text: Albemarle recognizes the importance of maintaining the security and integrity of our information systems and the data we collect, process, and store. We have implemented a comprehensive cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("CSF"). As such, we map the CSF to corresponding legal, regulatory, and industry security practices, which guide our global policies and procedures to prevent, identify, protect, detect, respond, and recover from cybersecurity threats and incidents. Our cybersecurity program is overseen by our Chief Information Security Officer ("CISO"), and it is integrated into our overall enterprise risk management framework and thus is factored into our long-term strategy and business continuity plans. Our CISO is a Certified Information Systems Security Professional and a Certified Ethical Hacker with more than 25 years of experience as a cybersecurity professional working extensively with critical infrastructure partners to reduce cyber risk within traditional and operation technology networks.

companyName: ALBEMARLE CORP

ticker: ALB


text: The Risk Committee of our Board of Directors provides structured oversight of the Company's Enterprise Risk Management Program, including the oversight of risks from cybersecurity threats. The Risk Committee regularly receives an overview from management of our cybersecurity risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Risk Committee generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer and Chief Technology Officer. Annually, the Risk Committee reviews and approves the Information Security Program. Additionally, the Risk Committee is promptly apprised of any cybersecurity incident that meets established reporting thresholds, and receives ongoing updates regarding any such incident until it has been resolved. At each regularly scheduled Board meeting, the Risk Committee Chair provides the full Board with an update on all significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled Board meeting.

companyName: GREEN DOT CORP

ticker: GDOT

secItem: Item 1C


text: For the year ending December 31, 2025, the Company has launched projects to improve our controls, particularly for logging and monitoring and vulnerability assessments. We currently leverage an AI-driven endpoint threat detection and prevention system. To strengthen our cybersecurity posture, we intend to implement a Security Information and Event Management (SIEM) solution that will aggregate and analyze logs from all critical infrastructure, including network, cloud, and endpoint security platforms. We also intend to expand our vulnerability management process to ensure regular assessments of public-facing systems and network devices. We are currently conducting a data migration project is expected to enhance the Company's security posture and resilience against potential threats, in compliance with SEC guidelines.

companyName: HCW Biologics Inc.

ticker: HCWB


text: Our Information Systems department, in addition to managing our general information technology systems, is also responsible for managing our enterprise-wide cybersecurity processes. Our Information Systems department relies on a third-party managed security service provider ("MSSP") to implement, manage and monitor our cybersecurity systems. Personnel in our Information Systems department, together with personnel at the MSSP, collectively have decades of experience in information security, information technology and cybersecurity operations. The MSSP monitors and receives notifications of potential cybersecurity incidents detected through automated detection and monitoring tools, which are communicated to personnel within our Information Systems department. In the event we discover a material cybersecurity incident, Information Systems personnel reports such incident to our Chief Strategy Officer, who then reports to our Chief Executive Officer and the Audit Committee, as appropriate. We do not currently have a permanent Chief Information Security Officer or other senior security officer of a similar title and rely significantly on the MSSP for management of enterprise-wide cybersecurity processes.

companyName: Cronos Group Inc.

ticker: CRON


text: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology ("IT") functions to assess Tredegar's information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement. The results of such an assessment are regularly presented to the Audit Committee. Notably, these assessments include periodic penetration tests, which allow Tredegar to identify vulnerabilities, refine procedures, and enhance its crisis management and recovery capabilities. The Program is also supported by an organizational structure, involving collaboration across various business sectors and an interdisciplinary Global Data Protection and Cybersecurity Oversight Team that meets regularly to identify information security risks and appropriate risk mitigation strategies. Additionally, because Tredegar recognizes the significant role that its employees play in information security, it provides annual formal information security training to all of its employees that covers critical topics such as phishing and email security best practices. Furthermore, periodic simulated phishing exercises are conducted to reinforce these practices.

companyName: TREDEGAR CORP

ticker: TG


text: As of the date of this Annual Report on Form 10-K, we believe that the Cybersecurity Incident has not materially impacted the Company, our overall financial condition or results of operations, and that the incident is not reasonably likely to materially impact the Company, our financial conditions or results of operations. In addition, we are not aware of any cybersecurity threats or cybersecurity incidents that have or would be reasonably likely to materially affect us, including our business strategy, results of operations or financial condition as of the date of this Annual Report on Form 10-K. This includes penalties and settlements, of which there were none. We are seeking reimbursement of costs, expenses and losses stemming from the Cybersecurity Incident by submitting claims to our cybersecurity insurer. The timing and amount of any such reimbursements are not known at this time. As discussed in more detail in Part II, Item 7, "Management's Discussion and Analysis of Financial Condition and Results of Operations", the Cybersecurity Incident had a $4.6 million impact on our results for the year ended December 31, 2024.

companyName: ARTIVION, INC.

ticker: AORT


text: The operation of our business is dependent on the secure functioning of our digital information systems and infrastructure. Our cybersecurity risk management program (our "Cybersecurity Program") has been designed to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: Cybersecurity Risk Assessment Strategy, Policies and Standards The Company's cybersecurity program is primarily structured based upon national and international security protocols and frameworks. The Company has implemented a strategy to address threats to Company assets. The Company's Information Security program balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Company and customer information. The Company conducts benchmark assessments of its Information Security program to evaluate its strength as measured against recommended industry security best practice entities.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH


text: The Company also uses applications hosted by a reputable third party that are critical to managing Ramaco's business and financial records. The process to oversee and identify cyber risks associated with the third-party service provider involves reviewing its annual System and Organization Controls 2 ("SOC 2"), Type 2 Report as well as conducting recurring status meetings with the third party.

companyName: Ramaco Resources, Inc.

ticker: METC


text: Monitor Cybersecurity Incidents The CISO implements and oversees processes for the regular monitoring of our IT systems. This includes the deployment of security measures to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO runs an incident response plan. This plan includes actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: electroCore, Inc.

ticker: ECOR


text: While to date, we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "Disruptions to or any breach of our information technology systems could disrupt our business operations which could have a material adverse effect on our business, prospects, results of operations, financial condition and/or cash flows."

companyName: BOSTON OMAHA Corp

ticker: BOC


text: We maintain a system of data protection and cybersecurity resources, technology, and processes. We regularly evaluate new and emerging risks and ever-changing legal and compliance requirements. We make strategic investments to address these risks and compliance requirements. We also perform annual and ongoing cybersecurity awareness training, which includes regular simulated phishing campaigns. We also run tabletop exercises, including with external advisors, to simulate a response to a cybersecurity incident, and we use the findings to improve our practices, procedures, incident response plan, and technologies. In the event of a cybersecurity incident, we have worked with external advisors to develop an incident response plan, which provides guidelines for responding to an incident and facilitates coordination across multiple parts of our Company. The incident response plan includes a procedure for notifying the CISO and CIO of any incident as well as a procedure for reporting any material incidents to the Audit Committee of our Board (the "Audit Committee") and Board as appropriate.

companyName: Floor & Decor Holdings, Inc.

ticker: FND


text: The Adviser manages the Company's day-to-day operations, and the Company uses the Cybersecurity Program to assess, identify and manage material cybersecurity risks affecting the Company and its operations. The Company's business is dependent on the communications and information systems of Morgan Stanley, including but not limited to the Cybersecurity Program, and other third-party service providers.

