text: While to date TEC has not detected a significant compromise of its cybersecurity systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that TEC could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "TEC is exposed to potential risks related to cyberattacks and unauthorized access, which could cause system failures, disrupt operations or adversely affect safety" for a further discussion of risks related to cybersecurity.

companyName: TAMPA ELECTRIC CO


text: The Company depends on and engages various third parties, including suppliers, vendors, and service providers, to operate its business. The Company relies on the expertise of risk management, legal, information technology, and compliance personnel of the Adviser when identifying and overseeing risks from cybersecurity threats associated with its use of such entities. The Company's Chief Compliance Officer ("CCO") also plays an oversight role in the area of cybersecurity preparedness with respect to these entities.

companyName: Barings BDC, Inc.

ticker: BBDC

secItem: Item 1C


text: Our Vice President of Information Technology, as head of our information technology team, leading our cybersecurity efforts, oversees the day-to-day administration of our cybersecurity program. Our CIRT has members that include our Chief Executive Officer, Chief Financial Officer, Vice President, Corporate & Securities Law, and Vice President of Information Technology. As key members of our management team, our Chief Executive Officer, Chief Financial Officer, and Vice President of Information Technology have approximately a combined 48 years of risk management experience and are responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Key members of our information technology management team collectively possess over 16 years of hands-on experience in implementing a diverse array of cybersecurity initiatives. Their expertise spans both cloud and on-premise IT infrastructure and applications/systems, cultivated through extensive engagement across various regulated environments.

companyName: Coherus Oncology, Inc.

ticker: CHRS


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this report. However, companies like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of cyber actors.

companyName: VAPOTHERM INC


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks resulting from cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 50 years of technology risk and cybersecurity work experience supporting multiple life science organizations.

companyName: TELEFLEX INC

ticker: TFX


text: Hanover recognizes that risk is an intrinsic aspect of all areas of our business and activities. Effective risk management is vital to our success. A comprehensive risk management approach is fundamental to maintaining the trust of our customers and the efficacy of our financial services.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: The Cybersecurity Governance Committee is led by the CISO and includes cybersecurity managers and other subject matter experts as standing members. The Cybersecurity Governance Committee is tasked with developing, implementing, and maintaining the Cybersecurity Program. The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with the Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, the General Counsel, and the Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the 2019 Cybersecurity Incident, have materially affected our overall business strategy, results of operations, or financial condition. For further discussion of cybersecurity, and related risks for our business, see "Item 1A. Risk Factors" under the headings "We face risks related to our operational, technological and organizational infrastructure," and "A cyber-attack or other security incident on us or third parties (including their supply chains) with which we conduct business, including an incident that results in the theft, loss, manipulation or misuse of information (including personal information), or the disabling of systems and access to information critical to business operations, may result in increased costs, reductions in revenue, reputational damage, legal exposure and business disruptions."

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We have developed and implemented a cybersecurity program to manage the confidentiality, integrity and availability of our data and information systems that support our business. The program is aligned with the National Institute of Standards and Technology Cybersecurity Framework 2.0 and is integrated into our overall risk management program. It is designed to develop appropriate strategies for preserving the confidentiality, integrity and availability of our data and information systems that can evolve with the changing cybersecurity threat landscape. We have implemented policies, procedures and technological tools to prevent, detect and mitigate cybersecurity risks posed by third parties.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We rely heavily on third-party suppliers and vendors, and a cybersecurity incident at one of our suppliers or vendors could have a material adverse impact on our business operations. We evaluate third-party cybersecurity risk controls through various assessment activities carried out by LP employees and by third-party service providers acting on our behalf. We engage an independent third party to conduct a biennial Security Program Assessment under the National Institute of Standards and Technology Cybersecurity framework. For incident alerts and response, we outsource around-the-clock coverage to a third-party managed service provider who provides timely alerting and notification of potential cybersecurity issues. In 2023, we also engaged a specialized third-party assessor to perform an operational technology security assessment for a subset of our manufacturing facilities. We continually work with third-party experts to advise on new threats and cybersecurity strategy best practices for specific capabilities.

companyName: LOUISIANA-PACIFIC CORP

ticker: LPX


text: We utilize various securities tools and technologies designed to prevent, identify, protect, detect, escalate, respond and recover from cyber threats in a timely manner. Our approach includes real-time monitoring, threat analysis, and regular security evaluations to identify and mitigate potential vulnerabilities.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: As part of its risk-based strategy, the Company maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls based on changes to the technical or regulatory environment. The Company also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities. The Company participates in various information-sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation, retail and hospitality and other critical infrastructure sectors. The Company regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs for its CDR members.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: For additional information regarding the risk we face from cybersecurity threats, please see the risk factor titled "Our information systems may experience an interruption or breach in security and cyber-attacks, all of which could have a material adverse effect on our business." included in Part I. Item 1A. - Risk Factors of this report.

companyName: OLD SECOND BANCORP INC

ticker: OSBC


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable and unacceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a IT Management, and / or member of the Information Security Team, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Chief Risk Officer (CRO) and/or Information Security Officer in accordance with the Cybersecurity Incident Response Plan (CIRP).

companyName: COMMUNITY WEST BANCSHARES /


text: Oversight of cybersecurity matters is the responsibility of the Risk & Compliance Committee, which is a board committee, with oversight from the Board of Directors.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: We retain a third-party technology solutions firm (IT Firm) to help identify, assess and manage the Company's cybersecurity threats and risks. The IT Firm reports to an employee who functions as our IT lead (IT Lead) and who works with our management team, including our Principal Financial Officer (PFO). Our IT Firm identifies and, in conjunction with our IT Lead, helps assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods and tools.

companyName: Sensei Biotherapeutics, Inc.

ticker: SNSE


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences."

companyName: Fastly, Inc.

ticker: FSLY


text: Our cybersecurity policies, standards, processes and practices are based on applicable laws and regulations and informed by industry standards and industry-recognized practices. Our strategy to assess, identify, and manage material cybersecurity risks is through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security, and availability of our information systems and data. We implement security measures and processes to identify, prevent, and mitigate cybersecurity threats and to effectively respond to cybersecurity incidents when they occur. Our cyber risk management includes: (1) enterprise risk management to identify top cybersecurity risks; (2) vulnerability management to identify software vulnerabilities and risks related to compute infrastructure; (3) vendor risk management to identify risks related to third parties and business partners, which includes pre-engagement review, use of contractual security provisions, and continued monitoring, as applicable; (4) privacy risk management to identify privacy risks in our product and platforms and ensure regulatory compliance; (5) security monitoring to analyze and assess threat activity in real time; and (6) security incident response to investigate, respond to, and mitigate cyber threats. We regularly engage third parties to identify risks in our underlying software and infrastructure, to provide threat intelligence, and to assist in triaging, identifying, and responding to cyber threats.

