text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board plans to establish robust oversight mechanisms to ensure effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence,

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Information Security Team works with other members of management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business. Additionally, our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Audit Committee, as well as our Board of Directors, the latter of which evaluates our overall enterprise risk.

companyName: Beta Bionics, Inc.

ticker: BBNX

secItem: Item 1C


text: The Risk Committee receives regular reports from our Information Security leadership on our cybersecurity risks, including key status updates, security issues, current and future priorities, independent assurance, threat landscape and audit findings. The Risk Committee regularly reports to the full Board regarding its activities, including those related to cybersecurity oversight. The full Board also receives periodic presentations on cybersecurity topics from our Information Security leadership or other internal security staff or external experts as part of the Board's continuing education program.

companyName: JANUS HENDERSON GROUP PLC

ticker: JHG


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incident, have not materially affected our business to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.

companyName: Talkspace, Inc.

ticker: TALK


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Information technology and Director of Information Security, each Senior Principal Security and Infrastructure Architect with over 20 years' experience managing large scale enterprise information technology and security systems and programs.

companyName: Definitive Healthcare Corp.

ticker: DH


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Significant disruptions of information technology systems or security breaches could adversely affect our business" in Item 1A, Risk Factors, which disclosures are incorporated by reference herein.

companyName: PALVELLA THERAPEUTICS, INC.

ticker: PVLA


text: Our cybersecurity partners, including a technology consultant and other relevant third-party service providers, are a key part of our cybersecurity risk management strategy and infrastructure. We partner with industry recognized cybersecurity providers leveraging third-party technology and expertise and engage with these partners to maintain the performance and effectiveness of IT assets, data, and services. The cybersecurity partners provide services including, but not limited to, systems inventory management, vulnerability testing, user management, capacity monitoring, network protection, remote access management, data backups management, infrastructure maintenance, and cyber risk advisory, assessment and remediation. We also maintain a disaster recovery plan to help us quickly recover from an incident during a disruption and help mitigate the impact of certain cybersecurity risks.

companyName: Sachem Capital Corp.

ticker: SACH


text: We have developed an information security program that is designed to address material risks from cybersecurity threats. Our information security program is integrated into our overall enterprise risk management process, which the Board ultimately oversees. The Board has delegated its responsibility for cybersecurity risk oversight to the Technology Committee of the Board, which is responsible for (i) regularly reviewing with management significant cybersecurity, privacy, artificial intelligence, and IT risks or exposures, and our policies and processes with respect to risk assessment and risk management of the same; (ii) regularly reviewing with management an assessment of the steps management has taken to monitor and control such risks; and (iii) regularly reporting to the full Board on such matters. As described in further detail below, our information security program is led by our Director of IT Security & Compliance ("DITSC"), who is responsible for our overall information security strategy, policy, security engineering, operations, and cyber threat detection and response. The program includes policies and procedures that guide our implementation and maintenance of security measures and controls. Risk-based analysis and judgment of the DITSC and our management team, along with feedback from internal and third-party audits and assessments, are used to select security controls to address risks. The following factors, among others, are considered when identifying security controls: likelihood and severity of a risk, impact on the Company and others if a risk materializes, feasibility of controls, and impact of controls on operations and others. Third parties also play a role in our cybersecurity, as we engage security firms in different capacities to provide or operate some of these controls and technology systems, including cloud-based platforms and services. For example, third parties are used to conduct assessments, such as vulnerability scans and penetration testing. We use a variety of processes to address and oversee cybersecurity threats related to the use of third-party technology and services, including a vendor risk management program.

companyName: Designer Brands Inc.

ticker: DBI


text: The Audit Committee is informed of material risks from cybersecurity threats pursuant to escalation criteria set forth in the Company's disclosure controls and procedures. Further, the ERM Committee reports material risks from cybersecurity threats to the Company's Audit Committee and/or board of directors on a regular basis. The Company's Board of Directors has received training on cyber security and governance of the Company's processes for minimizing threats and response to incidences.

companyName: Charlotte's Web Holdings, Inc.

ticker: CWBHF


text: Our cybersecurity program is integrated into our overall risk management systems and led by our data protection officer. This program is on par with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Oversight of the program is performed by our executive management and board of directors. Internal employees as well as third party advisors were involved in the development and continued maintenance of our cybersecurity program. The program is evaluated and audited on an annual basis by independent third parties through ongoing IT compliance initiatives.

companyName: Globalstar, Inc.

ticker: GSAT


text: Deutsche Bank Group has a variety of prevention methods and controls in place, such as threat intelligence, data leakage prevention, cyber hygiene, and encryption solutions. These also include placing a strong emphasis on detection, backed by a robust incident-response process. Deutsche Bank Group actively shares best practices and threat information with national and international security organizations, government authorities, and peer organizations. These relationships help to ensure that Deutsche Bank Group's security technology and procedures reflect current industry best practices and keep pace with the threat environment.

companyName: RREEF Property Trust, Inc.


text: As a part of its cybersecurity program, GECM's cybersecurity processes and systems are reviewed and assessed by third parties. These third parties assess and report on GECM's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks. These third parties also help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third-party consultants and vulnerabilities are reviewed by GECM's Chief Operating Officer, IT Specialist and other members of Company management (together, "Great Elm IT Management") and third third-party consultants. In order to oversee and identify risks from cybersecurity threats associated with its use of third parties who will have access to sensitive data or client systems and facilities, GECM requires third parties to adhere to GECM's cybersecurity requirements prior to accessing such data. In addition, GECM performs annual reviews of its critical vendors with the assistance of a third-party consultant to identify and assess the vendors' security posture to reduce risk to the Company.

companyName: Great Elm Capital Corp.

ticker: GECC


text: Our cybersecurity risks and strategies are overseen by both management, including our CISO, Chief Information Officer (CIO), VP, Enterprise Risk Management, Executive Risk Committee (ERC), and the Board and relevant Board committees, including the Risk Management, Technology & Innovation Committee (RMTIC). This structure reinforces that our most critical risks are effectively monitored and communicated to the Board, and management, including for the purposes of making any required disclosures in a timely manner. Cybersecurity risk assessments, subsequent findings, and response plans, including risks arising in connection with our use of vendors and third parties, are integrated within our Enterprise Risk Management framework.

companyName: Employers Holdings, Inc.

ticker: EIG


text: To maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees. The Chief Information Security Officer reports directly to our General Counsel and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee of the Company's board of directors. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.