companyName: North Haven Net REIT


text: The Audit Committee cybersecurity risk oversight role includes: (i) reviewing and approving technology security policies and internal cybersecurity controls, (ii) monitoring cybersecurity and information security exposures, and (iii) confirming management has adequate procedures in place to not only control and limit these exposures but also to timely respond to any cyber incident. NNN's cybersecurity risk profile and cybersecurity program status, including results of any third-party evaluations are reported to the Audit Committee by the CATO.

companyName: NNN REIT, INC.

ticker: NNN


text: We have plans in place in order to respond to detected cybersecurity incidents: • Maintain written playbooks, which provide sequential instructions on the appropriate steps to take in the wake of various cyberattacks, including a playbook for each of the following: ransomware attack, a data breach, loss of third-party data and partial and full disaster recovery plans; and • Retain a leading incident response provider to assist with security incidents as well as an attorney that serves as our data breach coach who specializes in data privacy and cyber security, and has relationships with third-party forensics investigators, crisis communications professionals and other services and organization we may need if a data breach is encountered.

companyName: FIRST INDUSTRIAL LP


text: As part of the above-planned processes, we may engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.

companyName: Chilean Cobalt Corp.

ticker: COBA


text: We believe a robust and proactive approach to cybersecurity risks and threats is essential to achieving our strategic business objectives and protecting our business. We may face a wide range of cybersecurity threats, such as ransomware and denial-of-service attacks. Our customers, suppliers and other business partners may also face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these third parties could have a material adverse effect on our business and results of operations. Due to the risks that cybersecurity threats can pose to our business, we intend to continually evaluate best practices and methods, including cyber defense systems and training programs, to protect our business from a wide range of potential threats.

companyName: Modular Medical, Inc.

ticker: MODD


text: We have two cybersecurity teams, each dedicated to a specific area. Our Information Technology Cybersecurity team focuses on corporate programs, and our Products Cybersecurity team focuses on customer-facing programs. These teams work collaboratively to implement programs designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, these teams are responsible for addressing cybersecurity threats and responding to cybersecurity incidents. Through ongoing communications with these teams, the Senior Vice President of Information Technology, the Senior Director of Information Security and the General Counsel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee when appropriate. Similarly, the Audit Committee reports cybersecurity threats and incidents to the full Board of Directors as appropriate.

companyName: Mueller Water Products, Inc.

ticker: MWA


text: Our CTO's background includes 13 years of experience leading technology at several eCommerce companies and our Director of Information Security has 15 years of experience in the field of cybersecurity, including extensive experience as head of information security at public and private companies. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.

companyName: FIGS, Inc.

ticker: FIGS


text: We have a cross-functional approach to addressing cybersecurity risk, with digital technology, legal, and the corporate audit functions presenting to the Enterprise Risk Management Committee on key cybersecurity topics; and On at least an annual basis, the full Board of Directors receives a comprehensive cybersecurity review, including director education from third-party cybersecurity experts.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: We have also established a vulnerability management program to address the identification, prioritization, and remediation of potential cybersecurity vulnerabilities. These procedures allocate responsibility among various members of our cybersecurity team to detect vulnerabilities, assess their urgency, backup appropriate systems, and prioritize, select, test, and verify remediation methods. We hold weekly and monthly vulnerability management meetings with our internal technical and business partners and regularly review these procedures to ensure that this vulnerability management program continues to be effective.

companyName: CNX Resources Corp

ticker: CNX


text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 25 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.

companyName: Adient plc

ticker: ADNT


text: Our information security program and team are currently managed by our Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer. Our CISO has more than 25 years of experience in managing and leading cybersecurity functions which includes cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China. Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data. With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, including the President, Chief Financial Officer, Chief Legal Officer, and Chief Technology Officer, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: To further enhance the Board and Audit Committee's role in overseeing cybersecurity risks, the Board formed a special working group that is comprised of two members of the Audit Committee to have more frequent and detailed dialogue with executive management (including our COO, CFO, CIO, CISO and VP of Internal Audit) on all areas pertaining to cybersecurity. This working group provides updates on a quarterly basis, or more frequently if necessary, to the Audit Committee.

companyName: KFORCE INC

ticker: KFRC


text: The audit committee is primarily responsible for the Board's cybersecurity risk oversight. Management, including the CISO, provide comprehensive briefings to the audit committee on cybersecurity risks on a regular basis, and the audit committee reports to the Board at least quarterly. These briefings encompass a range of topics, including the current cybersecurity landscape and emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and compliance with regulatory requirements and industry standards. Additionally, the full Board is regularly briefed on updates related Global Information Security Program and the Company's Information Security Roadmap. The Board also oversees the prompt assessment of material cyber events including countermeasures and mitigation actions. In addition to scheduled meetings, the audit committee and CISO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain.

companyName: AMERICOLD REALTY TRUST

ticker: COLD


text: The Company employs a cybersecurity policy which it believes is appropriate for the potential of cybersecurity threats faced by it. The Company does not have possession of personally identifiable patient information from its clinical trials, nor does it have information with respect to third party credit or banking information. Accordingly, the threat is limited to disruption of ordinary business operations. The Company's information systems and maintenance are delegated to independent information technology and cybersecurity consultants, with at least 10 years of experience advising similarly situated companies on information technology and cybersecurity risk management, who report to the Company's Chief Financial Officer, who reports in turn directly to the Board of Directors and the Audit Committee, which is the principal committee charged with the Board's risk management oversite. The Company has never been affected by cybersecurity incidents.

companyName: REVELATION BIOSCIENCES, INC.

ticker: REVB


text: The Cyber Risk Management Policy (the "Policy") establishes the framework for our cybersecurity risk management and governance. Our security teams operationalize the Policy across the Company and conduct cyber risk identification, assessment, management, and reporting. Our privacy teams are responsible for identifying, assessing, managing, and reporting on data protection risks. We leverage the National Institute of Standards and Technology (NIST) frameworks for cybersecurity and privacy. We annually measure our security and privacy program maturity against the NIST frameworks, and engage a third-party every other year to assess the current state against these frameworks. The results of these assessments are discussed with the Board and the Cybersecurity Subcommittee of the Audit Committee.

companyName: Booking Holdings Inc.

ticker: BKNG


text: The Company maintains a robust cybersecurity program that promotes confidentiality, integrity and availability of our corporate and customer resources throughout the life cycle of our out-of-home service offerings. Under the oversight of the Audit Committee of our Board of Directors, as more fully explained below, and with the support of the Company's compliance function and the Company's internal and external audit functions, the Company operates an enterprise-wide risk management governance framework that sets standards and provides guidance for the identification, assessment, monitoring and control of the most significant risks facing the Company, including cybersecurity. Our enterprise risk management process is guided by the COSO Enterprise Risk Management Framework three lines of defense model, and we further utilize our global Compliance department, legal teams, cybersecurity teams and privacy teams as part of our overall cybersecurity program.

companyName: Clear Channel Outdoor Holdings, Inc.