companyName: Nextdoor Holdings, Inc.

ticker: NXDR


text: You should carefully review Part I, Item 1A. "Risk Factors" of this Form 10-K for a discussion of the risks to the Company related to cybersecurity.

companyName: AVALONBAY COMMUNITIES INC

ticker: AVB


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While the Company has taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A, Risk Factors of this Annual Report on Form 10-K.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Dow has established cybersecurity and information security awareness training programs. Formal training on topics relating to the Company's cybersecurity, data privacy and information security policies and procedures is mandatory at least annually for all employees, contractors and third parties with access to the Company's network. Training is administered and tracked through online learning modules. Training topics include how to escalate suspicious activities including phishing, viruses, spams, insider threats, suspect human behaviors or safety issues. Based on role and location, some employees receive additional in-depth training to provide more comprehensive knowledge on potential risks related to their individual job responsibilities. Training is supplemented through regular Company communications with frequent updates to educate on the latest adversary trends and social engineering techniques.

companyName: DOW INC.

ticker: DOW


text: USL does not have computer systems or networks. Pursuant to the terms of the LP Agreement, USL's affairs are managed by USCF. USCF has implemented an information security program that is focused on ensuring the security and protection of computer systems and oversight of third-party service providers. This program includes specific provisions pertaining to data security and the security of information that, if disclosed, could have detrimental effects on USL. Such provisions relate to the handling of information and computers, as well as the protection of computer systems and software from unauthorized persons. USCF engages a third-party consultant and service provider to assist with information technology services and advise on USCF's information technology infrastructure. As needed, but no less frequently than annually, USCF evaluates its cybersecurity risk profile in accordance with its compliance policies and procedures. To mitigate the risks from cybersecurity threats posed by third parties, USCF conducts due diligence on its critical third-party service providers with respect to (1) the cybersecurity programs and policies that they have in place as well as how they safeguard sensitive information, and (2) how those programs and policies apply to customers, including USCF and USL.

companyName: United States 12 Month Oil Fund, LP

ticker: USL


text: The program is managed and monitored by a dedicated security team, which is led by our Chief Security Officer and includes mechanisms, controls, technologies, systems, policies and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the systems and data residing in them. For example, we conduct risk-based penetration and vulnerability testing and ongoing risk assessments, including due diligence on our key technology vendors and other contractors and suppliers. We also conduct employee trainings on cyber and information security, among other topics. In addition, we consult with outside advisors and experts to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on the Company's risk environment.

companyName: PINTEREST, INC.

ticker: PINS


text: For additional information about cybersecurity risks, see Risk Factors, Any significant disruption in or unauthorized access to our computer systems or those of third-parties that we utilize in our operations, including relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, harm to our reputation, disclosure or destruction of data, or theft of intellectual property, including digital content assets, which could adversely impact our business.

companyName: Cineverse Corp.

ticker: CNVS


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments and penetration testing designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers such as forensic analysts, third party security reviewers, and other consultants such as outside counsel, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based on our assessment of their criticality to our operations and respective risk profile.

companyName: DXC Technology Co

ticker: DXC


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a combination of third-party assessments, internal audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: proactively review systems and applications, audit against applicable data security policies, perform penetration testing to test security controls, encourage proactive vulnerability reporting, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: TrueCar, Inc.


text: We maintain an Incident Response Policy that provides a documented framework for bringing together and organizing the resources for dealing with any event that harms or threatens the security of information. The goal of the Incident Response Policy is to facilitate a quick and efficient response to incidents, and to limit their impact while protecting information assets. The plan defines roles and responsibilities, documents the steps necessary for effectively and efficiently managing an information security incident, and defines channels of communication. The Information Security Officer and Chief Information Officer coordinate investigations of potential cybersecurity incidents.

companyName: CITY HOLDING CO

ticker: CHCO


text: The Company has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Oncotelic Therapeutics, Inc.

ticker: OTLC


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See Item 1A, "Risk Factors," in this annual report on Form 10-K, including the risk factors entitled "Cybersecurity breaches, cyberattacks and other disruptions to information technology systems could disrupt our operations, compromise the confidentiality of our data or our intellectual property, and adversely affect our business, reputation, operations and financial results" and "Our business may be impacted by information technology system failures or network disruptions and lack of redundancy" in this Annual Report on Form 10-K for additional information about our cybersecurity-related risks.

companyName: Credo Technology Group Holding Ltd

ticker: CRDO


text: The Cybersecurity Committee, which originated in 2015 as a dedicated cybersecurity subcommittee of the Audit Committee, assists the Board in its oversight of the Company's cybersecurity programs and risks. Its responsibilities include reviewing the state of the Company's cybersecurity, its strategy, policies, and procedures to mitigate cybersecurity risks, and any significant cybersecurity incidents. The Committee also considers the cybersecurity threat landscape and the impact of emerging cybersecurity developments and regulations that may affect Howmet. The Cybersecurity Committee currently comprises two members and meets at least quarterly with members of management, including the CISO and CIO. The Cybersecurity Committee may, from time to time, invite third-party advisors and experts as it deems appropriate. Pursuant to guidelines adopted by the Cybersecurity Committee, management is required to report immediately to the Chair of the Cybersecurity Committee upon the occurrence of certain cybersecurity incidents and ransomware demands. The Cybersecurity Committee reports to the full Board after each of its meetings and as needed regarding the cybersecurity risks, incidents and other matters reviewed and considered by the Committee.

companyName: Howmet Aerospace Inc.

ticker: HWM


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats the event of a cybersecurity incident, we maintain a regularly tested incident response program. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat, and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity containment and remediation efforts.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We maintain a cybersecurity program designed to protect our company, company data, customer data and personal data within information systems used by the Company. In order to respond to potential cybersecurity threats, we maintain policies, procedures and systems that provide for controls on detecting and addressing cybersecurity threats, including a formal incident response plan. We also maintain business continuity and disaster recovery capabilities, which we test regularly.

companyName: MATERION Corp

ticker: MTRN


text: Cybersecurity represents an important component of the Company's overall approach to enterprise risk management and is integrated into the risk management process and ongoing assessment. In addition to an internal security program, we strive to stay ahead of the threat landscape by actively monitoring and conducting due diligence on key third-party vendors' Information Security programs and risks. This includes qualitative assessments to gain a deeper understanding of their security posture and potential vulnerabilities. We make strategic investments in our perimeter and internal defenses, cyber security operations center, and regulatory compliance activities with the advice of consultants and third parties. Moreover, to minimize risk, we maintain an insurance policy that provides coverage for matters relating to Information Security.

companyName: Vistra Corp.

