text: As risk management is an ongoing process, the Company regularly assesses its cybersecurity risks and adjusts its program accordingly. Via multiple monitoring solutions, potential cyber threats are automatically logged and proactively addressed. Our monitoring tools use well-established vulnerability scoring to aid in the overall risk assessment. The scoring ranks by potential severity and likelihood and includes a review of mitigating factors. The Company prioritizes its cybersecurity investments based on the likelihood and impact of potential threats.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: The Board, in coordination with the Risk Committee, oversees the Company's risk management program, which includes risks arising from cybersecurity threats. DMC's Chief Information Officer (CIO) and Chief Information Security Officer (CISO), the management position responsible for assessing and managing material risks from cybersecurity threats, manages the Company's cybersecurity program and are responsible for leading and coordinating cybersecurity activities across the organization. The CIO reports directly to our Interim President and Chief Executive Officer, and the CISO reports directly to our CIO. Our CISO has extensive experience in cybersecurity, business continuity, disaster recovery and cloud security.

companyName: DMC Global Inc.

ticker: BOOM

secItem: Item 1C


text: The day-to-day responsibility for assessing, monitoring and managing our cybersecurity risks resides with our IT team. Across the IT team we have employees who have in-depth knowledge and decades of cybersecurity industry experience, including prior experience with developing and overseeing cybersecurity polices and processes for companies required to comply with NIST SP800-171, cybersecurity standards for companies that store sensitive unclassified information on behalf of the United States government, and former Ibeo employees having experience with TISAX compliance. Yet, we recognize the evolving and increasing threat that cybersecurity will have on our operations. As part of our long-term growth strategy, we expect to establish a dedicated cybersecurity team to oversee our cybersecurity risk management.

companyName: MICROVISION, INC.

ticker: MVIS


text: Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, internal IT audits, IT security, governance, and risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct privacy and cybersecurity reviews of systems, applications, and applicable data policies; perform penetration testing using external third-party tools and techniques; conduct employee training; monitor emerging laws and regulations related to data protection and information security; and implement appropriate changes. We have implemented incident response and breach management processes that are overseen by leaders from our information security, engineering, compliance and legal teams regarding matters of cybersecurity. Security threats are evaluated, ranked by severity and prioritized for response and remediation. Potential data security incidents are investigated to determine operational and business impact, applicability of regulatory or contractual data privacy requirements, including state data breach notification statutes, and materiality. We conduct tabletop exercises to simulate responses to cybersecurity incidents and collaborate with technical and business stakeholders across our business units to form detection, mitigation and remediation strategies. We also maintain third party security procedures to identify, prioritize, assess, mitigate and remediate third party risks; however, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.

companyName: EverQuote, Inc.

ticker: EVER


text: Our board of directors and its audit committee oversee the Company's ERM program, and the steps management has taken to monitor and mitigate such risks, including the Company's procedures and any related policies with respect to enterprise risk assessment and risk management. The board of directors bears principal responsibility for overseeing the Company's principal current and future risk exposures, and, on an annual basis, the board of directors reviews them, including cybersecurity risks and exposures. The board of directors' review includes an annual session with our CIO on the Company's procedures and policies for assessing and managing cybersecurity risks and disclosing any material cybersecurity incidents. In performing these oversight functions, the board of directors relies on advice, reports and opinions of management, counsel and our internal and external auditors, including mid-year and year-end cybersecurity inquiries by our external auditors on various aspects of the Company's cybersecurity program, processes and training.

companyName: Sotera Health Co

ticker: SHC


text: The Company leverages the expertise of independent consultants, legal advisors, and audit firms to evaluate the effectiveness of our risk management systems and address potential cybersecurity incidents efficiently. The Company conducts periodic cybersecurity training for its workforce.

companyName: LANDMARK BANCORP INC

ticker: LARK


text: Members of our Cybersecurity Management identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's enterprise risk profile using various manual and automated tools as well as by: (i) utilizing shared information about vulnerabilities and exploits from various professional security organizations, reports or other services that identify cybersecurity threats and through the use of external intelligence feeds; (ii) analyzing reports of threats and actors; (iii) conducting scans of the Company's threat environment; (iv) evaluating our and our industry's risk profile; (v) evaluating threats that are reported to us; (vi) coordinating with law enforcement concerning threats; (vii) conducting internal and external audits of our information security control environment and operating effectiveness; and (viii) conducting threat assessments for internal and external threats, including through the use of third party threat assessments and vulnerability threat assessments.

