text: Communication, Coordination and Disclosure: We take a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from our technology, operations, legal, internal audit and other key business functions and engage with our Board in an ongoing dialogue regarding cybersecurity threats and incidents while also implementing controls and procedures for the assessment and escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: BOYD GAMING CORP

ticker: BYD


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has established robust oversight mechanisms to promote effective governance in managing risks associated with cybersecurity threats because Lightbridge recognizes the significance of these threats to our operational integrity and stakeholder confidence. Furthermore, significant cybersecurity matters such as significant cybersecurity incidents, and strategic risk management decisions are designed to be escalated to the Board of Directors, so that they have appropriate oversight and can provide guidance.

companyName: LIGHTBRIDGE Corp

ticker: LTBR

secItem: Item 1C


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology ("IT") environment; • a team of employees (as further described below), or our Response Team responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of reputable, recognized external service providers that assess, test and otherwise assist with aspects of our cybersecurity controls; • periodic cybersecurity awareness training of our employees, incident response personnel, and senior management; • an incident response plan that includes procedures for responding to cybersecurity incidents; and • a risk management process with respect to IT-related third-party service providers.

companyName: American Assets Trust, Inc.

ticker: AAT


text: We recognize the importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. Civeo leverages controls modeled in the Center for Internet Security (CIS) and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to evaluate our cybersecurity capabilities and to inform the implementation and configuration of certain systems, processes, and technologies. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes. Cybersecurity events are collected, evaluated and, when appropriate, escalated to the Chief Information Security Officer (CISO) for impact analysis utilizing our cybersecurity risk management policy.

companyName: Civeo Corp

ticker: CVEO


text: In 2023, there were no risks from cybersecurity threats that have materially affected or reasonably likely to material affect the Fund, its business strategy, results of operations or financial condition.

companyName: RIDGEWOOD ENERGY A-1 FUND LLC


text: Our management team, including our Chief Financial Officer and Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Vice President of Information Technology has more than 25 years of experience managing and leading IT and cybersecurity teams. Our Vice President of Information Technology participates in the Aviation ISAC organization, an international membership community of airframers, airlines, airports, satellite manufacturers, aviation services, and their supply chains that collaborate to prevent, detect, respond to, and remediate cyber risk through threat intelligence sharing and best practices.

companyName: SKYWEST INC

ticker: SKYW


text: Our Board of Directors considers cybersecurity and other information technology risk as part of its risk oversight function. The Board of Directors receives an annual briefing, and the Audit Committee receives quarterly reports from our CSO on our cybersecurity risks and risk management program. Our cybersecurity team, led by our CSO, who reports directly to our Executive Vice President and Chief Operations Officer, is responsible for assessing and managing risks from cybersecurity threats. T he CSO and his team have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and any retained external cybersecurity experts. Our CSO has over 20 years of security experience managing global security organizations including architecture, operations, strategy, applications, infrastructure, support and execution. The information security team collectively have decades of relevant experience in the industry and many hold various cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Further, we invest in regular, ongoing cybersecurity training for our team.

companyName: Marvell Technology, Inc.

ticker: MRVL


text: The Company's CIO has been responsible for Global IT, including overseeing cybersecurity since joining the Company in 2017. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at DigitalGlobe, a satellite imagery provider to the U.S. Government, as well as other global high tech manufacturing companies.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: We are subject to cybersecurity risk, which includes intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risk can take the form of a variety of circumstances to cause harm to us, our members, our service providers, and the economy in general. These circumstances include, but are not limited to, malicious software or exploited vulnerabilities, social engineering, such as phishing, denial-of-service attacks, viruses, malware, and natural disasters. Refer to Item 1A — Risk Factors for a description of cybersecurity and other operational risks that may affect our information technology assets and data under our control.

companyName: Federal Home Loan Bank of Boston


text: We recognize the importance of developing, implementing, and maintaining measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data and to address potential cybersecurity incidents that may materially affect our business.

companyName: Organogenesis Holdings Inc.

ticker: ORGO


text: Risk Management and Strategy Identifying, assessing and managing material cybersecurity threats is important to our operations and business strategy. We have established policies and procedures that are designed to prioritize the safeguard of our information systems. These procedures help identify potential vulnerabilities and manage risks from unauthorized incidents within our information systems that may result in adverse effects on data residing within. We conduct periodic and ad-hoc assessments that are managed by third party information technology providers, to identify potential cybersecurity threats.

companyName: Capstone Holding Corp.

ticker: CAPS


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, 24x7 security monitoring, and other controls which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: AMICUS THERAPEUTICS, INC.

ticker: FOLD


text: We assess materiality of cybersecurity incidents based on the type of breach, whether any information was accessed, the nature of the information accessed, and the potential for business interruption. As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: Laird Superfood, Inc.

ticker: LSF


text: We have established an information security policy and incident response and crisis management plans. We continue to regularly test and evaluate the effectiveness of those plans. Our incident response and crisis management plans address and guide our employees, management and the Board on our response to a cybersecurity incident.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Processes for Assessing, Identifying, and Managing Material Risks from Cybersecurity Threats Our cybersecurity program has four components: (1) preparation and prevention; (2) detection and analysis; (3) incident response including containment, eradication, recovery, and reporting; and (4) post-incident analysis and program enhancements.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Our Director, IT Infrastructure & Cybersecurity has relevant expertise in cybersecurity having spent the previous two years prior to joining the Company building a SOX compliant IT controls framework for a biotechnology company in preparation for its initial public offering. Prior to that, our Director, IT Infrastructure & Cybersecurity spent five years at a publicly traded pharmaceuticals company, where he was responsible for the SOX cybersecurity and compliance of systems, processes, and policies. In addition to SOX compliance, our Director, IT Infrastructure & Cybersecurity has extensive experience with other compliance frameworks, including National Institute of Standards and Technology (NIST), HIPAA, Clinical Laboratory Improvement Amendments (CLIA), and GxP security models.

companyName: Third Harmonic Bio, Inc.


text: Our cybersecurity risk management program is comprised of a number of components, including but not limited to written information security policies, external cybersecurity risk assessments, and system monitoring. We also have an employee privacy and data security training awareness program that includes cybersecurity risk awareness trainings and phishing campaigns. We maintain an incident response plan to help guide our response to cybersecurity incidents.

companyName: Septerna, Inc.

