text: AMN's information security program has adopted policies, standards, processes, and practices that follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization, and other relevant standards. AMN Healthcare has also implemented certain controls and procedures that allow its management to assess, identify, and manage material risks from cybersecurity threats. Our processes are integrated into the overall enterprise risk management program, which includes financial risk, compliance risk and other strategic and operational risks that affect the Company. These processes complement our enterprise-wide risk assessment architecture, as implemented by the Company's management and as overseen by the Board through its Audit Committee.

companyName: AMN HEALTHCARE SERVICES INC

ticker: AMN


text: We have experienced targeted and non-targeted cybersecurity attacks in the past, and we could experience similar attacks in the future. As previously disclosed, we suffered a cyber-attack against certain systems within our network environment in November 2022. The attack temporarily affected operations and caused delays in originating loans at some locations. During the incident, the attackers had access to the PII of certain Company employees, customers and investors. We contained the harm caused by the incident, quickly restored our business operations, and provided timely notifications to affected individuals, entities, and governmental agencies as required by law. Following the cyber-attack, we began undertaking significant remediation efforts and other steps to enhance our cybersecurity and data security infrastructure. Five (5) putative class action lawsuits were filed in the United States District Court in the Northern District of Georgia against the Company alleging harm from the cyber-attack. The Court consolidated all cases into one, and after extensive motion practice, administratively dismissed the consolidated case in full in January 2024. The Plaintiffs have asked the Court to reconsider its dismissal. To date, the Company's cyber insurance policy has covered and paid all material costs and expenses related to the class action litigation.

companyName: 1st FRANKLIN FINANCIAL CORP

secItem: Item 1C


text: Our management utilizes a systematic approach to evaluating and determining risk tolerance and prioritizes the safeguarding of our digital assets. The Vice President of Cybersecurity leads our cybersecurity program and reports to the Executive Vice President and Chief Innovation Officer, who serves on the Executive Committee and reports to the CEO. The Vice President of Cybersecurity has a Master of Science degree in Cybersecurity Operations, is certified as an information security professional with the International Information System Security Certification Consortium (ISC2) and International Association of Privacy Professionals, and has over thirty years of leadership experience in technology, systems architecture, and cybersecurity.

companyName: LyondellBasell Industries N.V.

ticker: LYB


text: We depend on software applications, information technology systems, computing infrastructure and cloud service providers to operate our of these systems are managed, hosted, provided or used by third parties to assist in conducting our business and which have their own cybersecurity measures in place. We are currently working to ensure that we satisfy generally applicable industry standards and best practice methods for the assessment, identification and management of risks from cybersecurity threats that may jeopardize our line of business or may pose a risk to our information technology systems, including from third parties with whom we work. To further enhance our understanding of potential threats and prioritize our security efforts, we conducted a comprehensive cybersecurity threat survey in 2024, which included a review of cybersecurity threats. Based on the findings of this survey, we are actively implementing recommended security measures to mitigate identified risks, with such implementation being conducted with the support and expertise of a professional services company serving as our outsourced cybersecurity partner.

companyName: Odysight.ai Inc.

ticker: ODYS


text: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner intended to address cybersecurity threats and events. The results of such assessments, audits, and reviews are evaluated by management and reported to our Audit Committee and our board of directors, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: Viking Therapeutics, Inc.

ticker: VKTX


text: Our Senior Director of IT Operations oversees a team of analysts and operations support personnel and has extensive experience with the company's applications and infrastructure. Our senior director reports to the Senior Vice President of Global Operations, who communicates to the President and CEO who then communicates directly with the Nominating/Governance and Compliance Committee and the Board.

companyName: MANNATECH INC

ticker: MTEX


text: Management's Role in Cybersecurity Risk Management GC Advisors' internal cybersecurity team, headed by GC Advisors' Chief Information Officer ("CIO"), are responsible for the cybersecurity program applicable to the Company (including enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture, and processes), and along with the Company's CCO and a Disclosure Committee that is headed by the Company's CFO (the "Disclosure Committee"), are responsible for assessing and managing material risks from cybersecurity threats that impact the Company.

companyName: GOLUB CAPITAL BDC, Inc.

ticker: GBDC


text: We also identify our cybersecurity threat risks by comparing our processes to industry standards, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • leverage incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Cybersecurity Incident Response Planning The Company has established a comprehensive cybersecurity incident response plan to ensure the swift and effective handling of any potential security breaches. This plan includes detailed procedures for identifying, assessing, and mitigating cybersecurity threats, as well as protocols for communication and coordination with relevant stakeholders. Regular training and simulations are conducted to keep the Company's response team prepared for various scenarios, ensuring minimal disruption to its operations and safeguarding the Company's customers' data.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: Our cybersecurity risk management program includes an incident response ("IR") plan that is designed to facilitate our response to cybersecurity incidents, including an escalation process for cybersecurity incidents that may have a moderate or higher business impact to notify our executive officers, other members of our senior management team and other internal stakeholders. The IR plan provides our executive officers and other members of our senior management team with the information needed to assess whether a cybersecurity incident materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the need for public disclosure. We aim to test the IR plan at least annually to assess its operational effectiveness. We strive to conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare for and respond to a cybersecurity incident and to identify areas for potential improvement. These exercises are conducted in close coordination with members of our internal cybersecurity risk management team, our retained cybersecurity incident response consultants, outside cybersecurity counsel and internal technical, operations and insurance risk management, internal audit and legal personnel, as well as certain executive officers and members of the senior management team.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: Core elements of our cyber program include, but are not limited to: • Risk assessments to identify cybersecurity risks that may impact us in material ways, including risks associated with our use of third-party service providers; • Cybersecurity awareness training for our employees and ongoing technical training for cybersecurity personnel; • Procedural and technical security controls implemented and managed by cross-functional teams; • An incident response plan that includes procedures for responding to cybersecurity events, including those arising from our use of third-party service providers or partners; • Periodic evaluation of security controls through system assessments and vulnerability scanning; • Partnerships with external providers where appropriate to supplement our internal expertise, perform security assessments and penetration testing, consult on best-practices and support incident response activities with forensic analysis.