ticker: CCO


text: Our Director and VP of IT oversee and manage the Company's cybersecurity risk monitoring and mitigation processes and regularly collaborate with other departments, including business units and the information technology department, as necessary, to facilitate the risk monitoring and mitigation processes and to ensure the policies and procedures for our information security program are integrated into our overall risk management assessment. The information security team performs a bi-annual third-party assessment using industry standard frameworks of our information security program. Results are shared with the Company's management and with the Board of Directors.

companyName: DIODES INC /DEL/

ticker: DIOD


text: In 2023, the APA Board of Directors established a standing Cybersecurity Committee to assist with oversight of APA's cybersecurity program and the material risks associated with the threats identified under the program. The Cybersecurity Committee receives regular reports from APA management, including the CIO, regarding APA's cybersecurity systems and programs, and the committee from time to time also receives updates from external cybersecurity specialists on cybersecurity trends and incidents.

companyName: APACHE CORP


text: Reporting to Board of Directors The Directors of Information Technology and Internal Audit regularly inform executive management of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Partnership. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: MARTIN MIDSTREAM PARTNERS L.P.

ticker: MMLP


text: Cybersecurity threats and incidents are monitored and addressed through the processes described above in "- Risk Management and Strategy" and, as part of such processes, cybersecurity incidents are evaluated by the company's cybersecurity organization, which escalates information about incidents, as appropriate for the severity of the incident, to the CISO and by the CISO to senior leadership.

companyName: Sylvamo Corp

ticker: SLVM


text: We are a SPAC with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: ALPHA MODUS HOLDINGS, INC.

ticker: AMOD


text: In addition, we engage certain third-party security providers to assist with assessing, identifying, and managing cybersecurity risks. Such services include but are not limited to managed security providers, assessors, consultants, auditors, and penetration testers. We also use a third party vendor management software to assess the security posture of other material third party vendors to reduce the impact of a security incident from such vendors. As discussed below, we rely on notifications from third-parties and other external alert systems to identify material risks that may exist with such parties.

companyName: BRC Group Holdings, Inc.

ticker: RILY


text: In the ordinary course of business, we provide proprietary content and we collect, store and use confidential information (including, but not limited to, personal customer information and data) in connection with providing our products and engaging our employees and contractors. We have developed systems and processes designed to protect such content and information and we maintain cybersecurity insurance coverage. Our Board of Directors (the "Board") and management recognize the critical importance of protecting the confidentiality and integrity of such information and data and maintaining the trust and confidence of our members, business partners, employees, contractors and shareholders, as well as complying with applicable regulatory requirements and contractual obligations.

companyName: WW INTERNATIONAL, INC.

ticker: WW


text: Key components of our Cybersecurity Program include, but are not limited to, the following: • Information Security Governance: We designed what we believe are appropriate measures, policies and procedures to ensure that information and information systems are properly protected given the nature of our businesses and the size and complexity of our organization, including our reliance on third parties; • Organization: The Information Security team, led by the Chief Information Security Officer (CISO), is responsible for implementing and managing the Cybersecurity Program with executive oversight from the Chief Executive Officer and Chief Financial Officer, as well as oversight from our Board of Directors. Our CISO has extensive cybersecurity knowledge and skills gained from over 26 years of work experience on the information security team at SEI. In addition to the CISO's cybersecurity experience, he has certifications in risk and information systems control along with information systems auditing; • Cybersecurity Controls: We have implemented what we believe are appropriate preventative measures to protect SEI's infrastructure, systems, and data. These measures include network architecture segmentation, system and platform hardening, in-transit and at-rest encryption, dynamic security awareness training, regular vulnerability scanning and penetration testing, firewalls, web proxy filtering, and multifactor authentication, all of which we constantly evaluate and upgrade as we believe is needed based on our risk assessments; • Managed Detection and Response: Our security operations center's uninterrupted monitoring processes utilize tools such as network and host-based intrusion detection systems, endpoint detection and response technology, distributed denial of service detection and mitigation service, and centralized security and information event management (SIEM). These efforts are further supplemented by signals operations and threat hunting that provide the incident responders the ability to write custom detections to complement commercial technology controls and execute triage/analysis, threat intelligence, and response; • Independent Audits: We are subject to industry regulatory examinations. Our internal audit function provides independent assessment and assurance on the overall operations of our Cybersecurity and Privacy Programs and the supporting control frameworks. We also engage various reputable third parties to perform independent auditing and testing as well as network and web application penetration testing; • Risk Management Oversight: Enterprise Risk Management, through the Enterprise Risk Committee, provides independent monitoring and reporting of cybersecurity risks commensurate with our Technology Risk Program. In addition, we leverage our Third Party Risk Management, Insider Threats, Business Continuity & Disaster Recovery and Information Governance programs to supplement our Cybersecurity Program; and • Privacy Oversight: In addition to our Enterprise Risk Management functions, our Legal and Compliance team maintains a privacy risk management program to assess, manage and report privacy risks related to how we are collecting, using, sharing, and storing user data. Our Privacy team works with our Third Party Risk and Information Security teams to manage privacy-related issues.

companyName: SEI INVESTMENTS CO

ticker: SEIC


text: Our Audit Committee receives quarterly updates from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding any material cybersecurity incidents.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Board of Directors and Committee Oversight Our Board of Directors is responsible for understanding the issues and risks that are central to our business, including cybersecurity matters. In general, our Board of Directors and senior management team coordinate to oversee our guidelines and policies with respect to risk assessment and risk management, and the Audit Committee of our Board of Directors (the "Audit Committee") discusses our financial and operational risk exposures and the steps management has taken to monitor and control such exposures. In this context, the Audit Committee would be informed of a material cybersecurity incident that could impact our financial statements.

companyName: Greenbacker Renewable Energy Co LLC


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us.

companyName: KALTURA INC

ticker: KLTR


text: Engagement of assessors, consultants, auditors, or other such processes by the Company The Company engages outside consultants to conduct vulnerability scans and penetration tests to help the Company find and then mitigate cybersecurity threats. As noted above in Item 1 Business under the sub-heading Data Security, the Company also uses an external auditor to conduct an annual SOC 2 Audit.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: Our cybersecurity teams are supported by training programs and a dedicated learning management system, Herbalife University, whereby all Herbalife employees receive mandatory security awareness training. Specialized training is also assigned to certain functions based on job responsibilities. Training content is purchased from multiple well-recognized third parties. In addition to assigned training, Herbalife University offers additional information security related courses available to all employees on demand.

companyName: HERBALIFE LTD.

ticker: HLF


text: Risk Management Personnel CenterPoint Energy's Executive Vice President and General Counsel is responsible for overseeing our cybersecurity and data privacy programs. CenterPoint Energy's CISO is responsible for the day-to-day management of our cybersecurity program and reports directly to the Executive Vice President and General Counsel. CenterPoint Energy's Senior Vice President, Deputy General Counsel, and Chief Ethics & Compliance Officer (CECO) is responsible for day-to-day management of our data privacy program and also reports directly to the Executive Vice President and General Counsel. Our cybersecurity and data privacy teams, which report directly to our CISO and CECO, respectively, are tasked with implementing our programs in support of cybersecurity and data privacy risk management. We also have management-level teams and committees, which include and/or collaborate with our CISO and CECO, that support, among other things, our processes to assess and manage cybersecurity risk. These teams and committees provide summary reports on their activities and initiatives to appropriate senior executives, including the Executive Vice President and General Counsel and the Audit Committee or the Board, as appropriate.