companyName: RADIAN GROUP INC

ticker: RDN


text: Vulnerability Assessments. We conduct assessments over potential vulnerabilities for all new and existing network-connected assets on an annual basis. Any potential vulnerabilities that we identify are remediated. We rate vulnerabilities based on the following criteria: (i) High: A vulnerability exists that could potentially allow an attacker to gain elevated access of the host, divulge system information, and/or lead to system or network compromise; (ii) Medium: A vulnerability exists that could potentially allow an attacker limited access to file contents, security settings or ability to conduct a denial-of-service attack; (iii) Low: A vulnerability exists that could potentially allow an attacker limited access to sensitive host system data, such as installed software version giving the ability to exploit application vulnerabilities; and (iv) Info: An attacker could collect basic host information such as open ports and services.

companyName: Clene Inc.

ticker: CLNN


text: At least annually, the ISO reports to the Board the overall status of the Information Security Program and the Company's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management's responses and any recommendations for program changes.

companyName: CFSB Bancorp, Inc. /MA/

ticker: CFSB


text: As discussed in more detail under the heading "Governance," The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's ERM function, the Company's Director of Information Technology & Cybersecurity, and other members of management and relevant management committees and councils, including management's Cybersecurity Council.

companyName: EASTERN CO

ticker: EML


text: The Adviser has established an internal working group that includes relevant representation from senior management including the CCO, COO and CISO who work collaboratively to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through ongoing communication with these teams, the CISO and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Board when appropriate.

companyName: TCW Direct Lending VIII LLC


text: The Chief Administrative Officer and General Counsel has primary oversight of the IT Department and the cybersecurity program, with a direct reporting relationship to the President and Chief Executive Officer. The Chief Administrative Officer and General Counsel also reports to the Audit Committee at least two times per calendar year and presents a report to the Board at least once per calendar year. These briefings include both educational and program status information, including: Current cybersecurity risks, including qualitative rating based upon underlying objective measures; Status of ongoing cybersecurity initiatives and strategies; Maintenance and testing of the IRP;

companyName: YORK WATER CO

ticker: YORW


text: Board Oversight of Cybersecurity Threats The Board has oversight responsibility for the Company's overall risk management framework. The Board, acting primarily through the Audit Committee, is also responsible for oversight of our risk management practices, including as to cybersecurity, while management is responsible for the day-to-day risk management processes. Through our CEO and other members of management, the Board receives periodic reports regarding the risks facing the Company, including as to cybersecurity risks. In addition, the Audit Committee assists the Board in its oversight role by receiving regular reports from management regarding risks associated with technology, information systems and controls and security, including risks related to data security, cybersecurity and data privacy and the effectiveness of the Company's security controls, systems and policies.

companyName: Liquidia Corp

ticker: LQDA


text: Despite our efforts to identify and respond to cybersecurity threats, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. Refer to Part I —Item 1A. Risk Factors in this Annual Report, including "Cybersecurity risks could result in the loss of data, interruptions in our business and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations," for additional discussion about cybersecurity-related risks.

companyName: Greenbacker Renewable Energy Co LLC


text: Our cybersecurity program, and its associated CSMS, is led by an experienced team of cybersecurity professionals headed by the CISO. In the event of a cybersecurity incident, we have a dedicated Cybersecurity Incident Response Team that is responsible for identifying, escalating, responding to and managing cybersecurity incidents, including interdiction and remediation, as well as conducting the initial investigation, gathering and analyzing data, mitigating damage to the informational assets and infrastructure of Ansys, restoring normal services and system integrity and implementing actions designed to prevent future cybersecurity incidents. This team reports to the CISO. In the event of a significant cybersecurity incident, a cross-functional team comprised of cyber, legal and finance personnel work together to determine the materiality of an incident.

companyName: ANSYS INC


text: Cybersecurity Risk Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: APi Group Corp

ticker: APG


text: In the ordinary course of our business, we collect, use, store and transmit digitally large amounts of confidential, sensitive, proprietary, personal and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy, and we consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. To this end, we have implemented processes designed to assess, identify and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity and availability of these systems and the data residing therein.

companyName: DocGo Inc.

ticker: DCGO


text: Sponsor has designated the Head of IT to implement and maintain the cybersecurity program. The Head of IT may delegate any of the Head of IT's responsibilities to appropriate designees as long as the Head of IT remains primarily responsible for compliance oversight and administration. The Head of IT will is responsible for: Initial implementation of the cybersecurity program; employee education; testing of the cybersecurity program's safeguards;

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: During the fiscal year ended December 31, 2023, the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, its business strategy, results of operations, or financial condition.

companyName: PARKE BANCORP, INC.

ticker: PKBK


text: We achieved SOC 2 Type 2 attestation this fiscal year, demonstrating the operating effectiveness of our internal security controls and our commitment to industry-leading information security standards. This attestation provides assurance to stakeholders that Digital Turbine's systems and processes are regularly audited by independent third parties to verify compliance with rigorous security and privacy requirements.

companyName: Digital Turbine, Inc.

ticker: APPS


text: We also have specific cybersecurity risk assessment processes which help identify our cybersecurity threat risks, including a comparison of our processes to industry standards as well as periodic third-party assessments of our programs. We compare our Information Security Program with industry standards including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO 27001. In order to enhance internal expertise, members of our Information Technology (IT) department maintain various cybersecurity-related certifications. We also maintain written incident response and security policies that seek to ensure we are protected and ready to respond should a security incident occur. Incidents are investigated and analyzed for potential impact. If impact is present, the appropriate departments, key employees, and executive management team members are notified as part of the incident response process. Our incident response plan coordinates the activities we would take to respond to and recover from cybersecurity incidents, which include processes to triage, assess severity of, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate potential liability and reputational damage. If appropriate, incidents may be reported to senior management, the Audit Committee or the full Board.

companyName: GLAUKOS Corp

ticker: GKOS


text: While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive and, similar to other global financial institutions, we, as well as our employees, customers, regulators, service providers, and other third parties have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber attacks. We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader financial services cybersecurity ecosystem. For more information on risks to us from cybersecurity threats, see the section entitled " Risk Factors — Failure in our information technology, storage systems or our clinical laboratory equipment could significantly disrupt our operations and our research and development efforts " included within this Report.

companyName: VOLITIONRX LTD

ticker: VNRX


text: conduct a variety of information security and privacy trainings, including new employee training, job-specific security training, specialized training for IT and security personnel, and phishing simulations; and carry information security risk insurance to help defray potential losses that might arise from a cybersecurity incident.

companyName: GSI TECHNOLOGY INC

ticker: GSIT


text: Nicolet is susceptible to information security breaches and cybersecurity-related incidents like any other entity. Risks related to cybersecurity attacks are expected to remain heightened as digital capabilities continue to evolve. Increasing use in digital platforms create a vast footprint for sophisticated threats to attack organizations internally and externally, blurring the outermost edge of security. To mitigate these risks, resources are employed to provide visibility, prevention, and mitigation strategies, in line with information security standards.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: As a blank check company, we have no operations and therefore do not have any operations of our own that face cybersecurity threats. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, we do depend on the digital technologies of third parties, and as noted in Item 1A. Risk Factors of this Form 10-K, any sophisticated and deliberate attacks on, or security breaches in, systems or infrastructure or the cloud that we utilize, including those of third parties, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats for our Company, if any, and prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats, as described in Item 1A. Risk Factors of this Form 10-K. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Corner Growth Acquisition Corp.