companyName: GREIF, INC

ticker: GEF


text: Our cybersecurity risk management program currently includes the following key elements, which are deployed as the Company deems applicable: • We conduct periodic risk assessments, as well as internal and external vulnerability scanning and penetration testing of select systems and platforms, which are designed to help identify material risks from cybersecurity threats to our critical systems and information. • We have established security procedures for day-to-day operations designed to promote optimal system performance and maintain the integrity of critical systems and information, including detection, prevention and recovery controls, as well as backup procedures designed to prevent the loss of critical data, among other practices. • Our policy is to train employees and relevant contractors on cybersecurity awareness. The Company's office-based associates, store-based associates and certain distribution and fulfillment center associates are required to undergo security awareness training at the time of hiring. The Company's store-based associates may also receive ad hoc cybersecurity awareness communications and materials as part of their store's local operations training. • We have established, and periodically test, data security breach preparedness and response plans that are designed to address a range of scenarios that include data breaches and ransomware attacks. • We are subject to regular information technology and security audits by internal audit staff and external third parties. • We conduct third-party cybersecurity risk diligence for key service providers based on our assessment of their criticality to our operations and respective risk profile.

companyName: Container Store Group, Inc.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.

companyName: Bannix Acquisition Corp.


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile at its regularly scheduled meetings. The Company's Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Audit Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: Our Chief Financial Officer and the head of our IT department oversee our cybersecurity policies and processes, including those described above. The Company's overall risks and assessments are monitored by a cross functional team composed of members of senior management, security, legal, information technology and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: Managing Material Risks and Integrated Overall Risk Management The Company has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Our Director of Information Security (DIS), under the direction of our Director of Information Technology (DIT) continuously evaluates and addresses cyber risks in alignment with business objectives, operational needs, and industry-accepted standards, such as National Institute of Standards and Technology frameworks.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: As a health care provider, we regularly process and store patient and resident information. We are committed to the protection of the personal information of our and our independent operating subsidiaries' patients, residents, and employees. We have robust security tools, practices, and policies in place to help ensure the confidentiality, integrity, and accessibility of the data with which we are entrusted.

companyName: Pennant Group, Inc.

ticker: PNTG


text: For properties that are not owned, leased, or managed by Marriott, the franchisees, licensees, or other applicable counterparties are generally responsible for information security at such properties and the systems and business processes related to information security that are under their direction and control. Franchisees and licensees are typically required to comply with Marriott brand standards relating to information security, which include an obligation to report relevant information security incidents to us.

companyName: MARRIOTT INTERNATIONAL INC /MD/

ticker: MAR


text: Our business operations and relationships with customers and suppliers are heavily reliant on technology, and any failure or disruption in our technological systems could have significant negative impacts on our business. For example, we collect, store and transmit sensitive information including intellectual property, proprietary business information, including highly sensitive clinical trial data, and personal information in connection with our business operations. The secure maintenance of this information is critical to our operations and business strategy. If this information was subject to a cybersecurity attack or unauthorized access or use, it could have a material adverse effect on our business and could expose us to potential legal consequences, liabilities, mitigation costs, and damage to our reputation. Managing cybersecurity incidents would also divert management's attention and resources from regular business operations.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our Risk Committee assists our Board of Directors (the "Board") in its oversight of cybersecurity risk in accordance with its charter. The Risk Committee receives at least annually, and the Board receives periodically reports from our CISO and other members of senior management, which include updates on the Company's cyber risks and threats, its Cybersecurity Program, the status of projects to augment our information security systems, assessments of the Security Program, and the emerging threat landscape.

companyName: Virtu Financial, Inc.

ticker: VIRT


text: Currently, our Vice President of Infrastructure and Security assumes primary responsibility for assessing and managing material cybersecurity risks. With experience spanning restaurant, retail, financial, and technology brands, including serving in similar roles overseeing information security programs at other companies, and a degree in Computer Science, our Vice President of Infrastructure and Security brings experience and expertise to the role. Our Vice President of Infrastructure and Security leads a team of professionals who oversee the prevention, detection, and remediation activities within our cybersecurity environment.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: Risk Management and Strategy A. Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats The Company has developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its critical systems and information. The Company's cybersecurity risk management is integrated into and embedded in its overall enterprise risk management framework, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of Bitwise is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel, Chief Compliance Officer and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to Bitwise, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.

companyName: Bitwise Bitcoin ETF

ticker: BITB


text: Furthermore, we conduct annual cybersecurity awareness training for our employees to provide them with the knowledge necessary to navigate the digital landscape securely. We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy notice reflect this by incorporating internal audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.

companyName: Simulations Plus, Inc.

ticker: SLP


text: In addition, much of the sensitive information relating to hotel guests is controlled by the respective franchisor companies, affiliates of Marriott International, Inc., Hilton Worldwide Holdings, Inc., and Hyatt Hotels Corporation, each of which is a public company with cybersecurity protection policies in place which each publicly discloses.

companyName: Chatham Lodging Trust

ticker: CLDT


text: Role of Management Dow's Information Systems organization led by Dow's Chief Information and Digital Officer, is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation, with oversight by Dow's Audit Committee.

companyName: UNION CARBIDE CORP /NEW/


text: Annual risk and self-assessments against established industry frameworks to ensure best practices are in place and the Company's risk assessment continues to evolve.

companyName: National Bank Holdings Corp

ticker: NBHC


text: Our cybersecurity program provides what we believe is an effective level of protection of client information and of our operating systems while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology ("IT") systems. In order to accomplish these goals, we invest heavily in up-to-date information security and monitoring controls, which we believe provide the best mechanism to mitigate cybersecurity risks and threats. At the same time, cyberattacks are becoming increasingly common, sophisticated and destructive, and several highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking. In order to mitigate these risks and the potential harm that may result, our Chief Information Security Officer, who reports directly to the Chief Information Officer and who reports regularly to our Board's Audit Committee, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems. We also maintain and periodically review our cybersecurity disclosure procedures to assure the timely compliance with the Company's obligations under Item 1.05 of Form 8-K.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: SPAR Group Inc. recognizes the increased global cybersecurity threats and sophisticated, targeted computer crime and the risk it poses to our operations. We rely on information technology and data to operate our business and develop, market and deliver our products and services to our customers.

companyName: SPAR Group, Inc.