companyName: CENTERPOINT ENERGY RESOURCES CORP


text: Our management team is involved in assessing and managing the Company's material risks from cybersecurity threats, including by hiring appropriate personnel, considering cybersecurity risk in our enterprise risk management strategy, helping prepare for cybersecurity incidents, and participating in the cybersecurity incident response and remediation process for incidents escalated to it including determining materiality. Our management that is involved in these processes includes our Chief Technology Officer, Chief Financial Officer and General Counsel. Management also escalates, as appropriate, reports relating to cybersecurity incidents or threats to our Board or to its Audit Committee.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: The Vice President of Information Security leads our information security program. Our VP of Information Security has over 20 years of industry experience, including serving in similar roles leading and evolving cybersecurity programs at other public companies. Regular reports are provided to senior management and other relevant teams on various cybersecurity threats, assessments, and findings.

companyName: GRIID Infrastructure Inc.


text: The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.

companyName: ESSEX PORTFOLIO LP


text: The Vice President of Information Technology (IT) and the Director of IT Security are responsible for overseeing our cybersecurity risk management program and assessing cybersecurity risks. This includes managing internal cybersecurity staff, consulting with external cybersecurity experts, and staying informed through governmental and private sources. They report regularly to executive management on cybersecurity threats, resources, and program updates.

companyName: STAR GROUP, L.P.

ticker: SGU


text: At the management level, our CISO, who reports to our Chief Information Officer, is responsible for overseeing the assessment and management of our material risks from cyber security threats. Our CISO has extensive experience and knowledge in cyber security as a result of 26 years of experience in leading security teams, developing security strategies, and managing risk across various industries. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through reports from a number of experienced information security officers responsible for various parts of the business and regularly reviewing risk management measures implemented by the Company to identify and mitigate cyber security risks.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The operation of our businesses is dependent on the secure functioning of our computer infrastructure, digital information systems, and third-party hosted services. We use these systems to maintain sensitive business and customer data, operate record-keeping and accounting functions, process business transactions, and for other key aspects of our business.

companyName: Ascend Wellness Holdings, Inc.

ticker: AAWH


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from senior management on our cyber risk management program. Board members receive presentations on cybersecurity topics from senior management, or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: LIGAND PHARMACEUTICALS INC

ticker: LGND


text: During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or that are reasonably likely to materially affect the Company, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.

companyName: Antares Strategic Credit Fund


text: The IRPs set out a coordinated, multi-functional approach for investigating, containing, and mitigating incidents, including reporting findings to senior management and other key stakeholders and keeping them informed and involved as appropriate. In general, our incident response process follows the NIST (National Institute of Standards and Technology) framework and focuses on four phases: preparation; detection and analysis; containment, eradication and recovery; and post-incident remediation.

companyName: AT&T INC.

ticker: T


text: Chinese subsidiaries and affiliates have incurred, and will continue to incur, significant expenses in an effort to comply with cybersecurity and information security standards and protocols imposed by law, regulation, industry standards or contractual obligations to the date of this Report in all material respects.

companyName: Senmiao Technology Ltd

ticker: AIHS


text: Despite our efforts, the risk of cybersecurity incidents remains, and we continue to monitor, adapt and enhance our security posture to address evolving threats. Any future cybersecurity breaches or system vulnerabilities could impact our business operations, reputation and regulatory compliance obligations. We remain committed to maintaining a robust cybersecurity program to mitigate these risks.

companyName: Sunrun Inc.

ticker: RUN


text: We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and third party consultants, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning. We conduct "tabletop" exercises during which we simulate cybersecurity incidents to help us prepare to respond to a cybersecurity incident and to identify areas for potential improvement. We also provide employee training to support identification of and how to respond to cyber attacks. The results of these assessments are reported to the Board.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: The Company's cybersecurity strategy is focused on detection, protection, incident response, security risk management and mitigation, and resiliency of the cybersecurity infrastructure. The Company relies on third party service providers to operate and maintain its information technology infrastructure and systems and to evaluate, test and update various information security processes and to manage material risks from cybersecurity threats to the Company's critical computer networks, third-party hosted services, communications systems, hardware and software, and critical data, including confidential information that is proprietary, strategic or competitive in nature, as well as any personally identifiable information related to any tenants' and employees' personal data.

companyName: AmBase Corp

ticker: ABCP


text: When reviewing third party information technology service providers, our engagement process customarily includes, among other things, a review of such providers' cybersecurity measures. Additionally, we use third party data, such as Security Scorecard, to review and monitor such providers and as an indicator in respect of our cybersecurity environments.

companyName: MERCER INTERNATIONAL INC.

ticker: MERC


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our overall risk mitigation strategy, we also maintain cyber insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other related breaches.

companyName: Mersana Therapeutics, Inc.


text: The Company has established an Executive Privacy & Security Council ("EPSC") that meets semi-annually. The EPSC consists of a cross-functional senior leaders, including the Chief Information Officer ("CIO"), the Chief Information Security Officer ("CISO"), the Chief Risk Officer ("CRO"), the Chief Privacy Officer ("CPO") and General Counsel, among others. The EPSC receives a monthly written executive briefing on topics, and with metrics related to cybersecurity, including incident prevention, detection, mitigation and remediation. Quarterly, the Information Technology ("IT') Risk Council, made up of senior IT leaders, is also provided with an update of cybersecurity risks and preparedness. Various other meetings are held on cybersecurity topics periodically, including monthly business operating reviews, and meetings of the Enterprise Risk and Capital Committee ("ERCC") and executive leadership team.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: The Company maintains a cybersecurity program that is aligned with its business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into its overall risk management processes and governance structure.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: The Audit Committee of the Board is responsible for monitoring and overseeing risk management from cybersecurity threats. In accordance with the Audit Committee's charter, the Audit Committee is responsible for oversight of our ERM program, which includes cyber risk management. It is the Audit Committee's responsibility to review and discuss with management the adequacy and effectiveness of our cybersecurity policies and the internal controls regarding cybersecurity and privacy related areas. To satisfy this responsibility, the Audit Committee receives periodic updates from management regarding our cybersecurity program. The updates may include information on, among other things, actual events or incidents, results of vulnerability assessments and penetration testing, results of security incident and event management monitoring, updates to the cybersecurity strategy and program, new or modified security policy recommendations, and cybersecurity risk in general. On at least an annual basis, management presents to the Audit Committee on cybersecurity strategy and framework, roadmaps for continued program maturity, key risk areas and related actions, and any significant incidents that have occurred or are reasonably likely to occur. The entire Board is invited to attend this annual cybersecurity meeting of the Audit Committee.

companyName: Crocs, Inc.

ticker: CROX


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function through the audit committee. The chairperson of our audit committee has received a certificate in Cybersecurity Oversight from Carnegie Mellon University.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on us are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operational results, and financial condition.

companyName: Steele Creek Capital Corp


text: Our Chief Trust Officer is responsible for assessing and managing material risks from cybersecurity threats. Our Chief Trust Officer has more than twenty years of cybersecurity leadership experience, including serving in similar roles leading cybersecurity programs at other public companies.