ticker: VST


text: Our business involves the storage and transmission of a significant amount of confidential and sensitive information. As a result, we take the confidentiality, integrity, and availability of this highly sensitive information seriously and invest significant time, effort, and resources into protecting such information. Our cybersecurity strategy was designed with the foregoing principles in mind and prioritizes detecting and responding to threats and effective management of security risks.

companyName: APPFOLIO INC

ticker: APPF


text: The Board, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of our Board, which is composed of all non-employee directors, is responsible for oversight of our efforts to eliminate cybersecurity risks. The Audit Committee meets regularly with our Chief Executive Officer and Chief Financial Officer and, in turn, reports its finding to the Board.

companyName: Grom Social Enterprises, Inc.


text: We are a special purpose acquisition company with no business operations. Since our IPO, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Spark I Acquisition Corp

ticker: SPKL


text: Governance and Risk Management The entire Board of Directors has oversight of risks from cybersecurity threats and receives periodic updates on such risks from the Company's management, including from the Company's President and CEO and its Senior Vice President - Chief Information Security Officer (CISO).

companyName: BERKLEY W R CORP

ticker: WRB


text: The cybersecurity team, managed by the SVP of IT Enterprise Strategy and Execution, (i) receives oversight and executive support through engagement with our ERC, which is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile and (ii) collaborates with our ERM function on business alignment and cybersecurity insurance procurement.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: Our IT Infrastructure & Operations team manages the day-to-day administration of our cybersecurity program. We also work with a managed security service provider to monitor for vulnerabilities and threats, which are reported to the IT Infrastructure & Operations team and up to the CIO and other members of senior management, where appropriate. We engage employees in our cybersecurity efforts through a quarterly process for employees to complete security and awareness training as well as periodic simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.

companyName: REPLIGEN CORP

ticker: RGEN


text: Security events and data incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational, business, and privacy impact.

companyName: Toughbuilt Industries, Inc


text: Upon detection of a cybersecurity threat, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes, as well as the steps management has taken to respond to such risks. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, is managed by our Chief Financial Officer and supported by consultants with experience in managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs as needed. As discussed above, the Chief Financial Officer reports to our board of directors about material cybersecurity threat risks.

companyName: GRI Bio, Inc.

ticker: GRI


text: Our Board of Directors is ultimately responsible for overseeing and reviewing with management the Company's cybersecurity risks and the policies and practices established to manage such risks. In that effort, the Board delegates these responsibilities to the Audit Committee. The Audit Committee receives a cybersecurity update at each of its quarterly meetings from our Senior Vice President, Chief Information Officer ("CIO") or management. These updates address a range of topics, including updates on technology trends, policies and practices, and specific and ongoing efforts to prevent, detect and respond to internal and external critical threats.

companyName: SOMNIGROUP INTERNATIONAL INC.

ticker: SGI


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT Department works with management in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Quince Therapeutics, Inc.

ticker: QNCX


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition

companyName: DIH HOLDING US, INC.


text: Cybersecurity risk management is a part of our risk management process and is subject to oversight by our Board of Directors and management. Our Board of Directors has delegated oversight and mitigation of risks from cybersecurity threats to our Audit Committee. Our Audit Committee receives quarterly reports from either our CIO or our General Counsel concerning any significant cybersecurity threats, risks, and the tools and processes we have implemented for mitigation. Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of management, including the following: • The Information Security Executive Committee consists of our Legal Counsel, Chief Accounting Officer, Chief Compliance Officer, CIO, and Vice President of People & Culture. They are responsible for setting broad policy and communicating to the Chief Executive Officer, Chief Financial Officer, and the Board of Directors on potential material cybersecurity incidents that may require disclosure. • The Information Security Council consists of our CIO, the Senior Director of Information Security, in-house information security experts, and information technology experts and leaders from across the Company. The CIO leads this committee and communicates with the Information Security Executive Committee as required. • The Information Security Team consists of cybersecurity professionals primarily responsible for managing cybersecurity at Pursuit. This team has the primary responsibility for identifying, assessing, and managing material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware, software, and critical data. This team is led by our CIO, who has over 25 years of experience in information technology including cybersecurity oversight. This team includes the following: • The Senior Director of Information Security reports directly to the CIO and is an information security professional with over 20 years of experience in the development and implementation of information security processes, procedures, and practices. • The Senior Director of Global Infrastructure & Operations reports directly to the CIO and is responsible for implementing, maintaining, and providing oversight of the IT Infrastructure and the Information Security Team. • The Security Engineer leads the day-to-day operations of the Information Security Team and oversees individual analysts and IT experts on the team. • The Security Incident Response Team ("SIRT") is responsible for executing the IRP. The SIRT comprises individuals from multiple departments, divisions, and disciplines. Members of the SIRT are trained in incident response and reporting procedures.

companyName: Pursuit Attractions & Hospitality, Inc.

ticker: PRSU


text: We use third-party service providers to assist us in identifying, assessing, and managing material risks from cybersecurity threats, including professional service firms, legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, and forensic investigators. We have a Cybersecurity Incident Response Plan ("IRP") that includes procedures for responding to and, to the extent applicable, disclosing material cybersecurity incidents in a timely manner. We have third-party risk management processes designed to assess risks from key vendors and suppliers, including application providers and hosting companies. Key software service providers utilized by the Company undergo a review process for security, reliability, and effectiveness. We have processes in place to address access to our network by such third parties, to the extent applicable, including network access controls designed to provide access on a 'least privilege' basis.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: • Collaborative Approach The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. In the event the Company experiences a cybersecurity incident, it will take steps to contain, assess and remediate the incident. • Technical Safeguards The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our company or our stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: Role of Management Pursuant to our ERM Program charter, our Executive Committee is responsible for assessing and managing the Company's exposure to enterprise risks. The Executive Committee is composed of the CEO and members of senior management appointed by the CEO, including the CDIO. Our CDIO has delegated to our CISO and the cybersecurity teams primary responsibility for identifying, assessing, monitoring and managing our cybersecurity threats. They receive information regarding cybersecurity incidents and threats from the SOC and through internal escalation procedures detailed in the CIRP. The CISO then provides periodic reports to the Executive Committee, including reporting on significant cybersecurity incidents and resulting remedial actions, the cybersecurity team's strategic plan, the results of associate trainings, and any other notable cybersecurity matters.

companyName: Ferguson Enterprises Inc. /DE/

ticker: FERG


text: Information and cybersecurity risk management fall under the oversight of the Audit Committee. T he Audit Committee receives an annual review, followed by quarterly updates, of the Company's cybersecurity systems, enhancements, strategies and risk management efforts, and the Chair of the Audit Committee will be promptly notified of any material cybersecurity breach incident. In addition, the full Board reviews cybersecurity as part of its regular risk reviews. Linde has appointed a Global Chief Information Officer (CIO) reporting to the Chief Financial Officer (CFO). A Chief Information Security Officer reports to the CIO and is supported by a global IT security team.