ticker: SEPN


text: Management's Operations Committee meets monthly and provides oversight and governance of the technology and cyber security programs. The Senior Vice President, Senior Technology Officer and Information Security Officer are members of this committee and report monthly on the technology and cyber security programs. The Senior Vice President, Senior Technology Officer also is a member of Management's Enterprise Risk & Disclosure Committee, which meets a minimum of four times a year, to report on the technology and cyber security programs.

companyName: HORIZON BANCORP INC /IN/

ticker: HBNC


text: We have policies and processes in place for assessing, identifying, and managing material cybersecurity risks, and integrate these processes into our overall risk management systems. We conduct periodic risk assessments to identify reasonably foreseeable internal and external cybersecurity risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Marqeta, Inc.

ticker: MQ


text: Our information technology management team has over two decades of experience in the technology industry in developing security strategies, playing a pivotal role in incident identification, leading security teams, and managing risks across various industries.

companyName: TIGO ENERGY, INC.

ticker: TYGO


text: See Item 1A. Risk Factors — General Risk Factors "We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.

companyName: James River Group Holdings, Inc.

ticker: JRVR


text: In response to an identified cybersecurity incident, a group comprised of appropriate management personnel, our third-party information technology service provider and, depending on the scope and severity of the incident, additional third-party subject matters experts, will be assembled to develop and implement a response strategy to contain, control, and remediate the cybersecurity incident, including securing our affected systems and/or information, mitigating harmful effects of the incident, preventing further compromises, and communicating information to affected parties, regulatory agencies and law enforcement, as necessary. This group will also report any such cybersecurity incident to the Audit Committee of the Board.

companyName: CervoMed Inc.

ticker: CRVO


text: Our finance, risk & investment committee of our board of directors has oversight of our strategic and business risk management and oversees management's execution of our cybersecurity risk management program. The board receives updates from management on our cybersecurity risks as may be required or prudent. In addition, management updates the board as necessary, regarding any material cybersecurity incidents. Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our board of directors.

companyName: LUXURBAN HOTELS INC.

ticker: LUXH


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats.

companyName: KIORA PHARMACEUTICALS INC

ticker: KPRX


text: Our Board of Directors (the Board) considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the Committee) oversight of cybersecurity risks. The Committee oversees our cybersecurity risk management program.

companyName: Vistagen Therapeutics, Inc.

ticker: VTGN


text: Certain cybersecurity threats have the potential to materially affect our business strategy, financial condition, and results of operations. These threats include the risk of cyberattacks that could result in the disruption of our business operations, loss of sensitive information or data and damage to our reputation with our customers, shareholders, and other stakeholders. We conduct periodic assessments of these threats, and we have developed action plans that are already implemented, or are currently underway to be implemented, based on the results of our periodic assessments.

companyName: WillScot Holdings Corp

ticker: WSC


text: From time-to-time, we may engage third-party consultants, legal advisors, and audit firms to evaluate and test the Company's risk management systems and assess and remediate certain potential cybersecurity incidents, as appropriate. We prioritize the integrity of our data access controls to prevent unauthorized access, data breaches, and malicious activities. We regularly assess and enhance our cybersecurity posture through comprehensive risk assessments, security audits, and vulnerability assessments. Cybersecurity is a shared responsibility requiring collaboration and cooperation across all levels of our organization.

companyName: International Land Alliance Inc.

ticker: ILAL


text: In the event of a cybersecurity incident, designated personnel are responsible for assessing the severity of an incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing any reporting obligations associated with the incident, and performing post-incident analysis and program enhancements. We maintain a disaster recovery plan in the event of a significant cybersecurity incident.

companyName: Phio Pharmaceuticals Corp.

ticker: PHIO


text: We are a clinical stage biopharmaceutical company, with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We assess material risks from cybersecurity threats on an ongoing basis, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards. We have not encountered cybersecurity risks that have materially affected or are reasonably likely to materially affect us or our business strategy. For additional information regarding risks from cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: With oversight from our audit committee and our board of directors, our management team including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Operating Officer and General Counsel ("COO/GC"), is responsible for managing all cybersecurity risks and overseeing our security programs. Our information technology team is comprised of our Chief Accounting Officer ("CAO") and other knowledgeable employees, and is responsible for management of our cybersecurity programs. Our information technology team consists of individuals with experience in assessing and addressing cybersecurity risk and is responsible for executing our cybersecurity programs as well as communicating regularly with senior management. Our CEO, CFO and COO/GC have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors. In addition, our cybersecurity program includes engagement of other Company management and employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: The Company has established a clear chain of command in the management of cybersecurity risks by designating a CISO and Chief Information Officer ("CIO"), who jointly lead the Company's incident response team, which also includes the company's management team. The CISO has certifications in information security, and together, the CISO and CIO have over 25 years of cybersecurity experience combined. The CISO and CIO meet with Company senior leadership at least quarterly through an Information Technology Steering Committee in which management assess information security risk. The Company has subscribed to threat intelligence feeds that are reviewed throughout the day to ensure risks are identified and assessed in a timely manner.

companyName: EVANS BANCORP INC


text: Board Governance and Management The Executive Vice President ("EVP") & Chief Information Officer ("CIO") and the SVP of Enterprise Strategy and Execution provide quarterly written and in-person updates on the strength of our cyber risk control environment, emerging cyber threat issues, and the results of external assessments by outside security consultants and assessors to the Board's Audit Committee, which was responsible for the oversight of our ERM process in 2023. Effective January 1, 2024, the Board created a Risk Committee responsible for oversight of our ERM framework and practices, and to assist the Board in overseeing our operational activities and identifying and reviewing related risks, including our cyber risks and strategy.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Technical Safeguards We regularly assess and deploy internal and third party technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: Paymentus Holdings, Inc.

ticker: PAY


text: Board Oversight Role Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee (the Committee) of the Board of Directors oversees our cybersecurity and data privacy. The Committee meets periodically to review and discuss with management risks relating to significant cybersecurity matters and concerns involving the company, including information security, data privacy, backup of information systems and related regulatory matters and compliance. The Committee regularly reports to the Board of Directors with respect to the Committee's activities and recommendations, including those relating to cybersecurity matters and concerns. The CIO provides quarterly reports to the Committee on information security matters, including the adequacy and effectiveness of the company's information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: We continually enhance our cyber defense strategy with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously bolstering our system resilience in an effort to minimize the business impact should an incident occur. Third parties also play a role in our cybersecurity. We engage reputable third-party security firms for consultation on industry best practices and regulatory standards and to conduct routine evaluations of our cybersecurity, such as through penetration testing and security audits; these evaluations include testing both the design and operational effectiveness of security controls. All employees are required to complete cybersecurity training at least twice a year and have access to more frequent cybersecurity training through periodic updates. Employees in certain roles also receive additional role-based, specialized cybersecurity training.