companyName: Autodesk, Inc.

ticker: ADSK


text: Our information security program is principally managed by our information security team, which is led by our Senior Director, Information Services and Security. Our Senior Director of Information Services and Security reports to our Vice President of Information Services, who has extensive experience with information technology governance, data management, and systems management, including managing information security and data privacy law compliance at large multinational companies. Our information security team includes professionals with deep professional experience and cybersecurity expertise, including our Senior Director of Information Services and Security. Such expertise includes applicable security and technology degrees and certifications held by information security team members, including degrees in computer science, cybersecurity, and systems engineering and management and security certifications such as COMP TIA Security+, COMP TIA Data+, and GIAC Security Essentials. We also augment our internal cybersecurity expertise by engaging security service organizations.

companyName: Inspire Medical Systems, Inc.

ticker: INSP


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see "Risk Factors – We face risks related to our information technology systems, and potential cyber-attacks and security breaches."

companyName: Ascend Wellness Holdings, Inc.


text: Our ERM program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process when identifying and assessing material risks. Our ERM team collaborates with internal subject matter specialists, as necessary, to gather insights and report on the most significant risks. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to identify threats and improve our incident response plan.

companyName: CRAWFORD & CO

ticker: CRD-A


text: To mitigate the risk of a cybersecurity incident both internally and with third parties, the Company's IT team provides mandatory cybersecurity training for all employees and contractors. They also conduct periodic training and awareness campaigns by sending employees simulated phishing attacks. The results of these simulated phishing attacks are reviewed and reported to management and the Board of Directors. In addition to training its employees and consultants, the Company's devices and servers are equipped with cybersecurity software applications, which are continuously monitored by an expert third-party managed security service provider that has numerous certifications recognized in the IT industry and provides security services for several Fortune 100 companies and certain highly secure government agencies. Different data analytics techniques are used to detect suspicious system behavior, provide contextual information, and block malicious activity. Any detected threat or malicious activity will immediately alert the security team for further investigation and remediation. Periodically, the Company engages a third party to perform both internal and external penetration testing to assess strengths and vulnerabilities of the Company's readiness against cyber attacks.

companyName: DYNEX CAPITAL INC

ticker: DX


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our customers' confidential information ("Information Systems and Data").

companyName: Xometry, Inc.

ticker: XMTR


text: Our Chief Information Officer and our Chief Information Security Officer each have more than two decades of experience in technology and cybersecurity. The cybersecurity team has related academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks and is responsible for building out the materials for review by leadership.

companyName: CAVA GROUP, INC.

ticker: CAVA


text: We utilize various information technology and data protection services to help detect and prevent cyberattacks, including but not limited to firewalls, intrusion prevention systems, denial of service detection, anomaly based detection, anti-virus/anti-malware, endpoint encryption and detection and response software, Security Information and Event Management system, multiple threat intelligence services, threat hunting managed security service provider (MSSP), identity management technology, security analytics, multi-factor authentication and encryption. There can be no assurance that our protections will always be successful and any failure could result in loss, disclosure, theft, destruction or misappropriation of, or access to, our confidential information and cause disruption of our business, damage to our reputation, legal exposure and financial losses.

companyName: NCR Atleos Corp

ticker: NATL


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shared common methodologies, reporting channels, and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas. Our overall strategy in protecting against cybersecurity risks includes the following preventative and detective measures: • Multi-layered network security architecture – We have implemented firewalls, intrusion detection and prevention systems (IDPS), endpoint detection and response (EDR) solutions, and we utilize threat intelligence. • Incident Response – In the event of an incident, management has established an incident response plan designed to identify, evaluate, respond to, mitigate, and report potential cybersecurity threats, including notifying the Board or regulatory agencies, as deemed appropriate. This response plan is tested regularly and is intended to address cybersecurity risks to the corporate information technology ("IT") environment including the Company's systems, hardware, software, data, people, and processes. • Regular security assessments and penetration testing – We conduct periodic vulnerability assessments and simulated cyberattack exercises to identify and remediate security weaknesses in our IT infrastructure. • Third-party Security Operations Center (SOC) monitoring – We partner with a third-party SOC and incident response retainer to provide security monitoring, threat detection, and rapid incident response, ensuring proactive identification and mitigation of potential cyber threats. • Employee cybersecurity awareness and training programs – All employees are required to participate in cybersecurity training, including phishing simulations, social engineering awareness, and secure data handling practices.

companyName: Oklo Inc.

ticker: OKLO


text: Identity and Access Management Our identity and access management policies and procedures define the access control measures to our Information Systems to protect the privacy, security, and confidentiality of Computer Equipment, Information Systems, and Information Assets.

companyName: Clene Inc.

ticker: CLNN


text: Board is periodically informed of our risk management process, including risks from cybersecurity threats. Our Board is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Our Board of Directors' Role in Oversight of Cybersecurity Threats Our Board of Directors is responsible for overseeing the Company's business and affairs, including risks associated with cybersecurity threats. The Board oversees the Company's corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Board Risk Committee.

companyName: FIRST BANCSHARES INC /MS/


text: We have developed an incident response plan that includes a process for addressing issues arising from third-party relationships which includes communication channels for reporting and managing incidents involving third parties.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: The Chemours Company The board of directors is responsible for oversight of our Enterprise Risk Management process ("ERM") and is informed of the risks associated with cybersecurity through periodic ERM updates. The Board has also delegated oversight of the cybersecurity and information security programs and processes for assessing, identifying and managing material risks from cybersecurity threats to the Audit Committee. The Audit Committee regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and, ultimately, the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: Chemours Co

ticker: CC


text: As of the date of this filing, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For additional information, see Part I, Item 1A, Risk Factors—Risks Related to Our Intellectual Property, Information Technology, Cybersecurity and Privacy—A cybersecurity incident, other technology disruptions or failure to comply with laws and regulations relating to privacy and the protection of data relating to individuals could negatively impact our business, our reputation and our relationships with customers.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: The Company's cybersecurity program is managed by a dedicated Director of Information Technology. The Company's Director of IT has more than 25 years of experience in the design and implementation of IT infrastructure, including cybersecurity features, and holds a variety of relevant certifications. The Company has also engaged a third-party IT expert to assist the Company's in-house IT function in managing cybersecurity risks and evaluating, monitoring and testing the Company's cybersecurity program.

companyName: RETAIL OPPORTUNITY INVESTMENTS CORP


text: Our board-level audit committee retains oversight of our cybersecurity program, which is led by our Vice President of Information Technology Services. Our senior leadership regularly provides updates on cybersecurity risks and cybersecurity initiatives to both the audit committee and the broader board. The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate these risks. The Board's oversight of cybersecurity risks occurs at both the Board level and through its Audit Committee.

companyName: COMPASS MINERALS INTERNATIONAL INC

ticker: CMP


text: Our Executive Vice President and Chief Digital Officer, (the "CDO"), Shawn C. Berg, is responsible for managing the Company's cybersecurity risk and cybersecurity program. Shawn Berg has served as CDO since April 2019 overseeing the Company's Technology, Marketing, and Digital Business operations. Mr. Berg was appointed as an executive officer of MarineMax by our Board in October 2022. He previously served as Vice President of Technology upon joining MarineMax in 2017. Mr. Berg has over 30 years of experience, including experience in multiple officer-level positions, in information technology and security.