ticker: SGRP


text: We rely heavily on information technology (IT) systems in all aspects of our operations, and data security plays an important role in the protection of our proprietary information and that of our customers and suppliers. For these reasons, we take a number of steps to protect Onto Innovation's IT systems from internal and external cybersecurity threats.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Individuals in our Cybersecurity and Global Risk & Integrity departments regularly monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. We have implemented procedures by which any identified or potential cybersecurity risk is communicated to the VP of Cybersecurity promptly and discussed in regular team meetings generally held several times per week. Risks are escalated to the CRO and other members of management in accordance with our incident response and reporting policy.

companyName: iRhythm Holdings, Inc.

ticker: IRTC


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President (who also became the Chief Executive Officer effective January 1, 2025). Our CIO has over 30 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.

companyName: TUTOR PERINI CORP

ticker: TPC


text: We are utilizing our cybersecurity risk management program as the basis for developing our overall enterprise risk management program, and our current cybersecurity risk management program involves a range of policies, procedures, and controls designed to safeguard our information assets. Key elements of our cybersecurity risk management program include: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.

companyName: PRECISION BIOSCIENCES INC

ticker: DTIL


text: We have processes in place for assessing, identifying, and managing material risks from unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities. In addition, we engage with independent third-party partners, including cybersecurity assessors, consultants, and auditors, to assess and consult on our cybersecurity capabilities, prioritize areas of risk, and assist with execution of our risk management and strategic plans. Our collaboration with these third parties includes audits, threat assessments, and consultation on security enhancements. In an effort to mitigate data or security incidents that may originate from third-party suppliers, we also identify, prioritize, assess, and address third-party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.

companyName: Krispy Kreme, Inc.

ticker: DNUT


text: As a component of the Company's overall risk management process, which is aligned with a broader Enterprise Risk Management framework, the Company has implemented a multi-layered approach to minimize cybersecurity risk and safeguard its data. The Company conducts cybersecurity risk assessments on a regular basis and responds to identified risk exposures by employing a combination of risk mitigation strategies, including the adoption of cybersecurity controls and maintaining a cybersecurity insurance policy that provides coverage for security breaches. The Company engages third party consultants periodically to evaluate elements of the cybersecurity policy, processes, procedures and controls. The CIO and other members of the Executive Leadership Team respond to applicable recommendations arising from the third-party consultants. In addition, the Company engages a Qualified Security Assessor as part of the compliance requirements for Payment Card Industry ("PCI"). The Company also engages with a third-party risk management provider to ensure its vendors comply with internal security and privacy requirements and that key vendors are continually monitored for security risks. The Company's cybersecurity governance practices are based on the Company's common control framework which incorporates elements from the NIST Cybersecurity Framework, the Center for Internet Security's benchmark standards, and specific regulatory and industry requirements including Health Insurance Portability and Accountability Act and PCI.

companyName: SpartanNash Co


text: When a cybersecurity incident is detected, our response is governed by our IT Security Incident Response Policy, providing a rigorous, standardized process to ensure efficacy of the response. In general, when a cybersecurity incident is identified, our policy requires an initial review and triage of the incident. When a cybersecurity incident is determined to be significant, it is brought to the attention of a cross-functional leadership team consisting of our Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Chief Human Resources Officer and General Counsel and is addressed by that team, along with other internal stakeholders, using processes that leverage subject-matter expertise from across the Company. As with risk mitigation, we may engage third-party advisors, from time to time, as part of our incident response and management process. As part of our risk mitigation efforts, we also maintain cybersecurity insurance to defray the costs of potential information security breaches.

companyName: THOR INDUSTRIES INC

ticker: THO


text: Information Systems Acquired from Horizon Therapeutics plc On October 6, 2023, we completed our acquisition of Horizon. Certain Horizon legacy information systems are maintained separately from Amgen's preexisting information system infrastructure. We are continuing to operationally integrate and transition the legacy Horizon systems into our own, with the integrated systems becoming subject to Amgen's cybersecurity risk management structure and strategy. While we are integrating these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function's Operations, Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above. See Item 1A. Risk Factors—Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A. Risk Factors—A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.

companyName: AMGEN INC

ticker: AMGN


text: The Audit Committee is composed of independent board members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.

companyName: New Horizon Aircraft Ltd.

ticker: HOVR


text: We conduct organizational risk assessment, which help management in identifying data assets and recognizing and assessing potential threats, and investigating potential vulnerabilities. We are in the process of reviewing and implementing incremental information technology strategies to mitigate cybersecurity risks and their possible impacts. Risk assessments enable management to make risk management decisions and assign resources to mitigate risk. We also periodically engage third parties to assess the effectiveness of our cybersecurity practices.

companyName: FILANA THERAPEUTICS, INC.

ticker: FLNA


text: These response plans also set forth the processes for internal reporting of a substantive unauthorized occurrence. The CISO reports such matters to the CIO and CCO, who is responsible for convening a team of cross-enterprise leaders to ensure comprehensive responsiveness to an occurrence. This group also analyzes unauthorized occurrences affecting CNA's or third parties' IT systems or sensitive information, and directs the activities of CNA in responding to such incidents.

companyName: CNA FINANCIAL CORP

ticker: CNA


text: In 2024, we created a new position for a full time Chief Risk Officer. Our Chief Risk Officer has primary responsibility for our enterprise risk management program and works with our CISO in the oversight of our cybersecurity risk management program.

companyName: Walker & Dunlop, Inc.

ticker: WD


text: Our management team and incident response team have overall responsibility for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants that conduct vulnerability scans on a quarterly basis per PCI DSS standards.

companyName: EDUCATIONAL DEVELOPMENT CORP

ticker: EDUC


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: Pulmatrix, Inc.

ticker: PULM


text: Robert D. Velasquez, CPA, is an experienced risk management professional in our finance and risk management function and has served as Senior Vice President, Finance and Chief Accounting Officer since March 2022. Mr. Velasquez currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Velasquez leads the Company's cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents.

companyName: TEJON RANCH CO

ticker: TRC


text: We periodically have an annual assessment performed by a third-party specialist of our cyber risk management program. The periodic annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, in conjunction with the third-party cyber risk management specialists we develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the periodic annual assessment process.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: We believe we are appropriately staffed to support a healthy cybersecurity posture. All IT personnel have a combination of professional experience, education, and/or certifications for their area of responsibility. For IT leadership, our Chief Information Officer earned a Masters of Business Administration and also a Master of Science degree in Information Systems & Technology Management.