companyName: KRONOS WORLDWIDE INC

ticker: KRO


text: We depend on and engage various other third parties, including suppliers, vendors, and service providers, to support key elements of our business including our information technology infrastructure. Our processes address cybersecurity threat risks associated with our use of such third-party service providers. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, to inform our professionals' risk identification and assessment.

companyName: ALPHA PRO TECH LTD

ticker: APT


text: In connection with the Integration, we anticipate that we will continue to evaluate and address as needed our cyber security risk management, policies, structure, strategies and governance to meet our needs.

companyName: EchoStar CORP

ticker: SATS


text: We have experienced cybersecurity incidents that were immaterial and, as previously disclosed, in the third quarter of fiscal year 2023, we experienced a material cybersecurity incident as the personal information of a significant number of individuals was accessed by an unauthorized third-party exploiting a zero-day vulnerability in a third-party vendor's file transfer application used by many organizations, including us. We have recorded expenses in connection with the investigation and remediation activities related to this incident; further details are included in "Note 15. Commitments and Contingencies" in Item 8 of this Annual Report on Form 10-K. To date, we are not aware of any other cybersecurity incidents that have had a material effect on our business. Despite our preventative and remediation efforts, we may continue to experience cybersecurity incidents in the future. There can be no guarantee that such efforts will be sufficient to protect the company's information systems, information, and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the company or its results of operations or financial condition or cause reputational or other harm to the company. Refer to Item 1A of this Form 10-K, which includes a section on "Risks Pertaining to Data and Data Security," for further discussion of the associated risks.

companyName: MAXIMUS, INC.

ticker: MMS


text: • Incident Response and Recovery Planning: The Company has established and maintains security incident response and disaster recovery plans designed to address the Company's response to a cybersecurity incident. • Third-Party Risk Management: The Company leverages third-party vendors to house critical clinical trial data. These vendors are required to be GxP compliant which entails strong cybersecurity controls that are validated by a third-party auditor. Furthermore, the Company has begun performing security risk assessments prior to on-boarding new significant vendors. • Education and Awareness: The Company provides regular, mandatory training for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: Risk management and strategy the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: The Company's process for assessing, identifying, evaluating and managing cybersecurity risks as part of its broader ERM program includes: • Risk Identification and Prioritization: The Company employs various methods to assess and identify cybersecurity risks, which methods may, from time to time, include tabletop exercises to test our preparedness and incident response process, business unit assessments, control gap analyses, threat modeling, impact analyses, internal audits, external audits, penetration tests, and engaging third parties to conduct analyses of our information security program. This process includes evaluating the likelihood and impact of potential cybersecurity incidents. • Continuous Risk Monitoring: The Company actively monitors cybersecurity risks including third-party risk from vendors and suppliers. Significant fluctuations in the prevalence or impact of such risks are reported to the Risk Committee on a quarterly basis. • Mitigation Strategies: While continuous backups to a warm failover site are performed, the Company's Incident Management and Information Security Plan is designed to identify and respond to security incidents and threats in a timely manner to minimize the loss or compromise of information assets and to facilitate incident resolution. In general, our incident response process follows the framework established by the National Institute of Standards and Technology ("NIST") and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. We also conduct mandatory annual cybersecurity training for all employees.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Our CAO is responsible for enterprise-wide information technology services and cybersecurity system strategy. In this capacity, the CAO oversees the cybersecurity risk management program, which is maintained and implemented by the Enterprise Security Director. Our CAO has 24 years of experience at the company, during which time she has held a number of management and leadership positions, including Chief Information Officer, through which she has developed expertise in our IT/OT cybersecurity, data security, and physical security environment and risk profile.

companyName: WEC ENERGY GROUP, INC.

ticker: WEC


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For further discussion of the cybersecurity risks, see "Part I—Item 1A. Risk Factors," specifically the risk titled "We are subject to cybersecurity risks to our systems, infrastructure, and technology, and data processed by us or third-party vendors." No matter how well designed or implemented our internal controls are, we will not be able to anticipate all cybersecurity threats, and we may not be able to implement effective preventive or detective measures against such security breaches in a timely manner. While we maintain insurance that may cover certain liabilities in connection with certain disruptions, security breaches, and incidents, there can be no guarantee that our insurance coverage will be adequate to compensate us for the potential losses.

companyName: LiveOne, Inc.

ticker: LVO


text: Our CIO, supported by our Director of Cybersecurity, provides quarterly reports to the Board, which, generally includes: • Our cybersecurity risk profile; • Any changes to our cybersecurity strategy; • Status of the execution of the cybersecurity strategy; and • Summary of any material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Board Oversight of Cybersecurity Risks The Board provides strategic oversight on cybersecurity matters, including risks associated with cybersecurity threats. The Board receives periodic updates from its Chief Compliance Officer ("CCO"), which incorporates updates provided by the Head of Information Technology of Oxford Funds, regarding the overall state of Oxford Funds' cybersecurity program, information on the current threat landscape, and risks from cybersecurity threats and cybersecurity incidents impacting the Company.

companyName: Oxford Square Capital Corp.

ticker: OXSQ


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company. have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: BullFrog AI Holdings, Inc.

ticker: BFRG


text: Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight. While the full Board retains overall oversight over cybersecurity, the Board has delegated to its Audit Committee oversight of the Company's information technology security program and the controls around cybersecurity, and to its Compliance and Risk Committee oversight of an enterprise risk management program that is designed to assist with monitoring and mitigating operational risks. The Audit Committee and Compliance and Risk Committee meet every quarter. The Audit Committee is updated as needed on cybersecurity threats, incidents, and programs, and the Compliance and Risk Committee is updated as needed on new developments in our cybersecurity risk profile. After each such meeting, the respective chairs of the Audit Committee and Compliance and Risk Committee provide a report to the full Board on the committee meeting.

companyName: Cencora, Inc.