companyName: MARINEMAX INC

ticker: HZO


text: We recognize the importance of maintaining the integrity of our information technology systems and safeguarding the confidential business and personal information we receive and store about our employees, customers and suppliers. We have a cybersecurity risk management program in place designed to assess, identify and manage material risks from cybersecurity threats. Our cybersecurity risk management program is designed to employ industry best practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cyber attacks, cybersecurity incidents, and data breaches; cybersecurity crisis preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Among the key features of our program are:

companyName: TopBuild Corp

ticker: BLD


text: No risks from cybersecurity threats have materially affected, nor has LP identified any specific risks from known cybersecurity threats that are reasonably likely to materially affect, LP, including our business strategy, results of operations or financial condition. Please see "Risk Factors – Business and Operational Risk Factors – Cybersecurity risks related to the technology used in our operations and other business processes, as well as security breaches of Company, customer, consumer, employee, or vendor information could adversely affect our business" in Item 1A of this annual report on Form 10-K for additional discussion of cybersecurity risks applicable to LP.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: Our overall strategy in combatting known cybersecurity risks includes a variety of individual tactics, including: use of antivirus software, virtual private networks, email security, as well as other software to prevent and detect data the deployment of updates and patches as they are available and maintaining the current versions of major software to reduce the the use of third-party service to conduct mandatory online training for all employees regarding identifying and avoiding cyber-security the review of the security procedures used by third parties that may host or otherwise have access to Fuel Tech's data.

companyName: Transit Pro Tech Inc.


text: We recognize the potential cybersecurity risks inherent in our relationships with third parties. To address this, we have implemented a comprehensive third-party risk management program designed to identify and oversee such risks. This program relies on key elements, including risk assessment, due diligence, contractual provisions, and ongoing monitoring, to identify and mitigate impacts from high-risk third parties and specific risks. We utilize security risk assessment questionnaire tools to identify high-risk third parties, enabling us to proactively and effectively assess and mitigate potential security vulnerabilities.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: Our CISO works at the direction of the CDO, who has more than 20 years of executive IT leadership experience and leads the company's Digital and Information Technology functions that seek to provide innovative, secure, and reliable technology products and services to MPC and its customers.

companyName: Marathon Petroleum Corp

ticker: MPC


text: The Board of Directors, through the Board Risk Oversight Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, including the management of risks arising from cybersecurity threats. The Board Risk Oversight Committee reviews and approves the Information Security Policy, which includes the Company's cybersecurity risk management program. The Board of Directors receives regular presentations and updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, risk and vulnerability assessments, independent audit reviews, and technological trends. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full board of directors discusses the Company's approach to cybersecurity risk management.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: Our CISO, who has over twenty-five years of experience managing information security programs across banking and technology companies, is responsible for the Company's ISP and reports to our Chief Information Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security officers responsible for various parts of the business on an ongoing basis and in conjunction with senior management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CISO provides quarterly reports and an annual report to the Board and the Risk and Compliance Committee on cybersecurity matters.

companyName: Triumph Financial, Inc.

ticker: TFIN


text: Diamondback's cybersecurity governance program is led by its Vice President and Chief Information Officer, with support from the internal information technology department. Diamondback's Vice President and Chief Information Officer has over 20 years of technological leadership experience in the oil and gas industry, providing oversight of all information technology disciplines, including cybersecurity, networking, infrastructure, applications, and data management and protection. Diamondback's Vice President and Chief Information Officer and his team, which consists of individuals who hold designations as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), CompTIASecurity+, and Department of Defense (DoD)-Cybersecurity General, are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. In addition, Diamondback's cybersecurity incident response team is responsible for responding to cybersecurity incidents in accordance with its Computer Security Incident Response Plan. Progress and developments in Diamondback's cybersecurity governance program are communicated to members of its and our executive team. The audit committee of the board of directors receives quarterly updates on the status of Diamondback's cybersecurity governance program, including as related to new or developing initiatives and any security incidents that may occur, to the extent relevant to our program. Board members receive presentations on cybersecurity topics from Diamondback's Vice President and Chief Information Officer as part of the board's continuing education on topics that impact public companies. Further, Diamondback's code of business conduct and ethics expects all employees to safeguard the electronic communications systems and related technologies of Diamondback and its subsidiaries, including us, from theft, fraud, unauthorized access, alteration or other damage and requires them to report any cyberattacks or incidents, improper access or theft to Diamondback's Chief Legal and Administrative Officer and Vice President and Chief Information Officer. Diamondback's cybersecurity governance program also includes processes to assess cybersecurity risks related to third-party vendors and suppliers.

companyName: VNOM Sub, Inc.


text: We use a risk-based approach that is aligned with the National Institute of Standards and Technology. We maintain policies and standards that provide the framework for assessing risk. We conduct an annual information security focused risk assessment, which leverages the process and control areas provided by the International Organization for Standardization ("ISO") 27001. In 2024, we recertified our ISO 27001 Information Security Management certification to the new 2022 standard. In addition, we assess our cybersecurity threat risks by conducting periodic internal and external risk assessments and annual external penetration testing, as well as maintaining an active vulnerability management program to assess threats at the network, systems and application levels.

companyName: TrueBlue, Inc.

ticker: TBI


text: Cleco's cybersecurity team, overseen by the Chief Administrative and Sustainability Officer, has decades of experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes. Members of this team have extensive technical and leadership experience in federal and/or private sector environments as well as industry-recognized cybersecurity certifications. This team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by Cleco. Cleco's Audit Committee oversees the management of its cybersecurity risk and is responsible for communicating cyber-related incidents to its Boards of Managers.

companyName: Cleco Corporate Holdings LLC


text: Collaborative Approach: The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Charlie's Holdings, Inc.

ticker: CHUC


text: We identify and address cybersecurity threats through a multi-faceted approach including internal IT assessments and procedures, third-party assessments, internal audits, governance, and risk and compliance reviews. Identifying and assessing cybersecurity risk is integrated into our overall risk management processes.

companyName: OLD DOMINION ELECTRIC COOPERATIVE


text: Effect of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material effect on our results of operations and financial condition. As described above under "Item 1A-Risk Factors - Any inadequacy, failure or interruption of our information technology systems may harm our ability to effectively operate our business, and our business is subject to online security risks, including security breaches and identity theft," a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial and/or reputational damage, in addition to litigation or remediation costs or penalties.

companyName: Simply Good Foods Co

ticker: SMPL


text: We maintain security programs that include physical, administrative and technical safeguards, and we maintain plans and procedures whose objective is to help us prevent and timely and effectively respond to cybersecurity threats or incidents. Through our cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to company systems as well as our aerospace products and services, and we evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We continue to integrate our cyber practice into our Enterprise Risk Management program and our Compliance Risk Management program, both of which are overseen by our Board of Directors and provide central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. Risks from cybersecurity threats to our products and services are also overseen by our Board of Directors. In addition, we periodically engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents.