companyName: ARTESIAN RESOURCES CORP

ticker: ARTNA


text: We maintain a comprehensive cybersecurity program, recognizing the critical importance of safeguarding our operations, employees, customers, and other business partners from the constantly evolving risks associated with cybersecurity threats. These risks include, among other things, operational risks, reputational risks, financial risks, and litigation and legal risks.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: included in Part I, Item 1A of this Annual Report on Form 10-K, including "Risks Related to Product Development" and "Financial Risks."

companyName: INTELLINETICS, INC.

ticker: INLX


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess and manage material risks from cybersecurity threats, including by engaging a third-party cybersecurity service provider, which communicates directly with our management and compliance personnel. The cyber risk management program involves risk assessments, implementation of security measures and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants and auditors to evaluate cybersecurity measures and risk management processes as needed. We also depend on and engage various third parties, including suppliers, vendors and service providers in connection with our operations. Our risk management, legal, and compliance personnel oversee and identify, including through a third-party cybersecurity service provider, material risks from cybersecurity threats associated with our use of such entities.

companyName: Trinity Capital Inc.

ticker: TRIN


text: We have continued to expand investments in IT security to mitigate cybersecurity risks, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts. We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts. At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation. The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment. Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape. These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis. Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.

companyName: UNITED RENTALS NORTH AMERICA INC


text: Our CISO reports to the Audit Committee on cybersecurity quarterly, or more frequently if circumstances warrant, including relevant cybersecurity incidents impacting the Company and on topics related to information security, data privacy and cyber risks and mitigation strategies. In addition, outside experts periodically present to the Board on cybersecurity.

companyName: COLGATE PALMOLIVE CO

ticker: CL


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to associates or customers; violation of privacy or security laws; other litigation and legal risk; and reputational risks. These cybersecurity risks and other company risks are monitored and integrated into our enterprise risk management process. As part of this process, appropriate personnel will consult with subject matter specialists as necessary to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: WILLIAMS SONOMA INC

ticker: WSM


text: We use third-party service providers to perform a variety of functions throughout our business application providers, hosting companies, contract research organizations (CROs), contract manufacturing organizations (CMOs), supply chain resources, and other business-related SaaS platforms. We have a vendor management program to manage cybersecurity risks associated with our use of certain of these providers. The program includes conducting risk assessments of certain vendors, reviewing certain vendors' security assessments, and reviewing reports of certain of our vendors' security. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Mirum Pharmaceuticals, Inc.

ticker: MIRM


text: Each Trimble sector has identified a dedicated expert to assess vulnerabilities, calculate risks and determine where risk mitigation efforts are needed. These experts work with the Company's Chief Information Security Officer ("CISO") and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes. We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools. We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year. We maintain an information security risk insurance policy.

companyName: TRIMBLE INC.

ticker: TRMB


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business. In 2024, the Company did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition. However, despite its efforts, the Company cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board periodically. In addition, the full Board reviews the Risk Management processes and results, and the Board's Audit Committee tracks any corrective actions identified in the Internal Audit process. Cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank's Incident Response Plan.

companyName: ISABELLA BANK CORP

ticker: ISBA


text: Board Oversight of Cybersecurity Threats The board of directors of the Company (the "Board") has oversight responsibility for the Company's risk management framework, including technology and cybersecurity risks facing the Company.

companyName: S&P Global Inc.

ticker: SPGI


text: Third party security advisors have been engaged to periodically execute internal and external vulnerability scans for deployed production and organizational assets to flag any known vulnerabilities within deployed third-party components including but not limited to operating systems, web server software, hypervisor software etc.

companyName: Crexendo, Inc.

ticker: CXDO


text: The Company's Audit Committee oversees our risk management program, which is designed to identify, evaluate, and respond to our high-priority risks and opportunities to mitigate those risks. The Company's management, including our executive officers, reports to the Audit Committee on areas of material risk based on its annual risk assessment exercise and management is primarily responsible for managing the risks associated with the Company's operation and business, including cybersecurity and other information security risks. As part of the annual risk assessment exercise, our management conducts executive management interviews, participates in key committee meetings (including meetings of the Disclosure Committee, Compliance Committee and, during our ERP implementation, the Oracle Committee), quantitatively and qualitatively scopes financial accounts and IT system sources and considers industry reports and legal and/or regulatory changes to understand short-term, medium-term and long-term priorities, objectives and strategies, taking into account the level of maturity and degree of integration of governance and risk management programs. Management provides regular updates to the Audit Committee on our risk management program and reports on identified high-priority risks and opportunities during regularly scheduled Audit Committee meetings. In turn, the Audit Committee Chairman is responsible for regularly reporting to the Board.

companyName: Cano Health, Inc.


text: We leverage a managed security service provider and also engage with other third-party providers and consultants to support our cyber risk management efforts, including through periodic security testing. We have a process to assess and review the cybersecurity practices of information technology third-party vendors and service providers, including through review of applicable certifications, security reports, and vendor questionnaires and contractual requirements, as appropriate.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: Our Board of Directors engages in the assessment, oversight, and management of materials risks that could affect the company. The board has delegated to the Nominating/Governance and Compliance Committee the oversight responsibility for our cybersecurity risk management program to ensure that cybersecurity risks are identified, assessed, managed, and monitored. This oversight includes compliance with disclosure obligations and requirements, cooperation with law enforcement, and related effects on financial risks and is responsible for reporting its findings and recommendations to the full board for its consideration. Our IT operations team and other members of management discuss cyber risks and trends, and if they arise, any material incidents with senior executives and the Nominating/Governance and Compliance Committee.

companyName: MANNATECH INC

ticker: MTEX


text: The Company recognizes the risk that cybersecurity threats pose to our operations, and cybersecurity is an important component of our overall risk management strategy. HighPeak Energy's cybersecurity team consists of certain of our executive officers, as well as internal and third-party cybersecurity personnel, with cybersecurity expertise across multiple industries. The cybersecurity team takes a cross-functional approach to addressing these risks and engages in discussions with the Board and our executive management team on an as-needed basis.

companyName: HighPeak Energy, Inc.

ticker: HPK


text: We regularly engage third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.