ticker: COR


text: We regularly engage with third-party assessors and auditors as part of our ongoing cybersecurity risk assessment process to leverage specialized knowledge and insights and to identify areas for continued focus, improvement, compliance and effectiveness of mitigation. We also utilize government and industry-related security intelligence sources, and actively participate in industry peer groups and public-private partnerships to assist in the identification of potential threats. We conduct ongoing cybersecurity training and monthly email phishing drills for all employees.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: Our Chief Information Security Officer ("CISO") manages Adtalem's enterprise-wide cybersecurity program and reports to Adtalem's Chief Financial Officer. The CISO has been responsible for assessing and managing material risks from cybersecurity threats at Adtalem since 2018. The CISO has over twenty years of information technology and cybersecurity experience, including executive leadership roles at Fortune 500 organizations within regulated sectors including financial services and healthcare. The CISO leads a team of experienced subject matter experts with focus on strategy formulation, architecture design, incident response, colleague training, risk management, and governance functions. This team includes diverse industry backgrounds spanning Financial Services, Healthcare, and Government.

companyName: Covista Inc.

ticker: CVSA


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of the Bank's efforts to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats. We have established processes and systems designed to mitigate cyber risk, including on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and the Bank's supply chain. We also actively monitor our email gateways for malicious phishing e-mail campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to the Bank's information security program, to assess their design and operating effectiveness and make recommendations to strengthen the Bank's risk management program.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Management's Role in Cybersecurity Risk Management Our management, including our Chief Operating Officer and Chief Compliance Officer, is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks, such as information systems technology, cybersecurity, regulatory compliance and corporate governance. Our management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel.

companyName: Hercules Capital, Inc.

ticker: HTGC


text: The CyTOC receives regular updates from our CISO and other members of management on risks related to these matters. Specific topics may include updates to FedEx's cyber risks and threats, the status of existing or new strategies and associated projects intended to strengthen FedEx's information security systems, assessments of FedEx's cybersecurity program, risks associated with third-party service providers, and the emerging threat landscape. The CyTOC also receives regular updates on key metrics related to our cybersecurity-related risks. The results of the IT risk management process are also presented at least annually to the CyTOC. Additionally, members of the CyTOC participate in certain of the simulation exercises conducted by management. The Chair of the CyTOC briefs the full Board on certain of these matters. In addition, the Board periodically receives cybersecurity updates directly from management. Separately, through our ERM program, key enterprise risks, including with respect to cybersecurity, are communicated to the Board and its Audit and Finance Committee at least annually, and any significant changes to these risks are reported to the Board and its Audit and Finance Committee.

companyName: FEDEX CORP

ticker: FDX


text: Our CISO, in coordination with the Management Operational Risk Committee, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, cross-functional teams are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with our information security incident response plan. Our CISO, through his team and use of accompanying technology, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Management Operational Risk Committee and/or the Board Operational Risk Committee, as and when appropriate.

companyName: LendingClub Corp

ticker: LC


text: As discussed above, our information security program and approach are based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Information Security Officer, under the guidance of the Chief Information Officer and in coordination with the Head of Risk, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Information Security Officer holds the Certified Information Systems Security Professional (CISSP) designation, has over 20 years of experience working in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.

companyName: Argo Group International Holdings, Inc.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased Information Technology ("IT") security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: The Company's Chief Information Officer and Chief Information Security Officer, in coordination with the Company's Cyber Security Committee, work collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and designed to allow the Company to promptly respond to any cybersecurity incidents in accordance with the Company's Security Incident Response Plan. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Information Officer, the Chief Information Security Officer, and the Company's Cyber Security Committee monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and report such incidents to the Audit Committee when appropriate.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Due to the current small size and limited commercial operations of the Company, we have no formal cybersecurity policies and processes in place, however, the Board and management believe cybersecurity represents an important component of the Company's overall approach to risk management and oversight.

companyName: SUNHYDROGEN, INC.

ticker: HYSR


text: Management ' s Role Managing Risk The Company's management is primarily responsible for assessing, monitoring and managing our cybersecurity risks. Management must ensure that all industry standard cybersecurity measures are functioning as required to prevent or detect cybersecurity threats and related risks. Management oversees and tests our compliance with standards, remediates known risks, and leads our employee training program.

companyName: FIREFLY NEUROSCIENCE, INC.

ticker: AIFF


text: The EISP is our core policy for assessing, identifying and managing cybersecurity risks, and it applies to all employees, contractors, temporary employees, and other parties doing business on behalf of or in support of the Bank who, by the nature of their work, have access to our information assets and systems. Broadly, it establishes the administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with the applicable law. To do this, the EISP, among other provisions: • allocates key responsibilities, including the responsibilities of our chief information security officer ("CISO") and our Chief Risk Officer ("CRO") related to cybersecurity risk management; • establishes a security education, training and awareness program, which is intended to influence development of skills and habits to safeguard our information assets; • establishes a risk-based vulnerability management program; • mandates and establishes standards for periodic penetration testing; • provides controls and minimum standards regarding physical security (e.g., systems are located behind locked doors) and operational security (e.g., monitoring existing and emerging threats); • mandates the development, acquisition and maintenance of systems with appropriate security controls (e.g., maintaining appropriate configuration management and control processes and maintaining appropriate patch management processes); and • mandates the adoption of industry standards to address business requirements within a cybersecurity framework that leverages both the National Institute of Standards and Technology framework and the Center for Information Security Controls in measuring the maturity of our information security program and its adoption of best practices.

companyName: Federal Home Loan Bank of Indianapolis


text: Our information security program is managed by a dedicated Chief Information Security Officer ("CISO") who reports to our Chief Technology Officer, a member of our Executive Leadership Team ("ELT"). Our CISO has a graduate degree in computer engineering and has worked in cybersecurity for over two decades, including at a major financial institution. The information security team is comprised of approximately 60 employees, with dedicated teams assigned to governance, risk and compliance, identity and access management, strategy and architecture, and analytics and automation. The team operates from FactSet locations around the world, including offices in the U.S., India, the Philippines and Europe.

companyName: FACTSET RESEARCH SYSTEMS INC

ticker: FDS


text: The cybersecurity program at 8x8 is fully integrated with the Company's overall risk management program through our Chief Information Security Officer's participation in such governance structures as the executive risk management committee, data protection committee, and internal disclosure committee and the incorporation of security in the Company's overall compliance and enterprise risk management programs. By aligning cybersecurity initiatives with 8x8's broader enterprise risk management initiatives, 8x8 pursues a holistic approach to identifying, assessing, and mitigating risks across the organization.

companyName: 8X8 INC /DE/

ticker: EGHT


text: Our management team, including our CISO, Chief Risk Officer (CRO) and Chief Operational Risk Officer (CORO), is responsible for assessing and managing our material risks from cybersecurity threats. Our management team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO works closely with our CRO and CORO, who are responsible for providing effective oversight and challenge to the activities of our CISO.

companyName: BREAD FINANCIAL HOLDINGS, INC.