companyName: LINDE PLC

ticker: LIN


text: We have not experienced any material risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. However, there can be no assurance that our cybersecurity risk management program and processes, including controls, systems and processes that we have or will in the future implement, will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See our risk factor titled "Our business could be negatively affected by security threats and disruptions, including electronic, cybersecurity or physical security threats, incidents and other disruptions."

companyName: Tamboran Resources Corp

ticker: TBN


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors, and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our business, our business strategy, our results of operations or financial condition. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. See Item 1A - "Risk Factors" for additional information.

companyName: EMERSON ELECTRIC CO

ticker: EMR


text: Risk Management and Strategy NewtekOne maintains an enterprise-wide risk-management ("ERM") framework to identify, measure, mitigate, monitor and report material risks to NewtekOne. Our ERM process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Board. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.

companyName: NewtekOne, Inc.

ticker: NEWT


text: Material Cybersecurity Incidents As of September 30, 2024, we were not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Bank, including its business strategies, results of operations or financial condition. For more information on our cybersecurity-related risks, see "Item 1A. Risk Factors – Risks Related to Cybersecurity, Third Parties, and Technology".

companyName: Capitol Federal Financial, Inc.

ticker: CFFN


text: The Director of IT, in collaboration with a team of IT professionals, our legal counsel and Human Resources, are tasked with implementing a program designed to protect our information systems from cybersecurity threats and manage material risks. The Director of IT has served in various roles in information technology and information security for over 20 years. The Director of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the audit committee when appropriate.

companyName: Scilex Holding Co

ticker: SCLX


text: The Company evaluates cybersecurity risks through its comprehensive Enterprise Risk Management ("ERM") framework, which is governed by the Risk Committee of the Board and encompasses the spectrum of risks, including cybersecurity risks and threats, that are integral to the Company's strategic objectives. Cybersecurity risks and threats are managed by a dedicated security team within the Information Technology ("IT") Department, under the leadership of the Chief Information Officer ("CIO"), who is also a member of the Risk Committee (Executive Director). This team collaborates with various departments across the Company, including legal, compliance, and human resources, to ensure a comprehensive approach to cybersecurity.

companyName: UNIVERSAL INSURANCE HOLDINGS, INC.

ticker: UVE


text: Cybersecurity risk management, strategy and governance O versight of cybersecurity is integrated into the responsibilities of the Board and its committees. The Board is responsible for identifying and understanding Enbridge's principal risks and ensuring that appropriate systems are implemented to monitor, manage and mitigate those risks. The committees of the Board have oversight over risks within their respective mandates.

companyName: ENBRIDGE INC

ticker: ENB


text: Depending on the environment, systems, and data, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and critical data, including, for example, an incident response plan, incident detection and response processes, disaster recovery plans, risk assessments, encryption of certain data, network security controls, access controls, physical security, systems monitoring, penetration testing, cybersecurity insurance, vendor risk management processes, and employee training, and employment of a defense-in-depth methodology. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for Security Operations Center (SOC) services and various third-party assessments of our cybersecurity practices. We deploy both commercially available solutions, such as firewall and antivirus software, and proprietary systems to manage threats to our information technology environment actively.

companyName: Mission Produce, Inc.

ticker: AVO


text: Upon the discovery of a potential or actual cybersecurity incident, the detecting party is obligated to inform the CISO, or deputy CISO if the CISO is unavailable, as an initial step. We also employ the services of an outside vendor that is tasked with contacting the CISO, or the CISO's delegee, upon learning of an incident. Subsequently, our CISO will guide the initial analysis of the cybersecurity incident, and depending on the nature of the incident, these cybersecurity incidents may be escalated to our CIO and above according to the guidelines set forth in the IRP. Analysis of the potential impact of the cybersecurity incident is one of the primary objectives of our initial response. Once the severity level and appropriate management protocol for responding to the cybersecurity incident have been determined in accordance with our Cybersecurity Plan and IRP, the CIO, or the CIO's delegee, may elevate the incident to the CEO, Chief Legal Counsel, Board, and Audit Committee as needed (depending on the nature and severity of the incident) for further investigation and response, including for an assessment of materiality. Depending on the nature of the incident, the CIO or Chief Legal Counsel will coordinate a notification and communications plan and event analysis across the appropriate teams, which may involve updates to our cybersecurity management team, the Board, the Audit Committee, the ERC and the CROC.

companyName: Vertiv Holdings Co

ticker: VRT


text: • Third Party Risk Management. We have a governance process in place to oversee our third-party vendors who have access to our network or who hold or store personal information on our behalf ("risk vendors"). Our risk vendor contracts contain provisions requiring our suppliers to maintain a program that meets our information security standards. We periodically assess risk vendor compliance with our information security program requirements. One such requirement is the obligation that our risk vendors must notify Equifax within a designated time period upon identifying certain cybersecurity events. • M&A Due Diligence and Integration Process. Our Security team has implemented a due diligence and integration process for entities we acquire through mergers and acquisitions ("M&A"). This process is designed to protect our information systems, align acquired entities with our security controls, and comply with applicable legal and regulatory requirements, without interrupting critical business processes. Our M&A security integration status is reported regularly to management and the Technology Committee and annually to the Board of Directors. • Employee Training and Awareness. In order to help bolster our cybersecurity defenses and mitigate the risk presented by insider or employee cyber and security threats, Equifax has incorporated employee training into our security program. On an annual basis, all employees are required to complete mandatory security training. In addition, each Equifax employee receives training customized to his or her role or function, and has visibility into his or her individual security performance. We continually measure and assess key employee behaviors, including secure browsing and sensitive data handling. In order to promote a Company-wide focus on data security and reinforce overall security program goals, Equifax includes an individual security performance measure as one of the metrics used to evaluate the performance of all bonus-eligible employees under our annual incentive compensation program. • Cybersecurity Insurance. We maintain cybersecurity insurance under our errors and omissions/professional liability policy, which provides coverage for certain costs related to cybersecurity incidents.

companyName: EQUIFAX INC

ticker: EFX


text: Some members of the Audit Committee have completed certifications in cybersecurity, including one from the National Association of Corporate Directors (NACD) in Cyber-Risk Oversight. On a quarterly basis, the CISO or its delegee report to the Board or Audit Committee on information technology and cybersecurity matters, including a detailed threat assessment relating to information technology risks.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Our information security program is led by our Chief Information Security Officer (CISO) who manages a global information security team responsible for assessing and mitigating cyber-related threats. The cybersecurity expertise of our CISO and his team includes information security management as well as governance, risk and compliance (GRC) roles, hands-on cyber incident response experience, forensic and network intrusion investigations and security risk assessments.