companyName: VALUE LINE INC

ticker: VALU


text: The Company's Risk Management Committee (RMC), which is chaired by the Chief Policy and Risk Officer, evaluates risks relating to cybersecurity, among other significant risks, and oversees mitigation plans. The RMC is comprised of executive leadership across multiple functions, including individuals with responsibilities and oversight over legal, regulatory, finance and treasury, operations, information technology, business development, and policies and controls. The RMC meets monthly and receives regular updates on security performance metrics, global security risks, security enhancements, and updates on our security posture.

companyName: CHESAPEAKE UTILITIES CORP

ticker: CPK


text: Some of the other features of our cybersecurity program include: • Monthly phishing simulations and additional training as required for incorrect identification of phishing attempts • Ongoing vulnerability scanning and annual penetration testing of our internal and external environments • IDS/IPS ( Intrusion Detection Device / Intrusion Prevention System) • Firewalls • Endpoint Detection and Response •24x7x365 Security Operations Center

companyName: 1st FRANKLIN FINANCIAL CORP


text: Adient follows its cybersecurity incident response policy which outlines roles, identifies incident categories, severity levels, response activities and communication protocols that leverages the National Institute of Standards and Technology ("NIST") Framework.

companyName: Adient plc

ticker: ADNT


text: We maintain detailed records of our third-party assessments and any evidence or documentation that is provided during the assessment process. We regularly review and report on third-party risk management activities and any significant issues to senior management and/or our Audit Committee or Board of Directors.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: alerting the applicable support functions of the potential cybersecurity threat and any defensive action that would be required; and alerting management, as applicable and necessary, of the potential cybersecurity threat. • Members of our Information Security function have broad ranges of qualifications and experience in information technology and security.

companyName: TERADATA CORP /DE/

ticker: TDC


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a real estate company with hundreds of properties located across the United States, we guard against a multitude of cybersecurity risks that range from threats common to most industries, such as ransomware and denial-of-service, to threats from more advanced, persistent, or organized actors, including those acting on behalf of nation-states that target critical infrastructure sectors. Tenants, lenders, suppliers, subcontractors, and equity partners throughout the industry face similar cybersecurity risks, and a cybersecurity incident impacting us or a related entity could materially adversely affect operations, performance, or operating results. These and related risks make it imperative that we vigilantly tend to the social, physical, and logical aspects of our cybersecurity.

companyName: ExchangeRight Income Fund


text: Our global information security program is led by our CISO, who brings over 20 years of industry experience. Regular reports on cybersecurity threats, assessments, and findings are provided by the CISO to senior management and relevant teams. In addition, the CISO provides quarterly updates to the Board Audit Committee. The Board oversees annual enterprise risk assessments, with the Audit Committee specifically tasked with overseeing cybersecurity risks.

companyName: Skillsoft Corp.

ticker: SKIL


text: Our cybersecurity risk management program includes: • policies, process, and tools designed to identify, assess, and mitigate cyber risks across all aspects of our operations; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents (as such term is used and defined in Item 106(a) of Regulation S-K, as amended and supplemented, of the Securities Act ("Regulation S-K")); • the use of external service providers, where appropriate, to assess, test, monitor, or otherwise assist with aspects of our cybersecurity controls; • cybersecurity awareness training for our employees and contractors; and • a Cybersecurity Incident Response Plan that includes procedures for responding to cybersecurity incidents.

companyName: FOX FACTORY HOLDING CORP

ticker: FOXF


text: Given the size of our company and the nature of our operations, we believe the risk of significant cybersecurity incidents is minimal. Our CEO is responsible for overseeing all aspects of our business, including the management of cybersecurity risks. We utilize standard commercial software for business operations, which includes basic security features such as password protection and data encryption.

companyName: C & C TOURS, INC.


text: Our Board of Directors and Audit Committee's principal role is one of oversight, recognizing that management, led by our CIO and CISO, is responsible for the design, implementation and maintenance of an effective program for identifying, detecting, protecting against, responding to, recovering from and mitigating data privacy and InfoSec risks. Our CIO has more than 30 years of technology experience, including leadership across a variety of enterprise technologies, including InfoSec, and across multiple industries. Our CISO has more than 20 years of experience in InfoSec, across multiple industries, and is a Certified Information Systems Security Professional (CISSP). The CIO and CISO provide, at least, annual updates on IT and InfoSec initiatives to the Board of Directors and quarterly updates to the Audit Committee.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: The Company's CISO reports directly to the CIO, who in turn reports to the CEO. The CISO has over 20 years of experience in IT and cybersecurity. Under the direction of the CISO, the Company's cybersecurity department continuously analyzes cybersecurity and resiliency risks to our business, considers industry trends and implements preventive and detective controls, as appropriate, to mitigate these risks. The cybersecurity team consists of cybersecurity professionals holding multiple certifications such as CISSP (Certified Information Systems Security Professional), CEH (Certified Ethical Hacker), GSOM (GIAC Security Operations Manager), CISM (Certified Information Security Manager), CISA (Certified Information Systems Auditor), among others. This analysis drives the Company's short- and long-term cybersecurity strategies, which are executed through a collaborative effort within the IT department and are communicated to the board of directors regularly.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: We, like any company, have experienced cybersecurity incidents in the past. However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents which have been determined to be material. For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors, in this Annual Report on Form 10-K.

companyName: SelectQuote, Inc.

ticker: SLQT


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on IT systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.

companyName: SSR MINING INC.

ticker: SSRM


text: In the ordinary course of business, we and our vendors collect, store and transmit large amounts of confidential information (including trade secrets or other intellectual property, proprietary business information and personal information), and it is critical that we do so in a secure manner to maintain the confidentiality and integrity of such confidential information. The size and complexity of our and our vendors' systems and the large amounts of confidential information that is present on them also makes them potentially vulnerable to security breaches from inadvertent or intentional actions by our employees, partners or vendors, or from attacks by malicious third parties. Maintaining the security, confidentiality and integrity of this confidential information (including trade secrets or other intellectual property, proprietary information, business information and personal information) is important to our competitive business position. However, such information can be difficult to protect. While we have taken steps to protect such information, and to ensure that the third-party vendors' on which we rely have taken adequate steps to protect such information, there can be no assurance that our or our vendors' efforts will prevent service interruptions or security breaches in our systems or the unauthorized or inadvertent wrongful use or disclosure of confidential information that could adversely affect our business operations or result in the loss, misappropriation, and/or unauthorized access, use or disclosure of, or the prevention of access to, confidential information. A breach of our or our vendors' security measures or the accidental loss, inadvertent disclosure, unapproved dissemination, misappropriation or misuse of trade secrets, proprietary information, or other confidential information, whether as a result of theft, hacking, fraud, trickery or other forms of deception, or for any other cause, could enable others to produce competing products, use our proprietary technology or information, and/or adversely affect our business position. Further, any such interruption, security breach, or loss, misappropriation, and/or unauthorized access, use or disclosure of confidential information, including personal information regarding our patients and employees, could result in financial, legal, business, and reputational harm to us and could have a material adverse effect on our business, financial condition, results of operations, cash flows, and/or ordinary share price.