ticker: BFH


text: Following these risk assessments, we re-design, implement, and maintain reasonable safeguards to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards. We devote internal and external resources and designate high-level personnel to manage the risk assessment and mitigation process.

companyName: Innoviva, Inc.

ticker: INVA


text: The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs. For example, we engage third parties to: monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations. The BISO assists the CRO/CISO in assessing and monitoring information risks posed by third parties and any non-compliance with the controls created to address such risks. With respect to cybersecurity incidents affecting our third-party service providers, the CRO/CISO works with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.

companyName: Capital Bancorp Inc

ticker: CBNK


text: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management and Board of Directors, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Simulations Plus, Inc.

ticker: SLP


text: The Program is governed by the Board of Directors and specifically, the Audit and Risk Committee, as well as two management committees, the Enterprise Risk Management Committee ("ERMC") and the Technology and Information Security Committee ("TISC").

companyName: TOMPKINS FINANCIAL CORP

ticker: TMP


text: To date we have not experienced any cybersecurity incident that has materially affected our business, results of operation, or financial condition. We have also not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Although we have adopted various processes and preventative measures with the objective of preventing breaches and minimizing the risks from cybersecurity matters, given the nature of cybersecurity threats which are constantly evolving over time, there is no guarantee that the Company, including its business strategy, results of operations or financial condition, will not be adversely affected by such threats or that our preventative measures and processes will be effective. For further discussion of the Company's risk related to cybersecurity, see the risk factors "Our business and reputation may be impacted by IT system failures or other disruptions" and "If our products experience data security breaches, and there is unauthorized access to our customers' data, we may lose current or future customers, our reputation and business may be harmed and we may incur significant liabilities" in Part I, Item 1A of this Form 10-K.

companyName: Augmedix, Inc.


text: We engage in periodic assessments and testing of our policies and procedures that are designed to address cybersecurity threats and incidents. We use a range of activities such as audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. On occasion, we use third parties (such as outside counsel, information security consultants, and software providers) to assist in these assessment and testing exercises.

companyName: HERC HOLDINGS INC

ticker: HRI


text: The standing Cybersecurity Committee of the Company's Board of Directors assists with oversight of the Company's cybersecurity program and the material risks associated with the threats identified under the program. Given the Cybersecurity Committee's chair's previous military experience in positions relevant to information security and his NACD-sponsored CERT Certificate in Cybersecurity Oversight from Carnegie Mellon University's Software Engineering Institute, the committee benefits from his perspectives, skills, and training when reviewing and managing the Company's exposure to cybersecurity risks.

companyName: APA Corp

ticker: APA


text: Our Chief Executive officer is the sole member of our Board of Directors, and he is responsible for oversight of cybersecurity risk. Our Chief Executive Officer, along with our President and Chief Operations Officer, who are currently our only other employees, are responsible for the ongoing managing and assessing of our cybersecurity practices and reporting on such practices and risks. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Board of Directors and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken. We believe we are appropriately staffed (as supported by IT consultants and service providers, as needed) to support a healthy cybersecurity posture given our Company's size and scope.

companyName: GenFlat Holdings, Inc.

ticker: GFLT


text: The Corporation maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats. The Corporation's cybersecurity program is based on the Federal Financial Institutions Examination Council ("FFIEC") framework which tailors the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to be more financial services focused. The risk of cybersecurity threats is integrated into its Enterprise Risk Management ("ERM") program, led by the Corporation's Chief Risk Officer. The ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the "CITSO"), the VP of Information Technology, and the VP of Information Security. Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity. Management also assesses the cybersecurity proficiency of potential third-party suppliers before utilizing their services. The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services. The Corporation reassesses all suppliers on a regular interval.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: Cybersecurity risk management is integrated into our overall enterprise risk management program ("ERM Program") and our cybersecurity, legal, infrastructure, privacy and other cross-functional teams work together to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risk management is also integrated into our broader risk management framework through information technology general controls that are independently tested by our Internal Audit team and the findings reported to the Audit Committee.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Our Information Security function is overseen by our Chief Technology Officer ("CTO"), our information security team, security management, engineering operations, legal, risk management, and various third-party service providers, including our virtual Chief Information Security Officer ("vCISO"). In doing so, they identify, assess and manage the Company's cybersecurity threats and risks, using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, coordinating with law enforcement concerning threats, conducting internal and/or external audits and threat assessments for internal and external threats, utilizing third-party threat assessments, conducting threat and vulnerability assessments, using external intelligence feeds, and using third parties to conduct tabletop incident response exercises and other tests.

companyName: Definitive Healthcare Corp.

ticker: DH


text: The board of directors and audit committee receive periodic reports concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The board of directors and audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Nuvation Bio Inc.

ticker: NUVB


text: Following these risk assessments, if necessary, we would re-design and implement reasonable additional safeguards to minimize identified risks and address any identified gaps in existing safeguards.

companyName: Verde Clean Fuels, Inc.

ticker: VGAS


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.

companyName: RENASANT CORP

ticker: RNST


text: Index to Financial Statements We have implemented devices designed to control third-party access to our plant systems and also provide 24/7 monitoring of our infrastructure.

companyName: Kinetik Holdings Inc.

ticker: KNTK


text: At the management level, our cybersecurity team is led by the head of our information technology team, who is responsible for assessing and managing material risks from cybersecurity threats, including the prevention, mitigation, detection, and remediation of cybersecurity incidents, and is a member of our incident response team. Our cybersecurity team has relevant academic degrees, multiple certifications, and real-world experience managing cybersecurity incidents and risks. The head of our information technology team has over 20 years of experience in information technology and cybersecurity, including previous employment as the chief information officer of multiple entities. Our broader cybersecurity team includes specialists that collectively have over 50 years of experience in information technology and/or cybersecurity and is supported by independent contractors. Our cybersecurity team works collaboratively to identify, assess and manage cybersecurity incidents and risks and implements and maintains centralized cybersecurity practices in coordination with senior leadership and cross functionally with other teams across the Company.

companyName: OLAPLEX HOLDINGS, INC.

ticker: OLPX


text: See the section titled Item IA. Risk Factors, including "Our business is dependent upon the proper functioning of our internal business processes and information systems. The modification, change of, or interruption of such systems may disrupt our business, processes and internal controls," for additional information about the risks from cybersecurity threats that may materially affect our business.

companyName: Mediaco Holding Inc.

ticker: MDIA


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity Governance reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity Governance has over 15 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, such as legal counsel, cybersecurity consultants, forensic investigators, and cybersecurity software providers.