companyName: Element Solutions Inc

ticker: ESI


text: Employment of a responsible disclosure policy, which includes a Bug Bounty Program designed to help identify and fix any potential flaws in the company's services or products.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: Third-party assessments of NeurAxis: We have third-party cybersecurity companies engaged to assess NeurAxis' cybersecurity readiness and to assist in identifying and remediating risks from cybersecurity threats. NeurAxis has a "real time" cybersecurity partner that monitors our servers 24/7/365 for any attempted intrusions.

companyName: Neuraxis, INC

ticker: NRXS


text: As part of our cybersecurity risk management process, we conduct simulated cybersecurity incidents to ensure that we are prepared to respond to such incidents and to highlight any areas for potential improvement in our cyber incident preparedness. We have a cybersecurity incident management policy and response plan in place. Cybersecurity breaches are evaluated by our information technology teams, which includes our VP of Information Technology. If an incident is deemed to be a breach, it is communicated to our legal department and management for evaluation, including whether the breach requires communication to the Board of Directors or investors through a relevant public filing.

companyName: Permian Resources Corp

ticker: PR


text: We engage third party consultants with respect to cybersecurity, including to conduct vulnerability assessments and penetration testing of its information technology systems. We have established a formal third party risk management (TPRM) policy which defines the criteria that a third party service provider must meet in order to be considered by us. All vendors are risk ranked and reviewed by our TPRM team with results reported to our information security committee, which ultimately approves the use of new and existing vendors. In addition, we maintain an internal information security committee comprised of cross-departmental company executives and IT leaders to ensure that we maintain strong governance mechanisms and to ensure compliance with our security policies and procedures.

companyName: Essent Group Ltd.

ticker: ESNT


text: The Adviser has instituted a cybersecurity program designed to identify, assess, and manage cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: AGL Private Credit Income Fund


text: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats. Information security management is conducted by the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) of the Bank. The CIO has over ten years' experience with the Bank, including information security technology deployment and previous information technology audit experience. The CISO has more than 15 years of experience with the Bank, with expertise in large-scale systems information security and customer data privacy management.

companyName: BankFinancial CORP


text: Cybersecurity Incident Response Plan The DPT plays a critical role in the Incident Response Plan ("IRP") adopted by the Company. The IRP sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Under the IRP, any incident that is identified is promptly reviewed by the Incident Response Team ("IRT"), which is a committee of IT members, including the Company's Chief Information Officer. Any incident that the IRT determines may be material to the Company is then escalated to the DPT, which is responsible for overseeing the investigation of and response to such incidents, including ensuring that the Company's senior leadership and Audit Committee are informed and that any notification and regulatory filings are made in a timely manner.

companyName: DigitalBridge Group, Inc.

ticker: DBRG


text: Our board of directors has approved management committees including the Information Technology Committee, which focuses on technology impact, and its business impact. This committee provides oversight and governance of the technology program and the information security program. This committee is chaired by the Information Technology Officer and includes the Information Security Officer and the Chief Operations Officer. This committee generally meets monthly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. More frequent meetings occur from time to time in accordance with the Incident Response Plan in order to facilitate timely informing and monitoring efforts. The Information Technology Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

companyName: PFS Bancorp, Inc.

ticker: PFSB


text: Board has delegated the primary review of our cybersecurity, disaster recovery, risk assessment, vendor management, and business continuity risk management framework and related policies and procedures to the Information Security Committee, which consists of senior management members and one Board member. The committee is responsible for assisting the Board in its oversight of risk, including cybersecurity threats, and for overseeing our cybersecurity, disaster recovery, vendor management and business continuity risk management framework. The committee actively discusses major risk exposures, establishes risk management principles, and determines our risk appetite, and regularly reports on their activities, and makes recommendations to, the full Board. The Information Security Committee receives regular summary analysis reports of cybersecurity risks, threats, and incidents at their meetings. In addition, the committee is engaged, as needed, in accordance with our Incident Response Plan and Business Continuity Plan.

companyName: Bancorp 34, Inc.

ticker: BCTF


text: The Audit Committee receives regular updates from management on the state of cybersecurity risks facing the Company. This includes briefings on any significant cyber incidents and ongoing risk management efforts. These updates enable the Audit Committee to provide informed reports on cybersecurity matters to the full Board.

companyName: Onconetix, Inc.

ticker: ONCO


text: Mid Penn relies on several reputable service providers who provide systems or support to our technology environment. Service providers are selected carefully and monitored closely through our Vendor Management program. With routine, ongoing service provider reviews that exist throughout the relationship with the service provider, and with alerting for notable events for our service providers in place, we can quickly identify potential threats and mitigate threats with our service providers as needed.

companyName: MID PENN BANCORP INC

ticker: MPB


text: The HCTI board of directors provides enterprise-level oversight of risks associated with cybersecurity threats through the Audit Committee, which assists the Board in fulfilling its oversight responsibilities regarding the Company's policies and processes with respect to risk assessment and risk management, including any significant non-financial risk exposures; reviewing and discussing the Company's information security policies and internal controls regarding information security; and reviewing the Company's annual disclosures concerning the role of the Board in the risk oversight of the Company. The Audit Committee performs an annual review of the Company's cybersecurity program and receives quarterly updates on key cybersecurity risks, the cybersecurity risk management plan, and cyber incident event trends.

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by the NIST as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices; • conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; • conduct cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; • run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • leverage the NIST incident handling framework to help us identify, protect, detect, respond and recover when there is an actual or potential cybersecurity incident; and • carry cyber liability insurance that provides protection against the potential losses arising from a cybersecurity incident.

companyName: LISATA THERAPEUTICS, INC.

ticker: LSTA


text: Management's role in assessing and managing material risks from cybersecurity threats involves leadership, governance, resource allocation, and proactive risk management. Management's involvement is crucial in safeguarding the Company's digital assets, reputation, and long-term success. Our Cybersecurity Team provides periodic reports to our IT Committee and Audit Committee, our Chief Executive Officer, and other members of senior management as appropriate.

companyName: Trulieve Cannabis Corp.

ticker: TCNNF


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our Executive Director of IT, works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Adverum Biotechnologies, Inc.

ticker: ADVM


text: To date, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business operations or financial condition. While we have taken significant steps to manage cybersecurity risks, there can be no assurance that these measures will prevent all potential incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.

companyName: DLH Holdings Corp.

ticker: DLHC


text: Processes for incorporating cybersecurity risks into the overall risk management process Our process for identifying, assessing, and managing risks related to cybersecurity is incorporated into our IT processes. The Risk Management team meets at least annually with cybersecurity leadership to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk. Through this process, cybersecurity risks are presented to the executive leadership team, including the Chief Executive Officer ("CEO") and CAO, as well as reported to the Committee.

