and vendors not under our direct control that includes pre-selection due diligence and validation, and post-selection periodic monitoring to manage cybersecurity risks and monitor adherence to applicable cybersecurity standards.

companyName: Kimball Electronics, Inc.

ticker: KE


text: Our Board of Directors has overall responsibility for risk oversight and has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The leadership team at 26North has delegated oversight of cybersecurity and related risks to a committee (the "Risk Committee"). The Risk Committee is a cross-functional committee that governs and oversees the RMP. The Risk Committee includes members of 26North's senior executive team, including its CFO, CTO, Chief Compliance Officer and senior partners from 26North's legal, operations, finance, investment and strategy teams. The Risk Committee, will, through regular consultation with 26North's internal cybersecurity team assess, discuss, and prioritize the approach to high-level risks, mitigative controls, and ongoing cybersecurity efforts. Further, our Chief Compliance Officer works closely with 26North's CTO to monitor ongoing cybersecurity threats and provide regular updates to our Board of Directors.

companyName: 26North BDC, Inc.


text: We have implemented risk management procedures, which include cybersecurity risk management, that are designed to define our corporate risk tolerance and align assumed risks to that tolerance through risk identification, prioritization, assessment, mitigation and planned responses if risk is realized. These elements are applied to cybersecurity as well as other origins of risk.

companyName: CERO THERAPEUTICS HOLDINGS, INC.

ticker: CERO


text: Engagement of Third Parties in Connection With Risk Management The Company leverages various third parties to conduct evaluations of our Cybersecurity Program, including security controls. The Company engages a third party to audit its information technology function, which includes an assessment of the Company's cybersecurity efforts. The Company also maintains cybersecurity insurance; however, the costs related to cybersecurity threats or disruptions may not be fully insured. Additionally, the Company engages third parties to perform penetration tests on an annual basis. The Company also periodically engages third parties for assessments of specific products, services, or applications. The Company leverages various software and service providers as part of its Cybersecurity Program, including a managed security service provider and a service provider that helps monitor third-party suppliers. The Company also receives periodic threat intelligence reports from vendors, peers, and industry information sharing and analysis centers. The Company maintains a relationship with a leading incident response firm to assist the Company in responding to cybersecurity incidents, if appropriate.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We acknowledge that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of business. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows. We proactively seek to detect and investigate unauthorized attempts and attacks against IT assets, data, and services, and to prevent their occurrence and recurrence where practicable; however, potential vulnerabilities to known or unknown threats will still remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject the Company to additional liability and reputational harm. In response to such risks, we have implemented initiatives such as implementation of the cybersecurity risk assessment process and development of an incident response plan.

companyName: Sharps Technology Inc.

ticker: STSS


text: Company management, including members of the Risk Committee, provides regular updates to the Board of Directors regarding material matters with respect to the Company, including cyber matters. These updates include quarterly updates to the board with respect to material cyber events and a twice per annum cybersecurity program review covering topics such as cybersecurity strategy, assessment, risks, notable events and governance. We also conduct an annual enterprise risk assessment through which it identifies and assesses material risks to the Company, including both cyber and non-cyber risks. This assessment is reviewed and discussed with the Board of Directors.

companyName: Orion Properties Inc.

ticker: ONL


text: We maintain specific coverage to mitigate losses associated with cybersecurity incidents that impact our or our third parties' systems, networks, and technology.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: In the last three years, we have not identified any cybersecurity incidents which have materially affected, or are reasonably likely to materially affect, our business. For further information regarding cybersecurity risks, please refer to "Risk Factors – Risks Related to Our Business Operations" and other risks described in the "Risk Factors" section of this Annual Report on Form 10-K.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Board of Directors maintains oversight of risks from cybersecurity threats by meeting with and receiving periodic updates from our Chief Executive Officer, who is assigned oversight of cybersecurity risks. Our Chief Executive Officer is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.

companyName: VIVOS INC

ticker: RDGL


text: We conduct annual internal audits to test compliance with our technology policies, security procedures and controls. Our third-party information technology providers, consultants and vendors are vetted by our information security teams to assess cybersecurity risks and mitigation measures, where applicable.

companyName: RPM INTERNATIONAL INC/DE/

ticker: RPM


text: To our knowledge, we have not had a cybersecurity incident that has materially affected Magnolia Bancorp, its business strategy, financial condition or results of operation.

companyName: Magnolia Bancorp, Inc.

ticker: MGNO


text: We have an employee security awareness program, required upon onboarding and on an annual basis thereafter, that is designed to raise awareness of cybersecurity threats across functions. As part of this employee training program, we periodically conduct phishing tests. We have also implemented a process to assess and review the cybersecurity practices of certain third-party vendors and service providers that may be critical to the operations of our business and who have access to our information systems including, as appropriate, through the inclusion of cybersecurity requirements in our contracts.

companyName: Upstream Bio, Inc.

ticker: UPB


text: STEP maintains a cybersecurity program that is reasonably designed to protect the Company's information, and that of the Company's portfolio companies and investors, against cybersecurity threats that may result in significant adverse effects on the confidentiality, integrity, and availability of the information systems of STEP and its affiliates. Governance.

companyName: Stepstone Private Credit Fund LLC


text: At Sirius XM Holdings, the Chief Information Security Officer, together with the Chief Product and Technology Officer and Chief Information Officer, are responsible for the day-to-day management of cybersecurity risks. Sirius XM Holdings has also established a Security Council, which includes the Chief Executive Officer, Chief Commercial Officer, Chief Product and Technology Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.