companyName: COHEN & STEERS, INC.

ticker: CNS


text: Role of Management Helios Technologies' Information Technology organization is led by the VP, Information Technology and is responsible for administration of the cybersecurity and information security framework and risk management, including that of the Corporation and its business units, with oversight by the ESG Committee.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties (including vendors, service providers and other external users of our systems) as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.

companyName: HERC HOLDINGS INC

ticker: HRI


text: The Company's cybersecurity team is headed by its Director of Information Technology & Information Security, who works with the Company's cybersecurity team to identify cybersecurity risks and who has been in the information technology and cybersecurity industry for over 25 years and holds numerous technical certifications and cybersecurity-related certificates. The team members report via its established cybersecurity triage and outage workflow to the Cibus Cyber Security Council, which consists of the Company's CEO, President and COO, EVP and CSO, and members of the Company's legal and human resources teams. The Company's Cyber Security Council meets regularly to discuss the status of the cybersecurity program, emerging cybersecurity threats, long-term cybersecurity investments and strategies, and oversight of the Company's cybersecurity program. The Company's Cyber Security Council is also responsible for identifying, assessing, and managing the Company's exposure to material risks from cybersecurity threats, including monitoring the prevention, detection, mitigation, and remediation of cybersecurity threats.

companyName: Cibus, Inc.

ticker: CBUS


text: Our CIO regularly evaluates the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise in consultation with members of our senior management team. Our CIO holds a Ph. D. in Information Systems from the London School of Economics and has over 20 years' experience and certifications in the field of information technology and data security.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: The Board is responsible for overseeing assessments of major risks facing the Company and for reviewing options to mitigate these risks. It has delegated oversight responsibility for information security matters to the Audit Committee, Chief Financial Officer ("CFO") and our internal information technology ("IT") resources. Our Director of IT manages our internal team of security professionals, as well as our third-party IT service providers, which provides 24/7 security monitoring. The personnel comprising our IT team include a certified information system security professional and other professionals with many years of experience across a variety of technological sub-specialties.

companyName: Capstone Green Energy Holdings, Inc.

ticker: CGEH


text: As part of our continuing education, employees are required to participate in cybersecurity awareness training at the commencement of their employment and annually thereafter. We reinforce this training with monthly internal phishing tests and cybersecurity newsletters to educate our employees on the latest cybersecurity threats and the most effective preventative measures.

companyName: WD 40 CO

ticker: WDFC


text: Cybersecurity Risks Our senior management identifies, assesses and evaluates risks impacting our operations across the Company, including those risks related to cybersecurity. Senior management is asked to consider the severity and likelihood of certain risk factors, drawing upon their knowledge of the Company and past business experience.

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: During the fiscal year ended January 31, 2024, no known cybersecurity threats materially affected, or we believe are reasonably likely to materially affect, our business, our business strategy, financial reporting, or results of operations.

companyName: HEALTHEQUITY, INC.

ticker: HQY


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business and Industry—Our failure or the failure of third-party service providers on which we rely to protect our marketplace, networks and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and substantially harm our business and operating results."

companyName: GigaCloud Technology Inc

ticker: GCT


text: Our Board of Directors oversees cybersecurity risk management and is supported by the Audit and Finance Committee of the Board (the "Audit Committee"). The Audit Committee interacts with the Executive Leadership Team ("ELT"), including our Chief Technology Officer ("CTO"), and other members of management with respect to cybersecurity matters. The Board of Directors and the Audit Committee receive periodic reports from management on the effectiveness of the cybersecurity program and any material cybersecurity incidents that have occurred. The Board of Directors and the Audit Committee work with management to help ensure that our cybersecurity program is effective in addressing the risks associated with cybersecurity threats and are committed to continuously improving our cybersecurity program to stay apprised of emerging threats. The CTO oversees our cybersecurity program, including assessing and managing material risks from cybersecurity threats. The Chief Information Security Officer ("CISO") reports to the CTO and leads the cybersecurity program and team.

companyName: nVent Electric plc

ticker: NVT


text: Our cybersecurity program includes processes for identifying and managing risks from third parties and is integrated into our overall risk management framework. Our program defines key risk objectives and if cybersecurity risk exceeds defined thresholds, such risks are documented and escalated into the enterprise risk program and Blend's internal audit team. We contractually obligate third-party service providers with access to our systems or processing sensitive data on our behalf to align with our cybersecurity objectives and adhere to industry best practices. We re-evaluate each such service provider at least annually and when the role or purpose of a service provider changes, and have processes to require service providers maintaining sensitive data on our behalf to delete such data upon contract termination.