companyName: STRATA Skin Sciences, Inc.

ticker: SSKN


text: Storage and Backup of Source Systems: Implementing robust data storage solutions and backup protocols to ensure data integrity and availability. Policy Management: Developing and enforcing comprehensive security policies that govern all aspects of our cybersecurity efforts. Response Management: Rapid identification and response to security incidents to minimize impact. Microsoft cloud ecosystem.

companyName: DSS, INC.

ticker: DSS


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: The Board of Directors oversees risks relating to cybersecurity. The CISO and CFO present to the Board of Directors on a quarterly basis and the results of the risk assessments and audits on at least an annual basis. These reports also include detailed updates on the Company's performance preparing for, preventing, detecting, responding to, and recovering from cyber incidents. Apyx outsources the majority of our IT services and security to a well-respected company in the industry.

companyName: Apyx Medical Corp

ticker: APYX


text: Governance and Management Our board of directors has responsibility for the direction and oversight of our risk management, which would include cybersecurity risk management. Our board of directors administers this oversight function directly, with support from its audit committee (the "audit committee"). In particular, the audit committee considers and discusses our major risk exposures and the steps our Advisor takes, or is required to take, to monitor and control these exposures. Our audit committee also monitors compliance with legal and regulatory requirements, in addition to overseeing the performance of our internal audit function.

companyName: Cantor Fitzgerald Income Trust, Inc.


text: The Board of Directors conducts informed oversight of the Company's risk management process, including risks from cybersecurity threats. The Board of Directors is responsible for monitoring and assessing strategic risk exposure. The Company's management is responsible for identifying any potential cybersecurity risks to the Board of Directors and monitoring compliance practices at the operational level.

companyName: Kingfish Holding Corp


text: Oversee Third-party Risk Because the Company is aware of the risks associated with third-party service providers, the Company has implemented policies and processes to oversee and assist with managing these risks. The Company's Third-Party Risk Management Officer (the "TPRM") conducts security and risk assessments of all third-party providers before engagement and monitors these third-party providers on an ongoing basis to assess each provider's compliance with the Company's cybersecurity standards, which are intended to be commensurate with the level of risk and complexity of the relationship with, and the activities performed by, a given provider engaged by the Company. In addition, the TPRM conducts an annual risk assessment of any third-party provider that provides critical services to the Company or has access to customers' protected data. This approach is designed to help identify and mitigate risks related to data breaches or other cybersecurity incidents originating from third-parties in order to better protect our customers' personally identifiable information and the Company's assets and data.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB


text: Our Corporate Information Security Officer ("CISO"), who has relevant degrees and more than 17 years of information technology and information security experience, including five years in the financial services industry, manages our enterprise information security function and administers our information security program. The roles and responsibilities of the CISO's department include delivering and operating security capabilities and controls to detect, identify, protect against and recover from cyberattacks, as well as coordination with our Business Continuity Director for additional risk assessment, incident response and business resilience. These responsibilities are addressed by a first line of defense function, with our second line of defense function, including the Corporate Information Security Officer, providing oversight, guidance, monitoring and management of the first line's activities. Through ongoing engagement among these personnel, our Corporate Information Security Officer and other key members of management routinely monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents, and report such threats and incidents to the ERC when appropriate.

companyName: Ameris Bancorp

ticker: ABCB


text: Material Impact of Cybersecurity Threats While to date we are not aware of any material information security breaches and have not incurred significant operating expenses related to information security breaches, we acknowledge the persistent and evolving nature of these threats, which have the potential to materially impact our business strategy, operations, and financial standing adversely. See Item 1A, "Risk Factors" under the risks related to our business section for more information. Our incident response practices require incident assessments to be conducted in concert with our Chief Executive Officer, Chief Financial Officer and MSP. This enables faster response and effective communication, including public disclosure if a material cybersecurity event were to occur.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: We maintain a risk based approach to identify cybersecurity threats, and conduct assessments to determine if our information systems are vulnerable to such cybersecurity threats. This includes identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: COHERENT CORP.

ticker: COHR


text: Under the direction of the Executive Vice President, Administration, management's responsibilities with respect to the Company's cybersecurity program include (i) identifying and managing cybersecurity risks, (ii) coordinating cybersecurity incident response, (iii) assessing the health and maturity of the Company's cybersecurity policies, procedures, and plans, including the program, and (iv) reporting overall progress to the Cybersecurity Committee and to the full Board of Directors.

companyName: APA Corp

ticker: APA


text: Chief Executive Officer (CEO) is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The Company's Cybersecurity Risk Management Team is responsible for developing budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: GENELUX Corp

ticker: GNLX


text: Company's Management, including the Company's CCO, manages the Company's cybersecurity program, under the supervision of the Company's Audit Committee. The CCO of the Company oversees the Company's risk management function generally and relies on the Investment Adviser to assist with assessing and managing material risks from cybersecurity threats. The Company's CCO has been responsible for this oversight function as CCO to the Company for over 7 years and has worked in the financial services industry for over 25 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PRINCETON CAPITAL CORP

ticker: PIAC


text: Wendy's is committed to securing our information systems against cybersecurity threats and protecting the privacy and security of our customers', employees', franchisees' and business partners' information. However, as described in "Item 1A. Risk Factors—Risks Related to Technology and Cybersecurity" of this Form 10-K, we recognize that cybersecurity threats are an ongoing concern in today's interconnected digital world and that, despite devoting considerable resources to secure our information systems, cybersecurity incidents can occur and, if so, could negatively impact our brand, business, results of operations and financial condition. Based on this recognition and taking into account experience from previous cybersecurity incidents, we have developed a comprehensive cybersecurity risk management strategy designed to identify, assess and manage potential threats to our information systems. Key components of our cybersecurity risk management strategy include the following: • CIS Controls. We design our cybersecurity risk management strategy based on the Center for Internet Security's ("CIS") Critical Security Controls Framework and other industry accepted standards and practices. The CIS is an internationally recognized, non-profit organization dedicated to developing controls, benchmarks and best practices for cybersecurity risk management. We conduct an annual assessment of our progress against the CIS controls to measure our performance against accepted benchmarks and identify ways to enhance our cybersecurity risk management strategy. The results of the assessment are reviewed by our Internal Audit team and shared with senior leadership and the Technology Committee of our Board of Directors. • Regular Risk Assessments. We conduct regular risk assessments to identify and assess material risks to our information systems, including as part of our enterprise risk management ("ERM") program, which is described in more detail under "Cybersecurity Governance" below. These risk assessments involve input from key stakeholders, including those with assigned accountability for managing risk and supporting technical risk subject matter expertise, and consider a variety of factors, including our global business strategy, operations and support, information systems and data assets. • Infrastructure. We design our cybersecurity infrastructure, including firewalls, endpoint security, intrusion detection tools and identity access management systems, to provide a multi-layered approach to protecting our information systems from unauthorized access, use, disclosure, disruption, modification or destruction. • Dedicated Personnel. We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response. In recent years, we have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions. • Training. We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices. This training program includes initial onboarding training, annual refresher training and periodic awareness assessments such as email phishing campaigns to test user awareness and defend against business email compromise.