text: We are establishing a formal written information security policy and incident response policy which outlines the methods for assessing, identifying, and managing risks related to the Company. We've developed a robust cybersecurity program which includes multiple security layers. We understand the importance of a strong cybersecurity framework and have hired external security consultants to assess, audit, and monitor its security controls and events. We also ensure that third-party service providers have the ability to implement and maintain appropriate security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. In addition, we maintain a cybersecurity insurance policy. Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats.

companyName: ANI PHARMACEUTICALS INC

ticker: ANIP


text: Our information security architecture is focused on designing IT-related solutions that are foundationally secure. Our information security architecture assumes that internal and external threats always exist, and that all networks are inherently hostile. Accordingly, all connections accessing business assets must first be authenticated and authorized. Where viable, IT services are individually secured and monitored at the source, following the principle of least privilege.

companyName: Elanco Animal Health Inc

ticker: ELAN


text: Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program. The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect us and the achievement of our objectives; to understand, assess, and prioritize those risks; and to facilitate the implementation of risk management strategies and processes across the company that are responsive to the company's risk profile, business strategies, and specific material risk exposures. The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is transmitted to senior executives and, as appropriate, to the Board of Directors (Board) or relevant committees. The Board regularly reviews and discusses with the key members of management responsible for management of risk the guidelines and policies governing the ERM process, the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, and the risk mitigation strategies in each instance.

companyName: CF Industries Holdings, Inc.

ticker: CF


text: To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, preventative tools and technologies, monitoring and detection tools, and regular backup protocols. Additionally, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and standards. The results of these assessments are reported to the Audit Committee.

companyName: Paragon 28, Inc.


text: Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them. These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding. We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, security researchers, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.

companyName: Gitlab Inc.

ticker: GTLB


text: Processes and Procedures We have adopted physical, technological, and administrative controls on cybersecurity. Our risk management processes include, among others, the following features: • We leverage the National Institute of Standards and Technology security frameworks as well as established internal security standards, industry practices, and applicable regulatory requirements. Our program is designed to comply with a range of applicable industry standards, such as the Payment Card Industry Data Security Standard. • We maintain cybersecurity insurance coverage that provides protection against potential losses arising from certain cybersecurity incidents. • We require that cybersecurity awareness and data privacy training, along with company-wide and tailored training programs, be provided to associates annually. We also regularly conduct phishing and social engineering simulations, and host events to increase awareness, including an annual cybersecurity awareness summit and monthly campaigns. • We have a cybersecurity incident response plan in place which provides a framework for responding to cybersecurity incidents. Our information security team leverages technologies and vendors to monitor and respond to security threats via a dedicated security operations center. In the event of a security incident, a defined procedure outlines containment, response, and recovery actions that draw on resources and leadership across the Company, as needed. • A cross-functional team conducts periodic simulated exercises, and we perform regular vulnerability scanning and conduct vulnerability testing during the software development life cycle. • We collaborate with internal stakeholders and third-party assessors and consultants to conduct regular reviews, tests, and audits of our security program. This coordinated approach reviews security controls that safeguard our information assets, including payment information, through processes such as security control assessments and third-party penetration testing. Additionally, we utilize tabletop exercises, penetration and vulnerability testing, red team exercises, simulations, and other evaluations to improve our security measures and strategies. • We also participate in various cybersecurity and retail industry groups to remain apprised of emerging cybersecurity risks, defense, mitigation strategies, and governance best practices.

companyName: LOWES COMPANIES INC

ticker: LOW


text: Finally, with regard to compliance risk, we utilize third party firms to help us determine compliance with industry standards and regulations. We also maintain a Data Privacy Steering Committee, which is a group of internal legal, risk and IT professionals, to assist management with fulfilling applicable data privacy regulations.

companyName: Anywhere Real Estate Group LLC


text: Leadership receives training on how to respond to ransomware events and participates in breach simulations at least once a year. Additionally, employees throughout the organization support LII's risk management efforts by participating in mandatory cybersecurity training at least once a year, ongoing awareness campaigns, and quarterly simulated phishing attempts.

companyName: LENNOX INTERNATIONAL INC

ticker: LII


text: The Trust does not have any directors, officers or employees. Under the Trust Agreement, all management functions of the Trust have been delegated to and are conducted by the Sponsor, its agents and its affiliates. Hong Kim, the Chief Technology Officer of BAM is responsible for assessing and overseeing the Sponsor's and the Trust's cybersecurity risks and providing direction and oversight for risk mitigation action in conjunction with Katherine Dowling, the General Counsel and Vice President of the Sponsor. Mr. Kim graduated from the University of Pennsylvania with a Bachelor of Science in Computer Science, and, prior to BAM, worked on Google's backend infrastructure for Google Drive and worked in software security for the South Korean military. Ms. Dowling has served as a Chief Compliance Officer at various companies since 2015 and has more than ten years of experience as an Assistant U.S. Attorney, most recently in the Economic Crimes Unit of the U.S. Attorney's Office for the Northern District of California. Mr. Kim and Ms. Dowling receive periodic reports from the Experts and members of the Sponsor's Legal and Compliance team who take part in cybersecurity review, implementation, training and testing.

companyName: Bitwise Ethereum ETF

ticker: ETHW


text: Governance and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: OOMA INC

ticker: OOMA


text: Our Chief Risk Officer has primary responsibility for our enterprise risk management program. Our Chief Information Security Officer has primary responsibility for our cybersecurity risk management program and supervises the Company's cybersecurity personnel. Both individuals have extensive work experience in various roles involving risk and compliance, including cybersecurity and information security.

companyName: Axos Financial, Inc.

ticker: AX


text: During the period of this Annual Report, the business strategy, results of operations and financial condition of the Company have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Risks Related to Information Technology and Cybersecurity at Item 1A Risk Factors.

companyName: Dave & Buster's Entertainment, Inc.