companyName: Omnitek Engineering Corp

ticker: OMTK


text: Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") each have over 25 years of information system experience and are primarily responsible for implementing the Cybersecurity Program and managing our information security personnel and consultants. The CIO has served in a variety of information technology leadership positions in the finance industry and holds a Bachelor of Science in Electrical Engineering. The CISO served in a variety of cybersecurity operations, cybersecurity architecture, and critical infrastructure cybersecurity enhancement programs in the finance industry, the utility industry and in government and holds a Bachelor of Science in Management Information Systems and Decision Sciences.

companyName: PennyMac Mortgage Investment Trust

ticker: PMT


text: We have not engaged any third-party services to conduct evaluations of our security controls, which can include penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and effectiveness of security controls.

companyName: Resonate Blends, Inc.

ticker: KOAN


text: Our cybersecurity program focuses on these key areas: • Governance: The Audit Committee has oversight of cybersecurity risk management and regularly interacts with our Chief Technology Officer ("CTO") and other members of management. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats to equip them with effective tools to address and mitigate cybersecurity threats, and to communicate our information security policies, standards, processes, and practices. • Cross-Functional Approach: We have adopted a cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Third-Party Risk Management: We have adopted a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Technical Safeguards: We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, and access controls, which are evaluated and revised through vulnerability and cybersecurity threat assessments. • Incident Response and Recovery Planning: We maintain incident response and recovery plans addressing our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.

companyName: Nerdy Inc.

ticker: NRDY


text: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Audit Committee and the Board oversee cybersecurity risk management by regularly interacting with the Company's management team, our information technology team and a third -party security firm.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: Our Chief Information Security Officer, or CISO, who has decades of experience in similar roles in the technology industry, leads and oversees our information security program, including our cybersecurity policies and information security team. This team is responsible for implementing processes designed to identify and protect company assets through prevention and detection controls. Through our cybersecurity program, we have developed response and recovery processes and procedures designed to address potential adverse impacts to the company should a cyber event or incident occur. We have implemented a process for employees to complete security and awareness training annually.

companyName: Toast, Inc.

ticker: TOST


text: We have implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Thus, we base our program on multiple security frameworks including the National Institute of Standards and Technology ("NIST"), HIPAA, and privacy laws such as the E.U.'s GDPR. We also require that third-party service providers with access to personal or proprietary information implement and maintain cybersecurity practices consistent with applicable legal standards.

companyName: Quanterix Corp

ticker: QTRX


text: As of the date of this report, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition that are required to be reported in this Form 10-K. For further discussion of the risks associated with cybersecurity incidents and potential impact to the Company, see the cybersecurity risk factor within "Item 1A. Risk Factors" in this Form 10-K.

companyName: Seneca Foods Corp

ticker: SENEA


text: We routinely provide education, such as simulated phishing campaigns, to our employees to mitigate material risks from cybersecurity threats. This education includes cybersecurity training for new employees and training modules sent monthly to all employees. We also use various authentication technologies and third-party monitoring to mitigate material risks from cybersecurity threats. We annually retain a third-party vendor to test our information systems security and we annually review information systems security protocols of our vendors that interact with our financial data. We maintain insurance coverage that may, subject to policy terms and conditions, including deductibles, cover particular aspects of cybersecurity risk, such as social engineering and computer system fraud. However, it is possible such coverage may not fully insure all future costs or losses associated with all types of cybersecurity incidents such as ransomware.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers, violation of privacy or security laws and other litigation and legal risk, and reputational risks. We have implemented several cybersecurity processes, technologies, and controls in an effort to assess, identify, and manage such material risks.

companyName: PDF SOLUTIONS INC

ticker: PDFS


text: We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating in these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains regular contact with the Federal Bureau of Investigation for sharing of threat information.

companyName: Leonardo DRS, Inc.

ticker: DRS


text: Our board is responsible for overseeing our enterprise risk management activities in general, the appropriate committees assist the board in the role of risk oversight. Our chief information security officer (CISO) presents a quarterly update to the full board, including an update on our risk management process and risk trends related to cybersecurity.

companyName: Allegiant Travel CO

ticker: ALGT


text: We maintain a Cybersecurity Risk Committee (CRC) that is comprised of management level representatives from key organizations and functions within the Company and led by our Global Head of Cybersecurity. The CRC is responsible for our enterprise-wide cybersecurity risk management framework established by certain members of our senior management, including the review and approval of significant strategies, policies, procedures, processes, controls, and systems designed to identify, assess, monitor, and report the major risk factors facing the Company. In addition, the CRC provides guidance to senior management on risk appetite and risk profile and approves the effectiveness of the Company's enterprise-wide cybersecurity risk framework and such other duties as directed by the Board. The CRC also assists in the oversight of decisions that affect cybersecurity compliance with applicable laws, regulations, and corporate policies.

companyName: BIOMARIN PHARMACEUTICAL INC

ticker: BMRN


text: The Norfolk Southern Board, through the F&RM Committee, has direct oversight of cybersecurity risks. The F&RM Committee receives periodic reports from the CIO and CISO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment. Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results. Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.

companyName: NORFOLK SOUTHERN CORP

ticker: NSC


text: All relevant and critical incidents are reported to the Security Steering Committee, and events that may result in a material loss are additionally reported to the Audit Committee and evaluated for public disclosure as well as disclosure to the appropriate authorities. The Audit Committee oversees management's remediation actions relating to such events, and approves management's assessment of the materiality of the event to the Company.

companyName: MediaAlpha, Inc.