companyName: Blend Labs, Inc.

ticker: BLND


text: The Company's management is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Management implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of industry-standard security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, management will implement an incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.

companyName: Signing Day Sports, Inc.

ticker: SGN


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any cybersecurity incident, which have materially affected, or are reasonably likely to materially affect, us, our business strategy, our results of operations, or our financial condition.

companyName: Ryerson Holding Corp

ticker: RYZ


text: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Network and endpoint protection: Utilizing firewalls, intrusion detection systems, antivirus software, and advanced encryption protocols to safeguard sensitive data and systems. Multi-factor authentication, security and principle of least privileged (PoLP)

companyName: cbdMD, Inc.

ticker: YCBD


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. We maintain a cybersecurity risk register, and cybersecurity team leaders hold monthly meetings to discuss and prioritize risks as well as the status of any remediation activity. Key facets of our cybersecurity program include:

companyName: INSULET CORP

ticker: PODD


text: The Board established an IT Committee to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The IT committee membership includes senior management from business units, as well as information security risk experts such as the Information Security Officer, experts from Enterprise Risk Management, Internal Audit, and Information Technology Leaders. At the IT Committee meetings, security-related policies and standards are reviewed and approved, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, emerging threats reported on, and relevant cyber risks and trends are presented. The IT Committee is responsible for governing the assessment and treatment of cyber risks. The Committee reports its activities, key conclusions, and recommendations to the Board on a quarterly basis.

companyName: Merchants Bancorp

ticker: MBIN


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Allison Transmission Holdings Inc

ticker: ALSN


text: Primary responsibility for assessing any cybersecurity risks rests with A. Stone Douglass, our sole executive officer, who would report any threat to our board of directors.

companyName: Hypha Labs, Inc.

ticker: FUNI


text: Our commitment to cybersecurity resilience is rooted in the collaborative efforts between management, the IRT and the Board of Directors. We continuously strive to strengthen our cybersecurity measures to protect our systems, data, customers and stakeholders from evolving threats. To date, cybersecurity incidents and risks have not materially affected us, including our business strategy, results of operations, or financial condition.

companyName: ARBOR REALTY TRUST INC

ticker: ABR


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as certain incidents with lesser impact potential.

companyName: AMERICAN AIRLINES, INC.


text: The Technology, Environmental, Safety and Security ("TESS") Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require. The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.

companyName: Norwegian Cruise Line Holdings Ltd.

ticker: NCLH


text: Please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K for more information on risks posed by cybersecurity threats to the Company.

companyName: ASURE SOFTWARE INC

ticker: ASUR


text: The audit committee of the board of directors (the "Audit Committee") has been designated by our board of directors to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our management. The board of directors also receives periodic updates from management and the Audit Committee on cybersecurity risks. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Executive Officer. Management regularly updates the Audit Committee on our cybersecurity programs, which includes cybersecurity risks and mitigation strategies, vulnerability management, and on-going cybersecurity projects.

companyName: iPower Inc.

ticker: IPW


text: Under the direction of the Chief Information Officer, the Information Security Officer is responsible for cybersecurity and business continuity, which includes security architecture, security operations, incident response, IT risk and compliance, and security awareness and training. The Information Security Officer has over 40 years of security & risk management experience among other disciplines. The Cybersecurity Program Manager who reports directly to and supports the Information Security Officer in various aspects of cybersecurity and business continuity in the Company is a Certified Information Systems Security Professional (CISSP) and a Certified Information Systems Auditor (CISA), The other members of the Company's information security organization also have extensive cybersecurity, business, and technology experience and hold certifications in their area of expertise.

companyName: NORTHRIM BANCORP INC

ticker: NRIM


text: The responsibilities of the Company's Board of Directors ("Board") include oversight of our risk management processes. The Board has two primary methods of oversight. The first method is through the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company. The second is through the functioning of the Board's committees. The Audit Committee assists the Board in its oversight of the Company's information security program, including cybersecurity and data privacy risks and controls. Our CISO provides reports on the Company's cybersecurity program to the Audit Committee, which includes all members of the Board, on a quarterly basis. In addition, our Internal Audit function regularly audits our technology and cybersecurity programs and reports to the Audit Committee on its findings.

companyName: BROADRIDGE FINANCIAL SOLUTIONS, INC.