ticker: PLAY


text: In cases where cybersecurity threats are deemed significant or pose a potential risk to the Company's operations, they are escalated to members of management who oversee cybersecurity matters. Depending on the nature and criticality of the threat, it may be escalated to executives such as the CISO, Chief Information Officer, Chief Risk Officer, Chief Financial Officer, General Counsel, or other relevant senior management personnel. These leaders possess the expertise and authority to assess the situation's impact on the Company's operations, finances, and reputation. Further, these leaders have over 15 years of experience in their respective fields of expertise. Upon receiving this information, they engage in deliberation and decision-making, collaborating with the cybersecurity team to formulate and execute an appropriate response plan, which may include elevating the matter to the Risk Committee, or the Board, if warranted. This hierarchical escalation process is intended to ensure that key decision-makers are properly informed, enabling appropriate actions to mitigate the identified cybersecurity risks.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: Cybersecurity threats, including those as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information on our cybersecurity related risks, refer to "Part I, Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: CECO ENVIRONMENTAL CORP

ticker: CECO


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy and strategic plan.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: Our Compliance and Security Officer ("CSO"), who has extensive cybersecurity knowledge and skills gained from more than 20 years of work experience at the Company and elsewhere, is the head of our experienced cybersecurity team and is responsible for assessing and managing our cyber risk management program. The CSO receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. Our CSO collaborates with our business, engineering, human resources, legal, and other functions to implement and enforce our cyber policies. Our CSO reports to our CTO, and they collectively inform our senior management regarding the prevention, detection, mitigation, and remediation of incidents and vulnerabilities.

companyName: STEM, INC.

ticker: STEM


text: Our management, led by our Chief Executive Officer, has the overall responsibility for identifying, assessing and managing any material risks from cybersecurity threats, and our Board of Directors, assists in overseeing and monitoring cybersecurity risks and risk management. Our cybersecurity posture is designed to comply with key global financial regulations and cybersecurity laws in the jurisdictions in which we operate. This posture includes taking several proactive steps to prepare for attempts to compromise our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material cybersecurity risks, and protect against, detect, and respond to cybersecurity threats and incidents, we undertake the following activities: Closely monitor emerging data protection laws and implement changes to our processes designed to comply; Undertake reviews of our consumer-facing and internal policies and statements related to cybersecurity; Proactively inform our customers of substantive changes related to customer data handling; Conduct annual cybersecurity training for all our employees;

companyName: Byrna Technologies Inc.

ticker: BYRN


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and supply chain resources. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes a risk assessment for each vendor, vulnerability scans related to the vendor, and imposition of information contractual obligations on the vendor. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: Cidara Therapeutics, Inc.


text: As part of our risk management processes, we are developing risk assessments to identify the probability, immediacy, and potential magnitude of information security risks. Our internal experts, which are overseen by the Chief Operating Officer, regularly conduct audits and tests of our information systems, and our cybersecurity program is periodically assisted by established, independent third-party consultants, who provide assistance through tabletop and other preparedness exercises. These partnerships enable us to leverage specialized knowledge and insights, seeking to continue to improve upon our cybersecurity strategies and processes. Additionally, we review regular publications on cyber awareness and conduct ongoing simulated phishing exercises. We use the findings from these and other processes to improve our information security practices, procedures and technologies.

companyName: Boxlight Corp

ticker: BOXL


text: Our Corporate Sustainability and Risk Management Committee of the Board of Directors has been delegated the power and authority to oversee and make recommendations to the Board with regard to our overall approach to risks relating to business operations, including with regard to information technology and cybersecurity. In a presentation from our Chief Technology Officer, the committee received information regarding our approach to cybersecurity, which included the following topics: the confidentiality of nonpublic information and the integrity and security of our information system, the cybersecurity policies and procedures, material cybersecurity risks to us, and the overall effectiveness of our cybersecurity program.

companyName: KINGSTONE COMPANIES, INC.

ticker: KINS


text: As part of its oversight responsibilities, the Audit Committee monitors privacy, data and cybersecurity as specific risk areas. The Audit Committee also works with the Compliance and Quality Committee to oversee enterprise risks with healthcare and anti-corruption requirements, and those requirements include certain privacy, data and cybersecurity aspects. Both Mr. Schechter, a member of the Audit Committee, and Ms. Schoppert, a member of the Audit Committee, hold a CERT Certificate in Cybersecurity Oversight. The Audit Committee engages in regular discussions with management on privacy, data, and cybersecurity risk exposures, receiving quarterly reports from the ERM team and the CIO. On a periodic basis, the full Board of Directors also receives these reports from the ERM team and the CIO. The CPO and/or CLO periodically reports to the Audit Committee about the Company's privacy program, and Internal Audit reports to the Audit Committee quarterly, providing the Audit Committee with results from any privacy, data, or cybersecurity audits.

companyName: DAVITA INC.

ticker: DVA


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: The Bank recognizes that the cybersecurity landscape is constantly evolving and remains committed to adapting its risk management strategies to address new challenges. The Bank continues to invest in its cybersecurity infrastructure and strengthen controls to mitigate risks effectively.

companyName: VWF Bancorp, Inc.

ticker: VWFB


text: The IRP includes procedures for responding to actual or potential cybersecurity incidents, including providing timely notice to customers and our bank regulatory agencies when appropriate. The IRP is based on the NIST Cybersecurity Framework. The plan is tested annually through tabletop exercises.

companyName: Investar Holding Corp

ticker: ISTR


text: To date, we believe that the risks from identified cybersecurity threats, have no t materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: Korth Direct Mortgage Inc.


text: encountered cybersecurity challenges that have materially impaired our operations or financial standing. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Governance

companyName: IMAC Holdings, Inc.

ticker: BACK


text: Impact of Cybersecurity Risks W e are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Part I. Item 1A. Risk Factors—Risks Related to Our Business and Operations—Our business and operations could suffer in the event of system failures or cybersecurity breaches."

companyName: FORTRESS CREDIT REALTY INCOME TRUST


text: Our audit committee members have varying levels of information security backgrounds ranging from direct cybersecurity experience with extensive involvement in data protection and cybersecurity compliance, policies, and governance, to broader experience being responsible for corporate risk management, including information security and the development of cyber incident reporting under the Critical Infrastructure Act. As part of their role on the audit committee, audit committee members stay current with information security trends and considerations for addressing cybersecurity risk and governance.

companyName: AdTheorent Holding Company, Inc.


text: For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Part I, Item 1A "Risk Factors" in this annual report on Form 10-K, under the heading "Operations."

companyName: Dolby Laboratories, Inc.

ticker: DLB


text: Third parties also play a role in our cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to critical computer networks, third-party hosted services, communications systems, hardware, software, and our critical data including confidential, personal, proprietary, and sensitive data. Accordingly, we maintain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess any potential material impact to our business. Based on our assessment, we implement and maintain risk management processes to our information assets and mitigate harm to our business. In addition to internal systems and concerns, we manage risks from third parties that are a part of business operations. This includes assessing cybersecurity risks during the vetting process and recurring assessments during the life of the engagements. Relative levels of assessment are considered with regard to business criticality of the relevant third parties. We rely heavily on our third party CROs and CDMOs to manage our clinical trials and manufacture our investigational products, and a cybersecurity incident at a CRO, CMDO or other third party upon which we rely could materially adversely impact us. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. See "Risk Factors" in this Annual Report on Form 10-K for additional information on cybersecurity risks we face.