companyName: Wendy's Co

ticker: WEN


text: The Steering Committee thoroughly monitors the quality and effectiveness of the Company's cybersecurity program. This encompasses the security of our internal information technology systems, products, and solutions, as well as our cyber incident response plan and resources. To stay informed, the Steering Committee receives regular updates from management on cybersecurity initiatives. These updates cover prevention, detection, mitigation, and remediation of cyber threats, along with the overall health of the Company's cybersecurity program, results of third-party assessments, and the latest cyber threat trends. Additionally, the Steering Committee reviews the Company's cybersecurity policies and methodologies to ensure continual service improvements. This demonstrates a company commitment to not only maintaining the existing cybersecurity framework but also proactively identifying and implementing enhancements.

companyName: DecisionPoint Systems, Inc.


text: We maintain a Cybersecurity Incident Response Plan, or CIRP, which is designed to guide our response to cyber incidents, including to mitigate and contain any potential cybersecurity incidents that could affect our systems, network, or data. The CIRP identifies the individuals responsible for developing, maintaining, and following procedures related to cybersecurity incident response, including escalation protocols. We also engage external third-party consultants to provide services, such as penetration testing, which is conducted on an annual basis, along with ongoing vulnerability scans. These consultants also perform annual assessments of our cybersecurity program, which involve, among other things, review of our IT security measures and processes for alignment with the NIST Cybersecurity Framework and provision of threat intelligence regarding emerging risks to our information systems.

companyName: TScan Therapeutics, Inc.

ticker: TCRX


text: We have established processes designed to manage cybersecurity threats associated with the use of third-party service providers. These processes include security evaluations before third-parties' admission, ongoing oversight and assessment of their security status, and adopting necessary security measures at termination of services.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Regulatory Compliance: The Company is subject to various regulatory requirements related to cybersecurity, data protection, and privacy. Non-compliance with these regulations could result in financial penalties, legal liabilities, and reputational damage.

companyName: COMMUNITY BANCORP /VT

ticker: CMTV


text: Management's Role in Cybersecurity Risk Management Our management team, including our Chief Compliance Officer and Chief Operating Officer, is responsible for assessing and managing material risks from cybersecurity threats, including by engaging third-party service providers, as described above. Members of our management team possess relevant expertise in various disciplines that are key to effectively managing such risks, such as technology systems, technology leadership, technological development, cybersecurity, regulatory compliance and corporate governance. Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, including through the receipt of notifications from third-party service providers and reliance on communications with our risk management, legal, and/or compliance personnel.

companyName: Trinity Capital Inc.

ticker: TRIN


text: We have not identified known cybersecurity threats to date that could have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats such as loss or theft of data, disruptive attacks from financially motivated bad actors, and third party supply chain issues that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Relating to Our Business."

companyName: Lemonade, Inc.

ticker: LMND


text: The Company adheres to a periodic, third-party facilitated testing exercise of the cybersecurity incident response plan and playbook with the Company's tactical and strategic team members. The teams are comprised of key members of the organization and external advisors who hold critical importance in the handling of cybersecurity events. The exercise covers response procedures for prevalent cybersecurity incidents including but not limited to phishing, third-party breaches, and a standard incident response process. The documentation helps leaders make appropriate, pre-planned decisions. To assist, appendices detailing generalized incident response checklists and workflows from the Cybersecurity & Infrastructure Security Agency ("CISA") and the NIST are referenced and used as a framework. Lastly, the response plans contain instructions on collecting and incorporating lessons learned after a successful identification and remediation of a security event. The information security team also works in partnership with the Company's internal audit team to review information technology-related internal controls with our external auditor as part of our overall internal controls process.

companyName: Metallus Inc.

ticker: MTUS


text: The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp's Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp's Risk Management group. He holds a bachelor's degree in Finance and Management Information Systems and an

companyName: KEYCORP /NEW/

ticker: KEY


text: Our CTO is the primary senior management team member responsible for assessing, monitoring and managing material risks from cybersecurity threats, and works closely with out IT Risk Management team members. The CTO and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.

companyName: Enova International, Inc.

ticker: ENVA


text: Engaging Third Parties Companies, especially in the technology industry, have been subject to an increasing number of complex cybersecurity risks. Infinera has engaged with a range of external service providers, including consultants, auditors, and cybersecurity service providers, to understand, manage, and mitigate cybersecurity risks. These engagements help Infinera drive improvements in our processes, identify new and emerging threats, and respond rapidly to the ever-evolving cybersecurity risk landscape.

companyName: Infinera Corp


text: The Company has developed an information security program to assess, identify, and monitor cybersecurity risks. Each year, the Company assesses cybersecurity risks arising from the operating environment. In developing the assessment process, the Company reviews guidance from national standards organizations such as the NIST and the Center for Internet Security. In evaluating the risks identified as a part of this assessment, the Company's information security team considers the likelihood and severity of the risk and the possible impact of the risk on the Company, its customers, and its employees. These risks are then monitored by the Company's information security team.

companyName: KEMPER Corp

ticker: KMPR


text: To keep threat and vulnerability information up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide rapid alerting for emerging threats and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: Our cybersecurity risk management program includes the following key elements, among others: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a team comprised of IT security and IT infrastructure personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the periodic use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees and consultants with access to our IT systems; and • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents.

companyName: Enovis CORP

ticker: ENOV


text: As of the date of this report, management is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. However, we are regularly the target of attempted cyber intrusions, and we anticipate continuing to be subject to such attempts. Our security programs and measures do not prevent all intrusions. Cyber intrusions require a significant amount of time and effort to assess and remedy, and our incident response efforts may not be effective in all cases. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See "Item 1A. Risk Factors – Risks Affecting Our Business and Industry – If our information technology system fails or if the implementation of new information technology systems is not executed efficiently and effectively, our business, financial position, and operating results could be adversely affected" of this Annual Report on Form 10-K.

companyName: MANNATECH INC

ticker: MTEX


text: Role of the Corporation's Board The Corporation's Board of Directors ("Board") recognizes the importance of cybersecurity in safeguarding the Corporation's sensitive data. The Board is responsible for overseeing overall risk management for the Corporation, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk.