ticker: BR


text: The security and maintenance of our information technology systems is important to our operations and business strategy. To this end, we have implemented processes designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are informed in part by industry standards, principles and frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, and are managed and monitored by a dedicated information technology team, which is led by our Director of Information Technology, and includes mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and to maintain a stable information technology environment. For example, we conduct penetration and vulnerability tests, data recovery tests, security audits, and ongoing risk assessments, including due diligence on our key technology vendors, contractors, and suppliers.

companyName: BROADWAY FINANCIAL CORP \DE\

ticker: BYFC


text: Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance and other industry standards. In addition, we leverage certain industry and government associations, third-party benchmarking, audits and threat intelligence feeds to facilitate and promote program effectiveness. Our Chief Information Security Officer and our Chief Technology Officer, who reports directly to our President and Chief Executive Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups and policymakers to discuss cybersecurity trends and issues and identify best practices. The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

companyName: Blue Foundry Bancorp

ticker: BLFY


text: Operations (Detect and Respond): In the event of a cybersecurity incident, the Elanco Information Security Incident Response Plan (ISIRP) defines the roles, responsibilities, procedures and reporting processes required to respond effectively to cybersecurity incidents. Responses to information security incidents are led by two teams: 1) the Security Operations Center (SOC) team, which conducts the initial technical triage and analysis, and 2) a cross-functional team of leaders from the IT, Legal, Human Resources and Finance functions (the Cyber Lead team), which is engaged by the CISO on an as needed basis, based on incident severity. The Cyber Lead team is tasked with determining the severity of a cybersecurity incident and bringing together the proper resources to lead the corporate-wide response to such incidents, including engaging the Company's Disclosure Committee, in the event an incident may rise to a level deemed material to us. In the event an incident is escalated by the Cyber Lead team, the Disclosure Committee, led by our Chief Financial Officer and General Counsel, would evaluate all estimable quantitative and qualitative factors, to determine if a Current Report on Form 8-K would be required under Item 1.05, "Material Cybersecurity Incidents".

companyName: Elanco Animal Health Inc

ticker: ELAN


text: We conduct organization-wide cybersecurity training and compliance exercises in connection with our information security program. This training consists of educational material and compliance testing administered to all of our employees, which is tracked and recorded throughout the year. Results and progress are shared with Executive Leadership, the Audit Committee, and the Board. Employee phishing tests are conducted on a regular basis. Employees who do not follow protocol are redirected for additional training.

companyName: FASTENAL CO

ticker: FAST


text: The ISWG: (i) reviews any material information security incidents and documents the results of any such reviews and any responsive or remedial actions taken in connection therewith; (ii) escalates any significant incidents involving threats to, or breaches of, the cybersecurity protections set forth in the Adviser's Information Security Program and Policies and Procedures (the "Information Security Program") to the Adviser's Compliance Committee or Operating Committee; and (iii) updates the Information Security Program as needed, based on, among other things: (a) results of testing and monitoring pursuant to the Information Security Program; (b) changes to applicable laws, rules, or regulations; (c) new or prospective cyber threats; and (d) material changes to the business and operation of the Adviser and the Fund. In addition, the ISWG is informed by the CTO of: (i) any risks to personal information and the Adviser's information systems; (ii) ways to manage and control such risks; (iii) any concerns regarding third party vendor arrangements that could impact information security; (iv) the results of testing done in connection with the Information Security Program; and (v) any other matters that the CTO believes should be reviewed by the ISWG. The Information Security Program: (i) implements and maintains administrative, technical, and physical safeguards for the protection of personal information; (ii) protects against any anticipated threats or hazards to the security of such information, other Adviser information, and the Adviser's information systems; and (iii) prevents unauthorized access to or use of the Adviser's systems or personal information. In addition, the ISWG maintains an Incident Response Plan designed to define, in advance, the actions to be taken in the event that the Adviser suffers a digital attack or a potential cybersecurity breach.

companyName: Silver Point Specialty Lending Fund


text: We use third party providers to help us consistently monitor and evaluate our cybersecurity program and performance through actions that include hiring a contract Chief Information Security Officer ("CISO") with decades of cybersecurity experience to help manage our program. We also use industry standard technology tools including vulnerability scans, penetration tests, firewalls, endpoint detection and threat intelligence. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also important pillars in our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: We engaged an independent cybersecurity advisory service firm to perform a focused cybersecurity assessment to better understand our current cybersecurity threats and risks and build a foundation for establishing a cybersecurity risk assessment framework to identify, assess and manage cybersecurity risks arising from our business operations.