companyName: Vera Therapeutics, Inc.

ticker: VERA


text: The Company's Head of Information Technology, in coordination with the Board and audit committee, works collaboratively across the Company to implement and execute a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery approach. To facilitate the success of the Company's cybersecurity risk management program, the Company's Head of Information Technology and his team monitor the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time and, when necessary, report such threats and incidents to the Board. The Head of Information Technology has served in various roles in information technology and information security for over 20 years, including serving as the Head of Information Technology of another clinical-stage biopharmaceutical company. The Head of Information Technology holds undergraduate and graduate degrees in mathematics and computer information systems, respectively.

companyName: Cullinan Therapeutics, Inc.

ticker: CGEM


text: The CISO reports to the CIO and is principally responsible for overseeing the Program, in partnership with other business leaders across the Company including regional information security and technology officers. Our cybersecurity personnel maintain current knowledge through specific training programs, professional certifications, and participation in industry groups (e.g., Financial Services Sector Coordinating Council, Financial Services Information Sharing and Analysis Center, Analysis and Resilience Center, Securities Industry and Financial Markets Association, Cybersecurity and Infrastructure Security Agency, etc.).

companyName: AMERICAN INTERNATIONAL GROUP, INC.

ticker: AIG


text: Our cybersecurity risk management program, which is part of our enterprise risk management program, aims to identify risks related to the Company, including risks from cybersecurity threats. Our cybersecurity risk management program includes a number of components, including informal self-assessments and audits, penetration testing, and vulnerability assessments, that are conducted periodically by both internal and external resources. The Company also analyzes current and emerging cyber threats that pose a risk to the organization using various threat intelligence tools and services.

companyName: X4 Pharmaceuticals, Inc

ticker: XFOR


text: The CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CTO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Third-Party Risks: We rely on third-party service providers and vendors which exposes the Company to cybersecurity risks associated with systems and processes. A breach or failure in critical systems could impact operations and reputation.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: This information security program is a key part of our overall risk management system, which is administered by our Chief Risk Officer. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. These security and privacy policies and procedures are in effect across all of our lines of business and geographic locations.

companyName: HBT Financial, Inc.

ticker: HBT


text: Based on an assessment using the previously described cybersecurity risk management processes, we do not believe that there are currently any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: The Company utilizes a hybrid platform consisting of a local and cloud environment. Our local environment connects to the cloud environment via an encrypted virtual private network ("VPN") connection. Our Site-to-Site connection consists of a firewall in our local environment which responds to a connection from a firewall in our cloud. Our networks have segregated subnets, and only allow designated staff access to our cloud environment, which is only accessible from one of our local office segments. All firewalls are configured with intrusion detection systems and intrusion prevention systems, strict firewall rules, denial of service, spoof protection, advanced threat protection, and zero-day protection. Our firewalls are configured to receive definition updates as they are released, and firmware updates are automatically installed when available. We secure our local network by not utilizing any wireless access points connected to any of our networks or firewalls, enabling port security on switches, following a principle of least privilege policy, and implementing Security Information & Event Management ("SIEM") to capture all network traffic & security events from both networking equipment, endpoints, and servers. We enforce a strict password policy with multi-factor authentication.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: The Company recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. The Board, primarily through its Risk Committee, provides direction and oversight of the enterprise-wide risk management framework of the Company, and cybersecurity represents a component of the Company's overall approach to enterprise-wide risk management. The Company's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Management IT Examination Handbook, FFIEC Cybersecurity Assessment Tool, and GLBA 501(b). In general, the Company addresses cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.

companyName: FIRST BANCORP /NC/

ticker: FBNC


text: We maintain systems that are designed to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity. As part of our risk management processes, we also perform penetration testing using third-party vendors, conduct periodic cybersecurity awareness training for employees, deploy phishing test campaigns, maintain containment and incident response tools, and periodically review, update and enhance our Cybersecurity Incident Response Plan.

companyName: RESOURCES CONNECTION, INC.

ticker: RGP


text: Blackstone has a dedicated cybersecurity team, led by Blackstone's CSO, who works closely with Blackstone senior management, including Blackstone's Chief Technology Officer ("CTO"), to develop and advance the firm's cybersecurity strategy, which applies to BREIT.

companyName: Blackstone Real Estate Income Trust, Inc.

ticker: BSTT


text: As part of our information technology needs, we have contracted with NBP to provide certain equipment and services related to telephone systems, servers, network access, desktop and end-user support, and back-office equipment support. Inherent in the services provided by NBP are its efforts to assess, identify and manage risks from cybersecurity threats related to the specific equipment and services it provides us. We have no independent internal processes for addressing cybersecurity threats and have not integrated any processes provided by NBP in assessing, identifying and managing risks from cybersecurity threats into our overall risk management system; however, we receive and review monthly reports from NBP on user access changes to our electronic accounting file share folder and address any concerns immediately.

companyName: U. S. Premium Beef, LLC


text: The Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company's incident response plan and related processes. The Company's Information Technology Manager is also informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to notification criteria set forth in the Company's contracts with third-party service providers. Further, the Company's Information Technology Manager is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to reports prepared by consultants, auditors, and other third parties retained by the Company, if necessary, to investigate cybersecurity incidents.

companyName: Sow Good Inc.

ticker: SOWG


text: In addition, the Audit and Technology Committees of the Board coordinate on risk management oversight with respect to cybersecurity, including through quarterly joint meetings that cover the following topics: • Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan • Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items • Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity The Technology Committee of the Board oversees our information security program, including: • Reviewing with management our technology investments and infrastructure associated with risk management, including policies relating to information security, disaster recovery and business continuity • Receiving quarterly reports directly from our CISO, including updates on our enterprise cybersecurity threat level • Overseeing the engagement of outside advisors to review our cybersecurity program • Reviewing the results of our annual information security program maturity assessment performed by a third party • Reviewing the results of our annual security program risk assessment prepared by management Management Oversight of Cybersecurity Risk Our information security program is managed through implementation, monitoring and continuous improvement of the security program with active participation of management as described below. • Senior Leadership Team. The Equifax senior leadership team, consisting of our CEO and his direct reports ("SLT"), sets the tone for strategic growth, effective operations and risk mitigation at the management level. The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues. The SLT has overall managerial responsibility for confirming that the information security program functions in a manner that meets the needs of Equifax. • Chief Information Security Officer. Equifax has a CISO who is a member of the SLT and reports directly to our CEO. Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies. Our CISO is responsible for oversight of the global Security team and the implementation and execution of the information security program. Our CISO helps ensure that the program is strategically aligned to Equifax's business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors. • Global Security Team. The Equifax global Security team is responsible for supporting the CISO in the execution of the information security program to meet the program's objectives. The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.