companyName: Dianthus Therapeutics, Inc. /DE/

ticker: DNTH


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. As discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader security community and monitor cyber threat information.

companyName: PRUCO LIFE INSURANCE CO


text: Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors (the "Board") has ultimate oversight of the Company's risk management. In accordance with its charter, the Audit Committee of the Board is responsible for overseeing our enterprise risk management program on behalf of the Board, including material risks related to cybersecurity threats, and reporting on these matters to the Board. The Audit Committee receives regular updates from management, including the information technology and legal teams, on cybersecurity risk resulting from risk assessments and reviews any information on relevant internal and industry cybersecurity incidents and is notified between such updates relative to any incidents which could materially affect the Company. Based on this information, our Audit Committee monitors the Company's cybersecurity program, including potential threats, weaknesses and vulnerabilities, and reviews the policies and procedures in place to prevent, detect and respond to cybersecurity threats and unauthorized access to our information security systems. Significant findings related to cybersecurity, data and technology risks or incidents are regularly reported to and discussed at the Board level. Three members of our Board, included two of our Audit Committee members, are currently pursuing or have received certifications in cyber-risk oversight through the National Association of Corporate Directors.

companyName: Vita Coco Company, Inc.

ticker: COCO


text: Our Chief Technology Officer, who possesses a 25-year track record in overseeing technology, 15 of which includes oversight of information security systems, reports directly to our Chief Executive Officer. This extensive experience spans both public and private companies and includes over a decade as the dedicated key individual responsible for cybersecurity. Our Head of Security, who leads our internal security staff and reports directly to our Chief Technology Officer, has over 20 years of software development experience, ten of which have focused on cybersecurity, and includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.

companyName: Opendoor Technologies Inc.

ticker: OPEN


text: The CSO works to stay informed about relevant developments in cybersecurity, including potential threats and innovative risk management techniques. The CSO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and advanced compliance systems to identify potential vulnerabilities and mitigate them. The CSO collaborates closely with various key departments within the company – including the office of our Chief Technology Officer ("CTO"), Engineering, IT, DevOps, Support, and Production – to implement our Vulnerability Management Remediation Plan. This collaboration is aligned with industry standards of the Software Development Life Cycle, underscoring our commitment to maintaining robust security protocols across all phases of our operations.

companyName: JFrog Ltd

ticker: FROG


text: The information security team, under the authority of the CSO, has developed a cybersecurity risk management program that addresses four primary operational pillars: • researching, monitoring and identifying significant cybersecurity threats and risks across Akamai Connected Cloud and the larger internet ecosystem taking into account malicious actors, software vulnerabilities and other threat sources; • assessing designated risks applicable to Akamai's assets and systems, including those associated with third-party vendors and suppliers, and planning and tracking efforts to address significant risks; • managing cybersecurity incidents and associated reporting and communications obligations; and • ongoing compliance assessments through internal and external audits and assessments, certifications and the penetration and vulnerability testing of certain systems. These operational pillars and the programs established from them are informed by cybersecurity industry standards.

companyName: AKAMAI TECHNOLOGIES INC

ticker: AKAM


text: Arvana has not experienced cybersecurity incidents in the past, it cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors.

companyName: ARVANA INC

ticker: AVNI


text: While our Board has the ultimate oversight responsibility for the risk management process, the responsibilities of the Audit and Risk Committee of our Board include overseeing cybersecurity. As part of its program of regular oversight, all members of the Audit and Risk Committee are responsible for overseeing cyber, information security, and information technology risk, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks.

companyName: MATERION Corp

ticker: MTRN


text: We plan to strategically incorporate cybersecurity risk management into all our comprehensive risk management framework, fostering a corporate culture that prioritizes cybersecurity at all levels. This integration shall be done in stages so as to guarantee that cybersecurity factors are ingrained in our decision-making processes throughout the organization.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: As a result of such assessments and exercises, a number of processes have been established or are being improved upon to support the protection of our data and systems.

companyName: Grace Therapeutics, Inc.

ticker: GRCE


text: The risk management process occurs throughout the organization, but is facilitated through a risk management steering committee comprised of senior management whose members meet regularly to identify and address specific significant risks. At least twice a year, management assesses and categorizes key risks based on their potential impact to the Company and the likelihood of the risk occurring as part of Matson's enterprise risk management ("ERM") program. The ERM program includes regular cyber and information security risk assessments conducted by independent, third-party cybersecurity professionals, including assessors, consultants, auditors and penetration testers. Results from these risk assessments, along with remediation recommendations, are provided to executive leadership and the Company's Board of Directors (the "Board"). The Board also consults with outside advisors and experts, when appropriate, to anticipate future threats and trends, and their impact on the Company's risk environment. In addition, the Company utilizes third-party audits to test its cybersecurity systems, incident response and remediation plans to help spot vulnerabilities and improve its ability to respond to unexpected events. For more information on Matson's ERM program, see "—Governance " below.

companyName: Matson, Inc.

ticker: MATX


text: Our board of directors oversees the cybersecurity risk management program and is regularly informed of cybersecurity risks through periodic updates provided by the Director of Information Technology ("IT") and Information Security team, to address our cybersecurity processes and risk mitigation efforts. Certain members of the board of directors have cybersecurity risk certification credentials and experience with, and exposure to, cyber risk oversight. The periodic updates provided by the Director of IT and Information Security team to the board of directors generally encompass emerging cyber threats, the Company's security posture changes, significant cybersecurity incidents, progress of risk mitigation efforts, and cybersecurity strategies and investments. The frequency of these updates allows for timely decision-making and ensures that our board of directors is fully informed of our cybersecurity risks.

companyName: HYDROFARM HOLDINGS GROUP, INC.

ticker: HYFM


text: Cybersecurity Incident Response Infinera has implemented a cybersecurity incident response plan in line with industry standards. The plan defines roles and responsibilities regarding potential cybersecurity incidents, establishes processes regarding identification, containment, eradication, and recovery from potential cybersecurity incidents and clarifies communication and notification policies regarding such potential cybersecurity incidents. The plan also captures lessons learned to drive continuous improvement. Additionally, the plan is evaluated, tested, and enhanced through training, table-top exercises, and by engaging with third-party service providers.

companyName: Infinera Corp


text: Our cybersecurity program is overseen by the Audit Committee of the Ansys Board of Directors. This oversight is anchored in the Audit Committee's charter, which specifically grants the Audit Committee oversight responsibility on our risks related to cybersecurity, including a review of the state of our cybersecurity program, emerging cybersecurity developments and threats and our strategy to mitigate cybersecurity risks. The Senior Director of Internal Audit and Risk Management, with input from the Vice President of Cybersecurity, reports on the status of the cybersecurity program to the Audit Committee and, periodically or where appropriate, to the Ansys Board of Directors. These reports generally include recent updates and improvements to the cybersecurity program, information on the cybersecurity program's status and intelligence on recent cybersecurity threats, actions we have taken to mitigate such threats and recent material incidents, or potentially material incidents, if any. In addition, the Senior Director of Internal Audit and Risk Management reports to the Audit Committee on the enterprise risk management program, which includes risks associated with cybersecurity.