companyName: BOEING CO

ticker: BA


text: Verizon has a comprehensive enterprise cybersecurity incident response plan, which is activated in the event of a cybersecurity incident. The plan is a detailed playbook that specifies how Verizon classifies, responds to, and recovers from cybersecurity incidents and includes notification procedures that vary depending on the significance of the incident. When warranted by the severity of the incident, our Chief Executive Officer (CEO) and other senior executives are part of the notification chain.

companyName: VERIZON COMMUNICATIONS INC

ticker: VZ


text: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more detailed information about the cybersecurity risks we face, please see Item 1A, "Risk Factors," in this annual report on Form 10-K, including Risks Related to Privacy, Data Protection and Cybersecurity: "A breach of our security measures or unauthorized access to proprietary and confidential data, or a perception that any security breach or other incident has occurred, may result in our platform or products being perceived as not secure, lower customer use or stoppage of use of our products, and significant liabilities."

companyName: JFrog Ltd

ticker: FROG


text: We do not believe that there have been or are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.

companyName: KADANT INC

ticker: KAI


text: In the event of changes, we document the reason for the update, the responsible individual, and the details of what was modified (both before and after). Additionally, all modifications undergo verification by at least one individual before and after the change The board holds oversight of the Company's risks related to cybersecurity risks.

companyName: MOBIVITY HOLDINGS CORP.

ticker: MFON


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Information Security department. Our Chief Information Officer and Vice President of Cybersecurity work with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response vulnerability management processes include reporting to the Cybersecurity and Privacy Committee for certain cybersecurity incidents.

companyName: Arlo Technologies, Inc.

ticker: ARLO


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.

companyName: ZEVRA THERAPEUTICS, INC.

ticker: ZVRA


text: Our risk management program also assesses third-party risks where we identify and mitigate risks from third-parties such as vendors, suppliers, and other associated business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors.

companyName: CITIZENS, INC.

ticker: CIA


text: We and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. We do not believe we have experienced any material system security breach that to date has had a material impact on our operations or financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business, operating results and financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors."

companyName: HELEN OF TROY LTD

ticker: HELE


text: Our Vice President, Information Technology provides quarterly briefings to our audit committee regarding our cybersecurity risks and activities, such as any recent cybersecurity incidents and related responses (including those of third parties), if any, and cybersecurity systems testing. Our audit committee provides periodic updates to the board of directors that include any material information included in such briefings. In addition, our Vice President, Information Technology provides annual briefings to our board of directors on cybersecurity risks and activities.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. Our Senior Vice President ("SVP") of Information Technology and the Senior Director of Information Security have overall responsibility for assessing and managing our material risks from cybersecurity threats. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity at least annually, and receives an update quarterly on information security and cybersecurity from materials provided by the Senior Director of Information Security.

companyName: SKECHERS USA INC


text: Our board of directors has overall responsibility for informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure. Our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors has delegated to our audit committee its cybersecurity risk oversight processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: TECOGEN INC.

ticker: TGEN


text: The ITSC meets at least quarterly to discuss and approve IT and Cybersecurity matters. The ITSC produces and approves an annual IT budget, as well as an Incident Management and Response plan through which the CISO and the ITSC are informed about cybersecurity incidents.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Members of the Enterprise Information Security Steering Committee also include the Global Data Privacy Officer, Chief Technology Officer, Chief Administrative Officer, the General Counsel, and the Global Risk Officer of Protiviti.

companyName: ROBERT HALF INC.

ticker: RHI


text: Our board of directors oversees cybersecurity as part of its risk oversight function. The audit committee also assists our board of directors in fulfilling its responsibilities with respect to oversight of our cybersecurity programs, including assisting with reviewing the adequacy and effectiveness of our cybersecurity policies and practices and receiving regular presentations and reports from management. The audit committee provides regular briefings to our board of directors as appropriate. We follow an incident response plan that includes reporting prompt and timely information regarding material cybersecurity incidents, remediation, and related matters.

companyName: ON24 INC.

ticker: ONTF


text: There have not been any breaches at the Manager or the Fund during the year ended June 30, 2025. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: Under the Risk Committee's oversight, management works closely with key stakeholders, including regulators, government agencies, peer institutions, and industry groups, and develops and invests in human talent and innovative technology in order to better manage cybersecurity risk. The firm's Cybersecurity Program is led by our CISO, who reports to our Chief Information Officer ("CIO"). The CISO, in coordination with our information technology, compliance (including privacy), and risk management functions, works collaboratively across the firm to implement a program designed to protect the firm's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the firm's incident response and recovery plans. We maintain policies and procedures for the escalation of cybersecurity incidents assessed as potentially being or becoming material. Such incidents are escalated to a multidisciplinary group of senior leaders from our risk management, regulatory, compliance, finance, and legal teams, to assess such incidents for reporting under regulatory guidelines. In evaluating cybersecurity incidents, management considers the potential impact to our results of operations, control framework and financial condition, as well as the potential impact, if any, to our business strategy or reputation. Through ongoing communications with these teams, the CISO monitors the mitigation and remediation of cybersecurity threats and incidents in real time, and reports such threats and incidents to the Risk Committee when appropriate.

companyName: RAYMOND JAMES FINANCIAL INC

ticker: RJF


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the certain members of Company management, including those who are part of the Company's cybersecurity team. The Company's cybersecurity team is comprised of individuals with expertise in cybersecurity, information technology, risk management, and Company operations. Our cybersecurity team has decades-long experience in cybersecurity and holds industry-standard certifications including Certified Information Systems Security Professional ("CISSP"), Certified Cloud Security Professional ("CCSP"), among others.

companyName: Willdan Group, Inc.

ticker: WLDN


text: We have processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, to enhance our cybersecurity oversight.

companyName: CURIS INC

ticker: CRIS


text: Related to Cybersecurity Risks The full Board of Directors conducts several reviews throughout the year in an effort to ensure that our cyber strategy and risk management is appropriate and prudent. It is the responsibility of the Board of Directors to understand and oversee our strategic plans, the associated risks, and the steps that our senior management team is taking to manage and mitigate those risks. Principal accountability in this domain is placed with our Chief Information Security Officer, who has approximately 25 years of experience in cybersecurity program design and implementation. Responsibility is shared by our Chief Risk and Compliance Officer, who has approximately 20 years of leadership experience in the financial services sector with an extensive background in the mortgage industry, and our Chief Innovation and Digital Officer who has approximately 20 years of experience leading technology and product engineering functions.

companyName: Maverick Merger Sub 2, LLC

ticker: COOP


text: Related to Cybersecurity Risk Management is responsible for identifying, considering and assessing material risks for the business, including risks related to cybersecurity, on an ongoing basis. Our Chief Information Officer ("CIO") is responsible for our overall IT strategy and operations, including the strategic direction of our cybersecurity program, cybersecurity risk oversight and monitoring of the prevention, detection, mitigation, and remediation of cybersecurity incidents. The individual serving as our CIO has over 10 years of experience in information security.

companyName: Rapport Therapeutics, Inc.

ticker: RAPP


text: Our cybersecurity risk management program is led by Executive and Senior management, who hold a number of certifications including Certified CMMC Professional ("CCP"), Certified Information Security Manager ("CISM"), and Project Management Professional ("PMP"). Management is responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. The team of senior management officers responsible for our cybersecurity function is tasked with ensuring that potential cybersecurity risks are monitored, appropriate mitigation measures are implemented, and our processes for identifying and assessing cybersecurity risks and reporting cybersecurity breaches and other information security incidents operate as designed and comply with applicable requirements.