companyName: EQUIFAX INC

ticker: EFX


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment, and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Cybersecurity matters are overseen by our board of directors, which meets quarterly to review the measures implemented by the Company to identify and mitigate cybersecurity risks. Our chief information security officer ("CISO") reports to the board quarterly on cybersecurity matters. These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company's cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer and Chief People Officer. In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors. In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.

companyName: MAGNITE, INC.

ticker: MGNI


text: Our Enterprise Risk Management Committee includes a cross-functional team including the Chief Executive Officer, CIO, Chief Financial Officer and the General Counsel as members who are well versed in risk management. In addition, the Enterprise Cybersecurity Committee includes the CIO, CISO, and Vice Presidents who have the relevant risk management and cybersecurity expertise. The Cybersecurity and Information Services department is led by the CISO and includes cyber professionals who have the relevant cybersecurity expertise. The CISO reports to the CIO and has over 20 years of experience, a graduate degree and several certifications in the field of cybersecurity. Material risks are managed and monitored by persons or committees with relevant expertise and experience.

companyName: EXPEDITORS INTERNATIONAL OF WASHINGTON INC

ticker: EXPD


text: Management consistently assesses, monitors and manages our cybersecurity practices to align with the evolving threat landscape. Our cybersecurity risk management efforts are designed to protect the Company's information systems from cybersecurity threats and to appropriately respond to any threats or incidents. Through ongoing communications, management and other applicable personnel monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee and the Board, as appropriate.

companyName: WillScot Holdings Corp

ticker: WSC


text: The consequences of prior cybersecurity incidents we have encountered have not materially affected our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions and the occurrence of a significant cybersecurity incident could have a substantial negative impact on us. See Item 1A. Risk Factors — Technology and Cybersecurity Risks for additional discussion.

companyName: StoneX Group Inc.

ticker: SNEX


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, engineering, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.

companyName: Trade Desk, Inc.

ticker: TTD


text: Our program and team of cybersecurity professionals and resources is led and supervised by our Vice President of Information Technology, who has over 25 years of experience in information technology. To execute the program, we utilize internal and external technical experts in cybersecurity risk management, data and network security structures, incident response and security operations, and laws, regulation, and reporting requirements. Our cybersecurity team monitors the prevention, detection, mitigation, management, and remediation of cybersecurity risks and incidents through various means, which may include briefings with internal security personnel threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment. As part of the program, our executive management team is regularly informed about the monitoring, prevention, detection, mitigation, management, and remediation efforts.

companyName: DAKTRONICS INC /SD/

ticker: DAKT


text: The ISO has served in various roles in information technology and information security for over 21 years and holds a Bachelor of Science degree in Management Information Systems from Auburn University. The ISO is also a graduate of the Alabama Banking School of the University of South Alabama. The ISO also holds multiple professional certifications, including specialized certifications in vendor risk management and community banking technology.

companyName: Southern States Bancshares, Inc.


text: Equinix does not generally engage any consultants, auditors, or other third parties in connection with processes for assessing, identifying and managing risks from cybersecurity threats other than the technology risk consultant identified above.

companyName: EQUINIX INC

ticker: EQIX


text: Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Cybersecurity Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: The Electronic Data Processing ("EDP") Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors. The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives. The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings. In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.

companyName: FARMERS & MERCHANTS BANCORP

ticker: FMCB


text: The Board of Directors, directly and through the Audit Committee, actively engages in reviews of cybersecurity risks. The full Board of Directors meets with the Company's Vice President of Information Technology and Director of IT Infrastructure and Security at each of the Board's regularly scheduled meetings to discuss the Company's cybersecurity posture, including malicious activity experiences and vulnerabilities for potentially material cybersecurity threats and incidents. The results of disaster recovery exercises, penetration testing, and other external audits are also presented to the Board. The Audit Committee is responsible to review and evaluate the Company's cybersecurity and other information technology controls and procedures, including the Company's plans to mitigate cybersecurity risks and to respond to threats. In addition to being represented on the oversight committee under the Incident Response Plan, the Audit Committee meets regularly with the Company's information technology leadership team and reviews with them any specific cybersecurity issues that could affect the adequacy of the Company's internal and disclosure controls.

companyName: SIGMATRON INTERNATIONAL INC


text: To manage our cyber risk, we have engaged in a third-party service provider who is responsible for upgrading software and hardware to those with the greatest security protections. We also utilize multi-factor authentication processes for system access. Our data is stored on secure servers and protected by encryption by our providers. Our credit card sales are processed through one of the larger payment processing companies in the U.S. As such, we do not maintain any personal data in our systems.

companyName: Vystar Corp

ticker: VYST


text: Role of the Board Our Board is primarily comprised of US nationals. The Risk and Sustainability Committee of the Board, is responsible for the review and oversight of issues related to the key technology risks facing the Company, including, but not limited to, the Company's programs, policies, practices and safeguards for information technology, data privacy and protection, cybersecurity and fraud, identification, assessment, monitoring, mitigation and the overall management of those risks, and the Company's cyberattack incident response and recovery plan. The Risk and Sustainability Committee receives standing quarterly updates from the Global CISO and CIO on, among other things, our divisional and Group-wide cyber risks, divisional progress on cyber initiatives, external insights, incident updates and post incident reviews, our cyber strategy and our views of the emerging threat landscape.

companyName: Flutter Entertainment plc

ticker: FLUT


text: At the management level, our Vice President, IT Security leads our enterprise-wide cybersecurity program and is primarily responsible for assessing and managing our material risks from cybersecurity threats. In performing his role, the Vice President, IT Security monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents and is a key stakeholder and participant in the Company's cybersecurity and privacy incident reporting framework described above. Our Vice President, IT Security reports to our CIO who, in turn, reports to our Chief Financial Officer.

companyName: SANMINA CORP

ticker: SANM


text: Our Board is advised of key cybersecurity matters through high-level briefings, ensuring strategic alignment and informed oversight of our cybersecurity endeavors. The Company's officers, along with the executive team, play a pivotal role in the dynamic landscape of cybersecurity risk management. This committee is not only responsible for the ongoing assessment and management of cybersecurity risks but also ensures that strategic cybersecurity initiatives are integrated within the broader operational framework of our Company.