companyName: ANSYS INC


text: Our cybersecurity risk management program is fully integrated within our broader enterprise risk management framework, leveraging consistent methodologies, incident reporting channels, and governance processes. These approaches are used not only for cybersecurity risks but also for managing other areas of risk, including legal, compliance, strategic, operational, and financial. The program is continuously assessed and refined, using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guiding tool to identify, prioritize, and manage cybersecurity risks that could significantly affect our operations, financial performance, or business objectives.

companyName: LIGHTPATH TECHNOLOGIES INC

ticker: LPTH


text: We recognize the critical importance of maintaining the safety and security of our information technology systems and data. Management's approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management ("ERM") program. Management, in turn, reports up to our Board of Directors (the "Board"), which is responsible for oversight of risk, including with respect to cybersecurity threats.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: New Fortress Energy Inc.

ticker: NFE


text: The Company leverages the following guidelines and frameworks to continue to refine and maintain the information security program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: Bank of Marin Bancorp

ticker: BMRC


text: Audit Committee is responsible for the oversight of risks associated with cybersecurity threats. The Audit Committee charter provides that the Committee is responsible for considering the effectiveness of the Company's internal control system, including information technology security and control. The Director of IT reports significant cybersecurity events to our Chief Financial Officer, who then reports such events to our Audit Committee.

companyName: Biofrontera Inc.

ticker: BFRI


text: Our cybersecurity operation center monitors our environment to detect cybersecurity incidents, identifies suspicious activities or unusual behaviors, and responds with the objective of minimizing potential impact to operations. We use various security technologies and controls and modern analytics designed to detect, prevent and respond to cybersecurity threats. Our global cybersecurity services team collects intelligence from the private and public sector related to cybersecurity threats, emerging adversarial campaigns and vulnerabilities. The global cybersecurity services team uses this information, along with internal intelligence and analytics, to evaluate the potential cybersecurity threats and develop security strategies to reduce risk and improve response.

companyName: FISERV INC

ticker: FISV


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: DIH HOLDING US, INC.


text: The Board of Directors has delegated the oversight of risks from cybersecurity threats to the Audit Committee, which has delegated authority to the CFO to oversee the Company's cybersecurity risk management, including prevention, detection and responding to any suspected cybersecurity incident.

companyName: AMERICAN SUPERCONDUCTOR CORP /DE/

ticker: AMSC


text: A terminated employee's physical and electronic access to personal information must be immediately blocked. Such terminated employee shall be required to surrender all keys, IDs or access codes or badges, business cards, and the like, that permit access to the firm's premises or information. Moreover, such terminated employee's remote electronic access to personal information must be disabled; his/her voicemail access, e-mail access, internet access, and passwords must be invalidated. employees' user ID's and passwords must be managed in accordance to Valkyrie's password policy. are encouraged to report any suspicious or unauthorized use of customer information.

companyName: CoinShares Bitcoin ETF

ticker: BRRR


text: Under the oversight of the audit committee of the Board, and as directed by our Chief Executive Officer ("CEO"), the Head of IT is primarily responsible for the assessment and management of material cybersecurity risks and the Company's annual security audits to meet the payment industry expectations. Our management team holds a regular cybersecurity and business continuity reviews to evaluate data security exposures, control effectiveness and necessary remediation actions. The Head of IT is also supported by a third-party IT consulting services provider who helps oversee our IT systems and provides cross-functional support for cybersecurity risk management and facilitates the response to any cybersecurity incidents.

companyName: RYVYL Inc.

ticker: RVYL


text: Cybersecurity is an integral part of our enterprise risk management. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our Digital Systems. Our cybersecurity risk management program includes a cybersecurity incident response plan as well as property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: HESS CORP


text: Our Audit Committee liaises with our management team to communicate with and monitor management's mitigation efforts to reduce cybersecurity risks by monitoring incident response, discussing and assisting with identifying potential cyber threats, analyzing vulnerabilities, and prioritizing risks.

companyName: NextPlat Corp

ticker: NXPL


text: We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats and have implemented various processes and safeguards to aid in such efforts. Our program encompasses people, processes, and technologies to safeguard our systems, data, and business from cybersecurity threats. Our program prioritizes threat mitigation and risk management, while focusing on maintaining the integrity and resilience of our systems.

companyName: AUTOZONE INC

ticker: AZO


text: Board Oversight of Cybersecurity Risks The audit committee of the board of trustees, or the Audit Committee, provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Audit Committee receives periodic updates from the FS Investments CISO and our Chief Compliance Officer, or the CCO, regarding the overall state of the FS Investments cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting us.

companyName: FS Specialty Lending Fund

ticker: FSEN


text: oversees cybersecurity risk as part of its broader risk management responsibilities. The Board considers cybersecurity a critical component of our organization's risk management framework. The Board is responsible for approving the cybersecurity strategy, ensuring that sufficient resources are allocated to cybersecurity initiatives, and monitoring compliance with relevant regulations and industry standards.

companyName: Armlogi Holding Corp.

ticker: BTOC


text: Identification of reasonably foreseeable internal and external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of confidential information or information systems. Assessment of the likelihood and potential damage of these threats, taking into consideration the sensitivity of confidential information. Assessment of the sufficiency of policies, procedures, information systems, and other arrangements in place to control risks.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Employees receive annual and ongoing education and training regarding relevant cybersecurity risks and practices, including how to protect information and systems from cyber threats. We also conduct monthly phishing simulations to increase employees' ability to detect and prevent such threats.

companyName: Xylem Inc.

ticker: XYL


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of Directors of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Management's Role Managing Risk The VP of Technology and Deployment and the CEO play a pivotal role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a semi-annual basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events; and Compliance with regulatory requirements and industry standards.

companyName: Castellum, Inc.

ticker: CTM


text: These processes and systems are designed to protect against unauthorized access of information, including by cyber- attacks, and Fortress's policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks. Fortress's processes and systems aim to prevent or mitigate two main types of cybersecurity risk: first, cybersecurity risks associated with its physical and digital devices and infrastructure and second, cybersecurity risks associated with third parties, such as people and organizations who have access to its devices, infrastructure or confidential or sensitive information. The cybersecurity-control principles that form the basis of Fortress's cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Fortress Net Lease REIT


text: The TISD, under the direction of the Company's Chief Executive Officer, is responsible for overseeing the Company's information technology systems, digital capabilities, and cybersecurity practices. The current TISD has more than 25 years of IT experience and has spent 15+ years overseeing cybersecurity strategy, implementation, and operation. Additionally, he holds a Master's degree in IT Management and a Master's Degree in Business Administration.