companyName: DLH Holdings Corp.

ticker: DLHC


text: Risk management and strategy Turtle Beach uses a risk-based approach to cybersecurity, utilizing industry-standard frameworks and methodologies to assess and manage risks. The Company has processes for assessing, identifying, and managing material risks from cybersecurity threats. These processes have been integrated into the Company's overall risk management processes and include an incident response plan to assess and remediate cybersecurity attacks.

companyName: Turtle Beach Corp

ticker: TBCH


text: Our current cybersecurity risk assessment program consists of an annual review of our risks and policies. The program outlines governance, policies and procedures, and technology we use to oversee and identify risks from cybersecurity threats and is informed by previous cybersecurity incidents we have observed both within the Company and in our industry.

companyName: ENvue Medical, Inc.

ticker: FEED


text: Due to the type and volume of information that we collect and store to provide banking services to our customers, we are an attractive target for cyber threat actors seeking financial gain. Our failure to maintain the safety of our customer's information could have a material adverse effect on our reputation, financial condition and results of operations. To date, we have not experienced a cybersecurity incident that resulted in a material adverse effect on our business strategy, results of operations, or financial condition; however, there can be no guarantee that we will not experience such an incident in the future. Although we maintain cybersecurity insurance, the costs and expenses related to cybersecurity incidents may not be fully insured. We describe whether and how risks from identified cybersecurity threats, including as a result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition under Item 1A. Risk Factors. We are exposed to cybersecurity risks associated with our internet-based systems and online commerce security, including 'hacking' and 'identify theft.'"

companyName: Bank7 Corp.

ticker: BSVN


text: While, we have a comprehensive cybersecurity and compliance program in place as an effort to counter the threats, and while we have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition, there can be no guarantee that Crexendo will not experience such an incident in the future. For more information on the risks from cybersecurity threats that we face, refer to "Risk Factors — Operational Risks — Cyber-attacks impacting our networks or systems could have an adverse effect on our business" in Part I, Item 1A of this Annual Report on Form 10-K.

companyName: Crexendo, Inc.

ticker: CXDO


text: The Company's CIO has over 20 years of experience in the field of technology and security and is instrumental in developing and designing, implementing and executing the Company's cybersecurity strategies. The internal IT team is responsible for the day-to-day implementation of the Company's cybersecurity risk management programs, testing compliance with standards, remediating known risks, and leading employee training programs. The team monitors the latest developments in cybersecurity, including potential threats and risk management techniques, to help prevent, detect, and mitigate cybersecurity incidents.

companyName: Energy Services of America CORP

ticker: ESOA


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company's business strategy, operational results, and financial condition are regularly evaluated. During the reporting period, the Company did not identify any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: The Sponsor's Security Awareness Program includes training that reinforces the Sponsor's Information Security policies, standards, and practices, and the expectation that employees will comply with these policies. The Security Awareness Program engages personnel through training on how to identify potential cybersecurity risks and protect the Sponsor's resources and information. This training is mandatory for all employees upon onboarding at the firm and again annually, and it is supplemented by firmwide training and testing initiatives, including periodic phishing tests.

companyName: Grayscale Ethereum Classic Trust (ETC)

ticker: ETCG


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and risk assessments. We provide cybersecurity awareness training to employees with access to information systems, including corporate employees. We also maintain an incident response plan. Our incident response plan outlines the process for our coordination with our third-party cybersecurity providers to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with applicable legal obligations and mitigate brand and reputational damage. In addition, our incident response plan includes actions designed to enhance processes and responsiveness to address future incidents. We continue to strengthen our systems, cybersecurity training, policies, programs, response plan, and other similar measures.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known information security vulnerabilities, and information from external sources, including reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants. The results of the assessment are used to develop initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader Company-wide risk assessment that are then reported to our members of management.

companyName: GRESHAM WORLDWIDE, INC.


text: Our cybersecurity risk management program is part of our overall approach to enterprise risk management. Our cybersecurity risk management program seeks to protect our information systems by managing and reducing material risks from cybersecurity threats and by responding to and mitigating cybersecurity incidents. We have designed our cybersecurity risk management program using certain industry practices and frameworks as a guide, including those established by the International Organization for Standardization and the National Institute of Standards and Technology, although we may not meet all technical standards, specifications, or requirements. We employ a cross-functional approach to preserving the confidentiality, security and availability of the employee, customer, supplier and partner information that we collect and store.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Our Board, with oversight by the Audit Committee, oversees management's processes for identifying and mitigating cybersecurity risks. Executive management including our Chief Information Security Officer ("CISO"), who reports to our General Counsel & Chief Risk Officer, update the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.

companyName: BEST BUY CO INC

ticker: BBY


text: The executive management team and the Board oversee the Company's ERM process, including the management of risks arising from cybersecurity threats. The executive management team and the Board each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The executive management team and the Board also receive prompt and timely information regarding any cybersecurity incident, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the executive management team and the Board discuss the Company's approach to cybersecurity risk management to monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: The CIO provides periodic reports to our Board, as well as our Chief Financial Officer and other members of our senior management as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: Perimeter Solutions, Inc.

ticker: PRM


text: In fiscal 2024, we did not identify any cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. It is possible that we may not implement appropriate controls if we do not detect a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate the risks. Even when a risk is detected, disruptive events may not always be immediately and thoroughly interpreted and acted upon. For more information about these risks, please see "Risk Factors – Risks Related to our Business" in Item 1A of this Form10-K.

companyName: Worthington Steel, Inc.

ticker: WS


text: The Company has deployed an in-depth cybersecurity strategy to protect its assets, which includes a diverse preventive and detective tool set to stop, monitor, and alert management of suspicious activities and potential advanced persistent threats. We have implemented other preventive technologies and mitigating processes to include on-going education and training for employees, periodic tabletop exercises and recovery tests, and regular infrastructure penetration tests conducted by cybersecurity professionals and third-party specialists. Our internal and external auditors, along with independent external partners, periodically assess our processes, systems and controls for design and operating effectiveness, and provide recommendations to bolster our cybersecurity program. In addition, employees are subjected to regular simulated phishing assessments designed to sharpen threat detection and reporting capabilities. We also monitor our email gateways for malicious phishing emails and monitor remote connections through a secure virtual private network. Like many companies, we rely on third-party vendor solutions to support our operations. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. We have a vendor management program in place to assess and manage risks associated with third-party service providers.

companyName: HANMI FINANCIAL CORP

ticker: HAFC


text: Our cybersecurity incident response and vulnerability management programs are designed to escalate certain cybersecurity incidents to various levels of management depending on the circumstances, including our VP of Management Information Systems, Director of IT Infrastructure and Security, General Counsel, Chief Financial Officer, and Chief Executive Officer. Management works with our incident response team to help mitigate and remediate certain escalated cybersecurity incidents. In addition, our incident response and vulnerability management programs include reporting certain cybersecurity incidents to the Audit Committee and, in certain circumstances, to the Board.

companyName: VOXX International Corp