companyName: PAID INC

ticker: PAYD


text: Through the policies, plans, guidelines and processes the Company has implemented, any material cybersecurity incident would be reported to our executive officers as well as the Audit Committee and/or the Board.

companyName: EQC Liquidating Trust


text: Our business involves the storage, transmission, and processing of a large quantity of customer data, including confidential and sensitive information. Our management team and Board recognize the significance of maintaining the trust of our customers and business partners, including the importance of managing cybersecurity risks as part of our larger risk management strategy. While everyone at our company plays a part in managing these risks, oversight responsibility for cybersecurity is shared by our management team and our Board, including its Audit Committee.

companyName: SMARTSHEET INC


text: The CISO and Senior Director of Engineering are each responsible for helping to integrate cybersecurity risk considerations into NetScout's overall risk management strategy and communicating key priorities to relevant personnel. The CISO and Senior Director of Engineering are also responsible for helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: NETSCOUT SYSTEMS INC

ticker: NTCT


text: In addition, our Board of Directors (the "Board") will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.

companyName: Western Uranium & Vanadium Corp.

ticker: WSTRF


text: Our business strategy, results of operations and financial condition have not been affected by risks from cybersecurity threats, however, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors under " Our solutions or products or our third-party cloud providers have experienced in the past, and could experience in the future, data security breaches, which could adversely impact our reputation, business, and ongoing operations".

companyName: Roadzen Inc.

ticker: RDZN


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. The Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our CDIO and CISO meet with the Audit Committee on a quarterly basis and provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape. Our head of ERM also meets with our executive management team and the Audit Committee on a quarterly basis and with the Board of Directors on an annual basis and reports on applicable cyber risk management processes and activities pertinent to the ERM function.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: As of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents since the ransomware incident in the fourth quarter of fiscal 2019 described under "Our operations are subject to cyberattacks that could have a material adverse effect on our business" in Part I, Item 1A of this Report, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks, and there can be no guarantees that such attacks will not occur in the future.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Board of Directors' overall risk oversight function includes receiving reports on the Company's cybersecurity risks and our risk management processes, and assessing whether our risk management strategies are reasonably designed to address such risks. The Board has delegated this oversight responsibility to our Audit Committee, which reports periodically to the Board as appropriate.

companyName: CIRRUS LOGIC, INC.

ticker: CRUS


text: Our board of directors, in coordination with our audit committee, oversees our ERM process, including the management of cybersecurity risks, and is responsible for monitoring and assessing strategic risk exposure. Our management team and its committees, including our ERC, our CITF, our SIRT, and our core information security operational teams, in partnership with our engineering teams, are responsible for the day-to-day management and mitigation of the material cybersecurity risks we face.

companyName: TWILIO INC

ticker: TWLO


text: Implementation of the IR Plan requires cross-functional efforts from across the organization. The roles/functions involved and the related responsibilities in enforcing the IR Plan are spread across the entire organization of the Bank's senior.

companyName: ESSA Bancorp, Inc.


text: The Nominating and Corporate Governance Committee of our Board of Directors is responsible for overseeing cybersecurity risk management processes, including oversight and mitigation of risk from cybersecurity threats. The Nominating and Corporate Governance Committee receives reports from the CIO, Chief Financial Officer ("CFO") or their designee concerning the Company's material cybersecurity risks and the processes the Company has implemented in an effort to mitigate them.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council (FFIEC) Information IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool (CAT), Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology Cybersecurity Framework (CSF), 12 CFR Appendix B to Part 30 - Interagency Guidelines Establishing Standards for Safety and Soundness Gramm-Leach-Bliley Act (GLBA) 501(b).

companyName: LAKE SHORE BANCORP, INC.


text: The CIMT is supported by a dedicated Cybersecurity Incident Response Team ("CIRT"), comprised generally of security and networking team members with responsibilities to monitor and assess events, cybersecurity incidents, and technical activities throughout our organization. Our CIRT members possess critical skill sets, experience, and competencies related to the management of cybersecurity risks and matters. In particular, our VP - IT has over 29 years of experience in the field of information systems and cybersecurity and leads an experienced security and networking team with 71 years of additional combined experience in developing and executing cybersecurity strategies. Our CIRT members also hold over 31 certifications in risk and information security from organizations such as International Information System Security Certification Consortium (ISC2), The SANS Institute, Global Information Assurance Certification (GIAC), CompTIA and Cisco, including Certified Information Systems Security Professional (CISSP), GIAC, Certified Incident Handler Certification (GCIH), GIAC Critical Controls Certification (GCCC), GIAC Continuous Monitoring Certification (GMON), SANS Security Awareness Professional (SSAP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Auditor (CISA).

companyName: Coterra Energy Inc.

ticker: CTRA


text: We recognize the importance of assessing, identifying, and managing material risks associated with cyber security threats, as such term is defined in Item 106(a) of Regulation S-K. We have certain processes for assessing, identifying and managing cyber security risks, which are built into our overall information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, and protect employee information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards and routine review of our policies and procedures to identify risks and refine our practices. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: TOMI Environmental Solutions, Inc.

ticker: TOMZ


text: Cybersecurity risk management is part of our Board of Directors' general oversight function, which includes oversight of the cybersecurity risk management program and any identified cybersecurity risks and incidents. To facilitate its oversight, the Board of Directors receives regular updates from management on cybersecurity.

companyName: Axos Financial, Inc.

ticker: AX


text: Our Audit Committee is provided with regular updates from management concerning cybersecurity developments, significant cybersecurity threats, risks and processes implemented to address these risks. Our Audit Committee receives presentations on cybersecurity topics from management as part of the Committee's continuing education on topics that impact the Company. Furthermore, management informs the Audit Committee as deemed necessary, about any notable cybersecurity incidents.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Our cross-functional cybersecurity teams are responsible for addressing both enterprise and product cybersecurity risks. These teams, which are comprised of experts both within the organization and externally, utilize a defensive cybersecurity strategy with multiple layers of cybersecurity controls to protect our data (and data of others in our possession), systems and products.

companyName: Aptiv PLC

ticker: APTV


text: The Company maintains a cyber risk management program designed to assess, identify, manage, mitigate, and respond to cybersecurity threats and incidents. The cyber risk management program is integrated into the Company's overall enterprise risk management ("ERM") program. The ERM program is designed to provide cross-functional board and executive insight across the business to identify and monitor risks, opportunities and emerging trends that can impact the Company's strategic business objectives.

companyName: CORE MOLDING TECHNOLOGIES INC

ticker: CMT