companyName: SOUTHERN COPPER CORP/

ticker: SCCO


text: As part of our risk management program, we periodically conduct penetration testing through an independent third-party assessor, as well as internal user training and tabletop exercises. We also conduct self-assessments of our cybersecurity risk management program to evaluate effectiveness and alignment with NIST standards and industry best practices. In addition, we maintain processes governing interconnections with third-party systems and annually review critical vendors' cybersecurity positions for potential risks. This process includes review of System and Organization Controls ("SOC") 1 and SOC 2 reports (as each such report is defined by the American Institute of Certified Public Accountants), and direct interaction with key vendors to assess and address risks.

companyName: BARNES GROUP INC


text: As leaders of the Technology and CDT functions within ATMOS, respectively, the Company's CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company's internal cybersecurity reporting structure. Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents. Our CDT team, overseen by our CISO, is also responsible for the mitigation and remediation of cybersecurity incidents. When members of the CDT team detect a cybersecurity threat or incident or are made aware of a cybersecurity incident encountered by a third-party service provider, the discovery is communicated to the Incident Response team, which includes our CISO and other senior members of the CDT function. The Incident Response team evaluates the severity of the cybersecurity threat or incident and shares its findings with our CISO.

companyName: AMGEN INC

ticker: AMGN


text: Cybersecurity risk management is overseen both as a critical component of our overall risk management program and as a standalone program. We have implemented a risk-based, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Our cybersecurity program is designed to leverage people, processes, and technology to identify and respond to cybersecurity threats. We also engage external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes. We assess, identify, and manage risks from cybersecurity threats through various mechanisms, which may include risk assessments using applicable industry specific cybersecurity frameworks, control gap analyses, penetration testing, vulnerability scanning, cyber insurance that aligns with our subsidiaries' risk profiles and internal or third-party assessments.

companyName: Compass Group Diversified Holdings LLC


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including as a result of any previous cybersecurity incidents) that have materially affected our business strategy, our results of operations or our financial condition, but there can be no guarantee that we will not experience a cybersecurity incident in the future. We can give no assurance that we have detected or protected against all cybersecurity threats or cybersecurity incidents.

companyName: indie Semiconductor, Inc.

ticker: INDI


text: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks. Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs. Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually. We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy. Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and Internal Audit as well as our CISO, provides additional support for ERM assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices. Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.

companyName: BRIGHT HORIZONS FAMILY SOLUTIONS INC.

ticker: BFAM


text: The Company has processes in place to assess, identify, and manage material risks from cybersecurity threats and cybersecurity incidents. The Company's business is dependent on the communications and information systems of the Adviser and other third-party service providers. The Adviser manages the Company's day-to-day operations and has implemented a cybersecurity program that applies to the Company and its operations.

companyName: TriplePoint Venture Growth BDC Corp.

ticker: TPVG


text: In our risk factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have significantly affected or are reasonably likely to significantly affect us, including our business strategy, results of operations, or financial condition. See our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: A10 Networks, Inc.

ticker: ATEN


text: In addition, Lucid has implemented processes to integrate our cybersecurity risk management processes into our overall enterprise risk management system including within our greater product management, personnel management, and third-party vendor and service provider management processes.

companyName: Lucid Group, Inc.

ticker: LCID


text: Our CISO has over 20 years of experience in information security, including more than 15 years of experience leading large-scale cybersecurity and privacy programs across various industries. He currently leads all aspects of our enterprise cybersecurity strategy, risk governance, and privacy effort. He holds industry-recognized certifications, including CISSP. He earned his MBA with a focus on Finance and Strategy and a B.E. in Electronics and Communication.

companyName: Nurix Therapeutics, Inc.

ticker: NRIX


text: Our management oversees the assessment and management of cybersecurity threats. In the event of any reportable cybersecurity incident, our management shall promptly notify our board of directors, including determining the necessary actions such as disclosure, mitigation, or other appropriate responses. Public Offering.

companyName: Solidion Technology Inc.

ticker: STI


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes or other circumstances as warranted, and the procedures therein are tested annually. The GIRP's incident handling procedures dictate our actions during each phase of an incident, including the assembly of a broad, cross-functional Computer Security Incident Response Team, the formulation of a response, and post-incident reviews and corrective actions.

companyName: Cigna Group

ticker: CI


text: As part of the above process, we engage third -party services to provide 24 -hour, 365 -day monitoring, escalation, and response to cyber events. In addition to consulting on best practices, we leverage a third -party expert security firm for independent evaluations of our security controls through penetration testing. These evaluations test both the design and the operational effectives of security controls.

companyName: Eton Pharmaceuticals, Inc.

ticker: ETON


text: Risk Assessment and Management The Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and response processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: The audit committee oversees the implementation of our cybersecurity risk management program. The committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and Hess employee training activities. In addition, management updates the committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.

companyName: Hess Midstream LP

ticker: HESM


text: To proactively manage cybersecurity risk in our organization, our management team has instituted an Information Technology Security Policy that is available to all employees through our Quality Management System. We also conduct regular cybersecurity awareness and training campaigns for existing employees.

companyName: Jasper Therapeutics, Inc.

ticker: JSPR


text: Risk Management Strategy Securing the Company's business information, customer, supplier, and employee data and information technology systems is an important part of our overall risk management framework. We rely on certain key information technology systems, some of which are dependent on services provided by third parties, including cloud vendors, for various business functions necessary to operate and manage our business. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring, including a review of SOC-1 reports on an annual basis.

companyName: PHOTRONICS INC

ticker: PLAB


text: Our Board of Directors has overall responsibility for risk oversight and is currently overseeing Astra's business continuity risks, including cybersecurity risks, which occurs at both the full Board level and at the Board committee level through the Audit Committee. To help ensure effective oversight, the Audit Committee receives reports on information security and cybersecurity from the VP IT, at least four times a year including, but not limited to, analysis of events that have impacted our peers, updates on program maturity, regulatory compliance status and cybersecurity program status and updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents impacting the Company, as well as any incidents with lesser impact potential. The Audit Committee regularly briefs our Board of Directors on the matters communicated to the Audit Committee.

companyName: Astra Space, Inc.