companyName: Liberty Media Corp

ticker: FWONA


text: The Company, its third-party vendors and other companies in the rail and transportation industries have been subject to, and are likely to continue to be the target of, data breaches, cyber-attacks and other similar incidents as discussed in more detail in Item 1A. Risk Factors. In light of the numerous cybersecurity risks that CSX faces, it is reasonably likely that any of the related risks, individually or collectively, if significant, could materially affect the Company's operations, including but not limited to service interruption, train accident or derailment, misappropriation of confidential or proprietary information (including personal information), process failure, or other operational difficulties.

companyName: CSX CORP

ticker: CSX


text: Employee training and awareness: all employees receive mandatory regular cybersecurity training, with additional specialized sessions for high-risk roles. We also conduct simulated phishing exercises to enhance awareness and preparedness;

companyName: HOOKER FURNISHINGS Corp

ticker: HOFT


text: Our cybersecurity program is designed from a risk- and compliance-based approach to achieve systemwide resilience and protection across our operations. We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We utilize the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: The Company has taken steps to gain insights into how cybersecurity risk management functions have been integrated into its overall risk management systems and process. Below are the risk management activities regularly performed: • Cybersecurity, as described above; • Financial control risk assessment which is a formal part of the annual internal control program; • Management's risk assessment associated with the budgeting and strategic planning process; • A broader fraud risk assessment (also performed as part of the internal control program).

companyName: POWER SOLUTIONS INTERNATIONAL, INC.

ticker: PSIX


text: Our Chief Information Security Officer ("CISO") reports to our CTrO and oversees the technical identification, assessment and management of cybersecurity risks relevant to our business.

companyName: Atlassian Corp

ticker: TEAM


text: The company's cybersecurity program is led and overseen by our Chief Information and Technology Officer (the "CITO") and our CISO. The CITO joined CarMax in 2012, reports to our Chief Executive Officer and has served in various technology leadership roles in startup organizations and Fortune 500 companies across the retail, travel, hospitality, finance, and technology industries for over 20 years. The company's CISO reports to the CITO, joined CarMax in 2015 and has served in various roles in information technology for over 20 years, including prior service as the vice president of information security, risk and compliance for a Fortune 500 company.

companyName: CARMAX INC

ticker: KMX


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including Cyril Guyardeau, our Director of Information Systems Security, who had previously spent 15 years as an IT infrastructure engineer in the healthcare industry, and Cecile Delansorne, our Vice President for Information Systems, who has held similar executive positions overseeing information systems in other pharmaceutical companies for over 7years. Our Vice President for Information Systems reports to our CFO.

companyName: DBV Technologies S.A.

ticker: DBVT


text: As of December 31, 2023, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected us, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "Cybersecurity and Information Technology Risks" in this Form 10-K.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: Our management believes that our current systems and practice of implementing regular updates positions us well to support current needs and future growth. We use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosted services, CROs, and CMOs. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, we may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Kezar Life Sciences, Inc.

ticker: KZR


text: The Company's global cybersecurity incident response is overseen by our Chief Information Security Officer. Our Chief Information Security Officer has served in that role for over 2 years and has over 2 decades of cybersecurity governance, engineering, and operations experience for large global brands. Our Chief Information Security Officer reports to the Vice President of IT. The Vice President of IT reports directly to the Senior Vice President of Enterprise, Digital Operations, and Transformation.

companyName: Fisker Inc./DE


text: Our information security function and our Chief Information Officer (CIO) help identify, assess and manage the Company's cybersecurity threats and risks. This group works to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods in certain contexts, including, for example, manual tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threat actors, conducting scans of certain environments, evaluating certain threats reported to us, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

companyName: ACADIA PHARMACEUTICALS INC

ticker: ACAD


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk & Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.

companyName: VOC Energy Trust

ticker: VOC


text: We engage third-party service providers as part of our cybersecurity program. For example, we have engaged an independent cybersecurity advisor to review, assess, and make recommendations regarding our information security program and information technology strategic plan.

companyName: Prairie Operating Co.

ticker: PROP


text: The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our information technology functions. The CTO supports the CISO in chairing a quarterly Technology Risk Committee aimed at providing proper oversight and governance of the cybersecurity program, remediation of identified technology risks, and execution of the cybersecurity strategy. Our processes for assessing, identifying, and managing cybersecurity-related risks is also included within our overall enterprise risk management (ERM) program.

companyName: INSULET CORP

ticker: PODD


text: As part of our cybersecurity program, we have robust incident response and business continuity plans designed to provide a framework for quick and effective remediation of cyber issues, which are tested periodically throughout the year. Additionally, we have worked to create a culture of security by providing regular cybersecurity training to employees to raise awareness about various cyber threats like phishing, social engineering, and insider threats. We provide additional targeted training to individuals responsible for managing our information systems. We also maintain cyber insurance coverage intended to mitigate certain costs associated with certain cybersecurity events.

companyName: Tradeweb Markets Inc.

ticker: TW


text: Managing Third Party Risk Koil Energy recognizes the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough risk-weighted security assessments of various third-parties and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual assessments and assessments on an ongoing basis.

companyName: Koil Energy Solutions, Inc.

ticker: KLNG


text: Security Controls Framework Equifax has implemented a unified security and privacy controls framework as our primary mechanism to establish strategic priorities related to cybersecurity, assess cybersecurity risk across the enterprise, comply with regulatory requirements and enhance security program maturity. Our unified security and privacy controls framework is based upon the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) and Privacy Framework (NIST PF).

companyName: EQUIFAX INC

ticker: EFX