ticker: MAX


text: Information Security Program The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats. The information security organization is overseen by the Information Security Advisory Team, further detailed under the caption "Cybersecurity Governance" below.

companyName: MARA Holdings, Inc.

ticker: MARA


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards.

companyName: Harvard Apparatus Regenerative Technology, Inc.

ticker: HRGN


text: We face continuing and ongoing material risks from cybersecurity threats, which the U.S. Securities and Exchange Commission defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—A failure or breach of our IT infrastructure or that of our subcontractors, suppliers or joint venture partners, including as a result of cyber-attacks, could adversely impact our business and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: TechnipFMC plc

ticker: FTI


text: Our head of the ITS Department and our executive management provide quarterly briefings to the audit committee of the board regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports. In addition, our head of the ITS Department provides periodic briefings to the board of directors on cybersecurity risks and activities.

companyName: Amphastar Pharmaceuticals, Inc.

ticker: AMPH


text: Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they are engaged in comprehensive oversight and can provide guidance on critical cybersecurity issues on a broad range of topics, including: Current cybersecurity landscape and emerging threats; of ongoing cybersecurity initiatives and strategies; reports and learnings from any cybersecurity events; and with regulatory requirements and industry standards.

companyName: Novo Integrated Sciences, Inc.

ticker: NVOS


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to maintain the security, confidentiality, integrity, and availability of our business systems and confidential information, including personal information and intellectual property. Our cybersecurity program includes systems and processes for assessing, identifying and managing material risks from cybersecurity threats and include maintenance and monitoring of information security policies aligned with global regulatory controls; user and employee awareness of cyber policies and practices; information systems configuration management; third-party risk management systems; identity and information asset protection; infrastructure security systems; and cyber threat operations with continuous monitoring and threat hunting. This program includes processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers. We also engage a range of third-party experts in connection with various development, implementation, and maintenance activities related to our cybersecurity program.

companyName: VERTEX PHARMACEUTICALS INC / MA

ticker: VRTX


text: Monitor, Manage, and Safeguard Against Cybersecurity Incidents and Risks. The Company's vice president of support services, along with the supervisor of cybersecurity, a designated security team of professionals and third-party cybersecurity experts are responsible for assessing and managing risks as well as developing and implementing policies, procedures, and practices based on the range of threats faced by the Company. There are processes around access management, data security, encryption, asset management, secure system development, security operations, network and device security to provide safeguards from a cybersecurity incident along with continual monitoring of various threat intelligence feeds.

companyName: Knife River Corp

ticker: KNF


text: Our cybersecurity risk management program includes: • periodic risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • teams principally responsible for managing (1) our cybersecurity risk assessment and mitigation processes, (2) our security controls, and (3) our response to cybersecurity incidents; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response and reporting plan that includes procedures for responding to cybersecurity incidents; • a team responsible for compliance with security and regulatory standards including but not limited to Service Organization Controls (SOC) reporting, International Organization for Standardization (ISO) frameworks 27001/27017/27018/27701, FedRAMP, and HIPAA; • the use of external service providers, where appropriate, to audit, assess, test or otherwise assist with aspects of our security controls, and to assist with the design and implementation of our cybersecurity policies and procedures; and • a third-party risk management process for service providers, suppliers, and vendors.

companyName: BOX INC

ticker: BOX


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to operationalize our cybersecurity risk management program. The Audit Committee will promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates. The Audit Committee periodically discusses our approach to cybersecurity risk management with our CFO, who oversees the Company's information systems.

companyName: Longevity Health Holdings, Inc.

ticker: XAGE


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program and who is a long-standing member of both the ISC2 and ISACA organizations, which specialize in cybersecurity and governance, (ii) a cybersecurity council comprised of a cross-section of management with oversight over our program, (iii) incident response, and (iv) ongoing security awareness training.

companyName: Nextpower Inc.

ticker: NXT


text: Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.

companyName: PACCAR FINANCIAL CORP


text: Our Vice President of Engineering, Product and Platform oversees our information security program and leads our information security team. Our Vice President of Engineering, Product and Platform works closely with our Head of Internal Audit, in furtherance of the management of risks to the Company. The Vice President of Engineering, Product and Platform has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over twenty years of experience leading cross-functional organizations in the development and operation of large-scale systems, primarily focused on e-commerce.

companyName: ThredUp Inc.

ticker: TDUP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information systems. Our cybersecurity risk management program is integrated into our broader Information Security Management System ("ISMS"), which is designed to identify, assess and manage risks across the organization and to enhance our resilience and support the achievement of our strategic security objectives. Our cybersecurity risk management program includes a cybersecurity incident response plan and engagement of third-party cybersecurity experts who assist the organization with preparedness and on an as-needed basis. The audit committee of our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements: • a team dedicated solely to cybersecurity and managed by our Chief Security Officer ("CSO"), who reports directly to our Chief Executive Officer. The CSO and his team are responsible for leading enterprise-wide cybersecurity strategy, policies, standards, architecture and processes. Our CSO has over 20 years of and cybersecurity and infrastructure experience, including serving as the Chief Information Security Officer ("CISO") at Calendly, VP of Information Security and CISO at Ripple, and Senior Director of Enterprise Security at Salesforce. • a cybersecurity vulnerability assessment process that includes internal testing, as well as engagements with outside security researchers, for identification, evaluation and management of cybersecurity risks. For example, we conduct penetration tests, manage a bug bounty program, conduct table top and run red team/purple team exercises to evaluate the effectiveness of our ISMS and cybersecurity practices. • Our CSO and his team are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with our defined Privacy and Security Incident Response plan, which is reviewed along with other plans relevant to our cybersecurity risk management on an annual basis. • an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data. • a training program that includes updates on current security topics, including social engineering, phishing, password protection, protecting personal data, appropriate use of assets, and • an annual certifications program by an accredited third-party auditor for compliance with ISO/IEC 27001:2013 for an ISMS, ISO/IEC 27701:2019 for a patient information management system, as well as the requirements and control implementation guidance within ISO/IEC 27018:2019 for cloud computing.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: The Company utilizes a variety of third parties in connection with its cybersecurity risk management. For example, the Company uses the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency's Known Exploitable Vulnerabilities Catalog, the MITRE Corporation's Common Vulnerabilities and Exposures database and other threat intelligence portals and feeds to identify vulnerabilities. The Company also employs third-party cybersecurity companies to add capacity or expertise when necessary. Additionally, regular assessments of the Company's cybersecurity program are conducted by independent third-party assessors.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: The Company has implemented and maintained various information security processes designed to identify, assess and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, lab equipment, software, and critical data includes confidential, personal, proprietary, and sensitive data. Accordingly, the Company maintains certain risk assessment processes intended to identify cybersecurity threats, determines the likelihood of occurring, and assesses potential material impact to the Company's business. Based on the Company's assessment, the Company implements and maintains risk management processes designed to protect the confidentiality, integrity, and availability of its information assets and mitigate harm to its business. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the Center for Internet Security (CIS), the National Institute of Standards and Technology (NIST) and other applicable industry standards and are integrated into the Company's overall risk management system and processes.