text: C.Impact of Cybersecurity Threats on Business Strategy and Results of Operations The Company has experienced cybersecurity incidents in the past, and has been impacted by cybersecurity incidents experienced by its service providers, but none has materially affected the Company's operations. The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risks Related to Technology and Cybersecurity" in "Part I – Item 1A. Risk Factors" for additional information.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: Our cybersecurity risk management strategy is integrated into our enterprise risk management framework and is embedded in each of our three lines of defense. We use a combination of management expertise and Board oversight, as discussed below, as well as outside consultants to assist us in overseeing our cybersecurity risk management program. We deploy safeguards designed to protect customer information and our own corporate information and technology. We have programs and processes in place designed to mitigate known attacks, and we use both internal and external resources to scan for vulnerabilities in our applications, systems, and platforms. We implement backup and recovery systems and require the same of our third-party service providers.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Senior leadership, including our cybersecurity consultant, regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to have a moderate or higher business impact, even if immaterial to us. The full Board retains oversight of cybersecurity because of its importance. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal), as well as senior leadership and the Board, as appropriate.

companyName: Silo Pharma, Inc.

ticker: SILO


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common: methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: Cybersecurity is a critical component of our risk management program, given the increasing reliance on technology and potential cyber threats. Our Chief Technology Officer is leading cybersecurity risk management improvement initiatives as part of our Technology Strategy to 2025.

companyName: Freedom Holding Corp.

ticker: FRHC


text: There have been no known cybersecurity incidents that have had a material impact, have materially affected or are reasonably likely to materially affect the Trust, including its business strategy, results of operations, or financial condition.

companyName: NORTH EUROPEAN OIL ROYALTY TRUST

ticker: NRT


text: Management Oversight Our management plays an active role in assessing and managing the risks posed to us by cybersecurity threats. Our strategy for managing cybersecurity risk is embedded within the IT function, which reports to our Chief of Business Operations (CBO) and our Information Security function, which reports to our CRO. The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Global Chief Information Officer (CIO) and our Group Information Security Officer (GISO). Our CIO has over 25 years of experience in the area of information technology. He previously served in related roles, including IT strategy and delivery roles at Arthur Andersen Consulting and Deloitte Consulting, and has served in his current role since joining us in 2017. Our GISO has over 19 years of information security experience. His experience includes driving our information security strategy, awareness and training, third-party cyber risk management, compliance, and providing assurance of the security activities conducted by the IT Security Operations team. He has served in his current role since joining us in 2006. Our CIO and GISO are responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and are regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats.

companyName: Enstar Group LTD


text: In fiscal 2025, and through the filing of this Annual Report on Form 10-K, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business strategy, operating results, and/or financial condition. If we were to experience a material cybersecurity incident in the future, such an incident could potentially have a material effect, including on our business strategy, operating results, or financial condition. For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: SentinelOne, Inc.

ticker: S


text: Board considers cybersecurity risk as part of its risk oversight function and oversight of cybersecurity and other information technology risks.

companyName: Zoned Properties, Inc.

ticker: ZDPY


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.

companyName: PRUCO LIFE INSURANCE CO


text: Board Oversight of Cybersecurity Matters The Audit Committee is tasked with overseeing the Company's cybersecurity matters. Pursuant to the Audit Committee's charter, one of the Audit Committee's responsibilities is to discuss the Company's major risk exposures with management, including those related to cybersecurity, and the steps taken by management to monitor and control such exposures, including the Company's risk assessment and risk management guidelines, policies and practices.

companyName: Summit Midstream Corp

ticker: SMC


text: The CIO and CISO have primary responsibility over the Company's cybersecurity risk management program. Quarterly updates are provided to the Company's IT Council, comprised of executive, business unit and IT leaders from across the organization, regarding IT initiatives and risk management processes.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Despite our relatively low risk cybersecurity profile and the minimal threat of cybersecurity incidents that we face, we contract with one IT Consultant to assist us in identifying any potential cybersecurity risks and in implementing and maintaining effective measures to reduce our cybersecurity risks. Our IT Consultant helps ensure that our system is updated with the latest cybersecurity patches and configurations and monitors our system and accounts for suspicious activity.

companyName: SOLITARIO RESOURCES CORP.

ticker: XPL


text: Our cybersecurity risk management extends to risks associated with our use of third-party service and technology providers as well as partnerships with third parties we may enter into. For instance, we conduct risk and compliance assessments of third parties that request access to our IT resources and information or who provide technology products or services to Charles River.

companyName: CHARLES RIVER LABORATORIES INTERNATIONAL, INC.

ticker: CRL


text: Further, our cybersecurity risk management program includes a third-party risk management program to assess and manage cybersecurity risks associated with our use of third-party services providers that have access to our information systems and/or employee, agent or agent client confidential information. For example, we perform certain due diligence before engaging third-party service providers and consider potential cybersecurity risks and exposures in our choice among providers. We also generally require our third-party service providers that could potentially introduce cybersecurity risks to our information systems or sensitive consumer personal information to contractually agree to maintain a cybersecurity risk management program aimed at mitigating those risks and be subject to external cybersecurity audits.

companyName: Compass, Inc.

ticker: COMP


text: Cyber Risk Management Personnel The CISO directly reports to the Chief Administrative Officer ("CAO"). The CISO and CAO meet regularly to discuss both internal and external cybersecurity risks and incidents. The CIO and CAO also regularly meet with the Chief Executive Officer ("CEO") to update and discuss any cybersecurity risks and incidents affecting the Company. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, all significant cybersecurity matters and strategic risk management decisions are promptly escalated to the Board of Directors, ensuring that they have an up-to-date, comprehensive understanding of and can provide guidance on critical cybersecurity issues.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: As an early-stage company without significant investments in data security protection, we may not be sufficiently protected against such occurrences. We also lack sufficient resources to adequately protect against, or to investigate and remediate any vulnerability to, cyber incidents. It is possible that any of these occurrences, or a combination of them, could have material adverse consequences on our business and lead to financial loss. We have not encountered any cybersecurity incidents since our Initial Public Offering. In addition to our own cybersecurity risks, any proposed Business Combination target may have been subject to, or may in the future be subject to, cybersecurity incidents.

companyName: Launch Two Acquisition Corp.

ticker: LPBB


text: Training the Company's personnel is a vital part of how the Company manages cybersecurity threat risks. Effective training can both prevent cybersecurity incidents from occurring and can also enable the Company to rapidly and effectively respond to an actual cybersecurity incident through fast reporting. Company personnel are required to participate in new hire, annual and monthly training. In regular town hall meetings, a member of our information security team speaks to the entire Company, focusing Company personnel's attention on a specific risk or scenario in real-time, with the opportunity for Company personnel to ask questions. In addition, on an on going-basis, the Company's information security team has and will test Company personnel to see how they respond to phish emails or similar communications that originate from the Company.

companyName: LOGILITY SUPPLY CHAIN SOLUTIONS, INC


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled "Our internal computer systems, or those of our suppliers, customers, or contractors, have been and may in the future be subject to cyberattacks or security breaches, which could result in a material disruption of our business or otherwise adversely affect our business, financial condition, results of operations, cash flows, and prospects." under "Risk Factors" in Part I, Item 1A. to this Annual Report on Form 10-K.

companyName: Alpha Teknova, Inc.

ticker: TKNO