companyName: UNION CARBIDE CORP /NEW/


text: Cybersecurity is the responsibility of our Chief Information Security Officer ("CISO") who oversees an information security team responsible for maintaining the confidentiality, integrity, and accessibility of data within CCC while continuously monitoring for and responding to cybersecurity threats, with oversight by our EVP, Chief Product and Technology Officer who is responsible for all of our information technology systems. Our Chief Information Security Officer has 18 years of experience managing risks from security threats and developing and implementing security policies and procedures, as well as relevant degrees and certifications, including a bachelor of science in information systems and cybersecurity and being a Certified Information Security Manager and a Certified Information Systems Security Professional. Our EVP, Chief Product and Technology Officer has over three decades of experience in the technology industry and holds a bachelor of science in computer science.

companyName: CCC Intelligent Solutions Holdings Inc.

ticker: CCC


text: We evaluate our cybersecurity strategy annually, including our processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein, within our overall enterprise risk management framework. Our cybersecurity strategy takes a multi-faceted approach, one which focuses on the following key areas: (i) the human element within the organization; (ii) perimeter security; (iii) network security; (iv) application security; (v) endpoint security; and (vi) data security. We use a wide array of processes, mechanisms, controls, technologies, systems, strategies and tools in each of these areas, including but not limited to: routine security awareness training, formal evaluations of third-party applications, password strength policies, antivirus software, firewalls, routine patch management, encryption software, data backups and data redundancies, email security software, multi-factor authentication tools, network security monitoring, and web vulnerability scanning.

companyName: XOMA Royalty Corp

ticker: XOMA


text: Our Audit Committee oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services brief the Audit Committee on cyber threats and vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on our processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.

companyName: Banzai International, Inc.

ticker: BNZI


text: We have also developed a data breach response plan that includes policies and procedures to assess the nature and scope of an incident that has been determined to be a breach, identify the information systems and types of information that may have been accessed or misused, contain and control the incident, maintain or restore business continuity, and communicate the incident to the necessary parties, dependent upon the nature and severity of the incident. In addition, we have formed a data breach response team that is comprised of individuals across the organization, including our IT Director, executive management, information technology and security, risk management, audit, legal, privacy and compliance, finance, communications, and business and IT operations. The data breach response plan outlines the roles and responsibilities of the data breach response team members, including monitoring of new data breach reporting regulations and communication protocols for incident reporting. In the event of a verified data breach, the data breach response team communicates the data breach to internal and external stakeholders, including employees, vendors, customers, law enforcement, and other federal or state agencies. The data breach response team also works with the necessary individuals to determine whether a verified data breach has a material impact to the company. If determined to be material, the data breach response team provides our CEO with documentation to communicate the incident to our board of directors.

companyName: BOISE CASCADE Co

ticker: BCC


text: We have programs for assessing, identifying, and managing material risks from cybersecurity threats through the use of a suite of various security programs and tools including, but not limited to, Managed Security Service Provider and Extended Detection and Response monitoring and alerts, internal reporting mechanisms, monitoring tools, detection tools and continuous training. Our information security program undergoes regular evaluations, internal audits and various exercises, including tabletop, penetration, vulnerability testing and simulations. The findings from these activities, including identified security gaps, are integrated into our risk remediation process and subsequently updated across our suite of security tools and applications. Additionally, we conduct annual Payment Card Industry Data Security Standard compliance reviews and third-party penetration testing.

companyName: G III APPAREL GROUP LTD /DE/

ticker: GIII


text: Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. However, because we have investments in our Trust Account and bank deposits and we depend on the digital technologies of third parties, we and third parties may be subject to attacks on or security breaches in our or their systems. Because of our reliance on the technologies of third parties, we also depend upon the personnel and the processes of third parties to protect against cybersecurity threats, and we have no personnel or processes of our own for this purpose. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if any. We have not encountered any cybersecurity incidents since our IPO.

companyName: Trailblazer Merger Corp I

ticker: TBMC


text: Because we are aware of the risks associated with third-party service providers, we have implemented stringent processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes annual assessments of the SOC reports of our providers and implementing complementary controls. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third-parties. We have no t encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: NewHydrogen, Inc.

ticker: NEWH


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: Our information security team also participates in periodic global and regional Risk Assurance Committees to further strengthen our cybersecurity risk management activities across the Company. At these meetings, the information security team presents to members of Company leadership, including members of our internal audit team and regional and service line chief financial officers, on the current cybersecurity risk environment, including any newly identified areas of risk and updates on responses to existing risks.

companyName: Cushman & Wakefield Ltd.

ticker: CWK


text: The Partnership has implemented processes to assess, identify and manage material risks resulting from cybersecurity incidents. Our Cybersecurity program and processes are based upon the International Standards Organization ("ISO") guidance on information security. The Partnership's processes used to identify, assess, and mitigate cybersecurity risks are integrated into the Partnership's broader risk management system and processes, including through the risk management activities of the Board and its Audit Committee, our Enterprise Risk Management Committee ("ERM Committee"), and our internal audit and information technology functions.

companyName: CVR PARTNERS, LP

ticker: UAN


text: Prudential Financial's Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.

companyName: PRUCO LIFE INSURANCE CO


text: We have established policies and processes for assessing, identifying and managing risks from cybersecurity threats based on the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our technology environment is regularly assessed, both internally and through the use of third parties, against the six NIST principles (identify, detect, protect, recover, respond, govern) to oversee and identify the likelihood and impact of risks from cybersecurity threats. Additionally, we apply these principles where appropriate to third-party technology providers. We also utilize third parties to assess the effectiveness of our cybersecurity program on a periodic basis, which includes engaging cybersecurity assessors and cybersecurity experts to assist in the detection, verification and validation of risks from cybersecurity threats, as well as to support associated mitigation plans when necessary. We have a cybersecurity incident response plan in place to assist us in detecting, analyzing, containing, responding to and recovering from cybersecurity incidents. We also maintain cybersecurity insurance coverage to protect against certain potential losses arising from cybersecurity incidents.

companyName: UNITED NATURAL FOODS INC

ticker: UNFI


text: While we have not had any material cybersecurity breaches to our knowledge, the CFO is continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The CFO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and system audits as needed to identify potential vulnerabilities. In the event of a cybersecurity incident, the CFO is equipped with an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: City Office REIT, Inc.


text: Beginning last year, the Director of Cybersecurity also provides updates to the Audit Committee of the board of directors approximately on a quarterly basis. The Audit Committee, pursuant to its charter, reviews significant existing and emerging cybersecurity risks, including material cybersecurity incidents if any, the impact on the Company and its stockholders of any significant cybersecurity incident and any disclosure obligations arising from any such incidents.

companyName: Century Therapeutics, Inc.

ticker: IPSC


text: Our Audit Committee, in connection with management led by our Chief Information Officer and Director of Cybersecurity, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Audit Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

companyName: REPUBLIC AIRWAYS HOLDINGS INC.

ticker: RJET