companyName: CUTERA INC


text: The Companies maintain a robust, tested and regularly revised Cyber Security Incident Response Plan and a Vendor Compromise Response Plan. These plans detail roles, responsibilities, and actions to be taken in response to a detected event whether internal or associated with a third-party service provider. The plans provide clear direction for escalation of information to leadership, including Dominion Energy's Board of Directors as appropriate, and drive collaboration amongst relevant members of management representing cybersecurity, information technology, operations, supply chain, legal and accounting departments. As necessary, the COO, CFO and chief legal officer will advise the CEO on any incidents which could potentially have a material effect on the Companies' business operations, results of operations or financial condition.

companyName: VIRGINIA ELECTRIC & POWER CO


text: We identify such threats by, among other methods, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting vulnerability assessments.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: We place a high priority on cybersecurity within our organization. This includes regular cybersecurity training for employees, focusing on relevant risks to their job duties (e.g., social engineering, ransomware, denial of service, and other risks). As part of our cybersecurity risk management program, we conduct internal tests to identify potential vulnerabilities. Additionally, we organize annual tabletop exercises led by third-party consultants to enhance our readiness for different scenarios, assess our core information systems and cybersecurity practices, improve decision-making and prioritization, and promote monitoring and reporting across business functions.

companyName: CRACKER BARREL OLD COUNTRY STORE, INC

ticker: CBRL


text: Our CIO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CIO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Additionally, prior to engaging any vendor that will store sensitive Company information, PSCM performs due diligence on the vendor's information security infrastructure and requires that the vendor agree contractually that the Company's information will be encrypted in transit and at rest and that the appropriate user access controls will apply. As of the date of this report, we are no t aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: Our SVP of Information Technology and our CISO regularly provide cyber threat intelligence briefings to management on the status of the Company's security measures and our efforts to identify and mitigate risks from cybersecurity threats. Our SVP of Information Technology and CISO also work closely with our Chief Financial Officer and Chief Legal Officer to further enhance incident response procedures and to assess and manage risks from cybersecurity threats.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Our Board of Directors is responsible for overseeing the cybersecurity risk management process and exercises this risk oversight through both our full Board of Directors and its Audit Committee. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee risks related to cybersecurity threats, and our Audit Committee Charter requires the Audit Committee to review and discuss with management the Company's policies with respect to risk assessment and enterprise risk management and to review the risk exposure of the Company related to the Committee's areas of responsibility, including with respect to cybersecurity. In carrying out this role, the Audit Committee meets with our Chief Information Security Officer regularly and receives at least quarterly reports on cybersecurity matters.

companyName: WESTERN DIGITAL CORP

ticker: WDC


text: Our management team is responsible for oversight and administration of our cyber risk management program, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our management team relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants who may be engaged by us for strategic cyber risk management, advisory and decision making. To the extent we utilize third-party vendors to provide information technology services for various areas, including human resources functions (e.g., payroll), we generally require these vendors to monitor and protect their information technology systems against cyber-attacks and other breaches. The Audit Committee of the Board of Directors oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Member(s) of management brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents.

companyName: Quoin Pharmaceuticals, Ltd.

ticker: QNRX


text: Through the policies and controls described above, including our incident response policy, members of our management team, including our Chief Financial Officer, our Executive Vice President, Global Risk Management and our Executive Vice President, General Counsel, as well as representatives of the third-party IT and cybersecurity team are informed about cybersecurity threats and incidents affecting our information systems and direct our efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents.

companyName: Kennedy-Wilson Holdings, Inc.

ticker: KW


text: During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Risks from cybersecurity threats, however, in the future may, among other things, cause material disruptions to our or our subsidiaries' operations, which may materially affect our liquidity, results of operations and financial condition, as well as damage our reputation. For additional information related to risks from cybersecurity threats, please refer to Item 1.A. — "Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our beneficiaries, providers, or other third parties, would damage our reputation and brand, and substantially harm our business and results of operations."

companyName: CLOVER HEALTH INVESTMENTS, CORP. /DE

ticker: CLOV


text: ESSA Bank and Trust has adopted an Incident Response Plan (the "IR PPlan") for responding to cybersecurity incidents. This IR Plan applies to both potential and actual incidents. The IR Plan should be invoked in any context where the Bank believes that an incident may have occurred. The IR Plan applies to all employees, contractors, and third parties. The objectives of the IR Plan are to ensure the protection of customer data and all organization assets from security incidents and ensure timely detection, mitigation, and communication of security incidents to appropriate parties.

companyName: ESSA Bancorp, Inc.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ADVANCED MICRO DEVICES INC

ticker: AMD


text: As part of its regular oversight role, our Board of Directors, with a primary focus on policy, oversight and strategic direction, oversees management's development and maintenance of the enterprise cybersecurity program and its actions to identify, assess, mitigate and remediate cybersecurity threats to our company. Our Board of Directors has delegated to its Audit Committee primary responsibility for regular oversight of cybersecurity risk at the Board-level and this delegation is reflected in the Audit Committee's Charter. Our Chief Information Officer provides a regular quarterly report to the Audit Committee of our Board of Directors regarding cybersecurity matters and our enterprise cybersecurity program.

companyName: EQT Corp

ticker: EQT


text: We are currently completing the search for a new CISO, following the voluntary departure of the incumbent CISO. An accomplished information technology leader with 29 years of experience in the field and 20 months of experience with the Company is currently serving in the role on an interim basis.

companyName: HERTZ GLOBAL HOLDINGS, INC

ticker: HTZ