companyName: Applied Therapeutics, Inc.

ticker: APLT


text: Each member of our Board of Directors and Audit Committee also receives a quarterly report on cybersecurity matters and related risk exposures, and when the report is discussed during an Audit Committee meeting, the chair of the Audit Committee reports on related matters to our Board of Directors. Our Audit Committee also receives regular updates on our cybersecurity posture throughout the year, as appropriate.

companyName: SPRUCE POWER HOLDING CORP

ticker: SPRU


text: Monitor Cybersecurity Incidents The cybersecurity sub-committee stays apprised about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity sub-committee implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the cybersecurity sub-committee is equipped with a well-defined incident response plan, which provides a framework to mitigate the impact of cybersecurity incidents.

companyName: National Storage Affiliates Trust

ticker: NSA


text: In 2024, we did not identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. Refer to "Item 1A. Risk Factors" for a description of the risks from cybersecurity threats that may materially affect the Company, including the risk factor titled, "If we or the third parties with whom we work experience a security breach or unauthorized parties otherwise obtain access to our customers' data, our data, or our platform, our platform may be perceived as not secure, our reputation may be harmed, our business operations may be disrupted, demand for our solutions may be reduced, and we may incur significant liabilities".

companyName: Unity Software Inc.

ticker: U


text: During the last year we have not identified cybersecurity threats or challenges that have materially impaired our operations or financial condition. Our monthly baselines for cybersecurity are closely tracked and show a continual improvement and reduction of risk over the last three years. Similarly, incident investigations over the same period have reduced in severity and frequency. These internal metrics are consistent with our third-party risk scorecard subscriptions which similarly show a year-over-year improvement in our risk posture over the last three years. See Risk Factor, "Damage to our computer infrastructure and software systems and issues relating to the incorporation of artificial intelligence ("AI") solutions into our systems, could harm our business."

companyName: Cornerstone Building Brands, Inc.


text: Material Risks from Cybersecurity Threats Our operations and other aspects of our business rely heavily on various information technology systems, some of which are managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber attacks. These threats could disrupt our operations, lead to the loss of confidential information (such as the personally identifiable information of individuals, including our employees), and hinder our ability to process transactions with customers, operate our manufacturing facilities, and accurately report transactions in a timely manner. To manage these cybersecurity risks, our organization leverages the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We have implemented comprehensive policies and procedures that facilitate the timely identification and reporting of cyber incidents.

companyName: NEWMARKET CORP

ticker: NEU


text: The Bank's Information Security Department is led by the Bank's Chief Information Security Officer ("CISO"). The CISO reports to the Chief Information Officer ("CIO"), with an open line of communication to the Bank President. The Bank also has an internal cross-functional committee – the internal Technology and Operations Committee –which is responsible for, among other activities, overseeing information and cybersecurity risks and the steps taken by management to understand and mitigate such risk. This Committee reports to the Bank's Management Committee.

companyName: Federal Home Loan Bank of New York


text: >administering a series of processes and automated tools to monitor and alert for potentially malicious activities and vulnerabilities on our network, systems, applications and devices, with the ability to terminate processes and isolate potential vulnerabilities; >employing tools and controls to support our efforts in identity and access management, device and user management, and authentication;

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: The review of the security procedures and controls used by third parties that may host or otherwise have access to the Company's data. If necessary, the use of third-party security experts if and when an incident is detected.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Depending on the nature and severity of the reported cybersecurity incidents, the Enterprise Risk Management Committee may recommend activation of the Crisis Management Plan under the Company's Business Continuity Management Program. The Disclosure Committee is informed by the CEO of significant cybersecurity incidents for purposes of determining materiality.

companyName: MERCURY GENERAL CORP

ticker: MCY


text: Our overall cybersecurity program includes: security tools, technologies and processes and control reviews; cybersecurity awareness training exercises for our employees, including phishing simulations to raise internal awareness of manipulated electronic communications; and an annual review of System and Organization reports for critical third-party service providers.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: We recognize the importance of cybersecurity in achieving our business objectives, safeguarding our assets, and managing our daily operations. Accordingly, we integrate a process for identifying, assessing, and managing material risks from cybersecurity threats into our overall risk management system. The Audit Committee of our Board of Directors oversees all matters related to the security of and risks related to information technology systems and procedures, including cybersecurity policies and procedures.

companyName: EMCORE CORP


text: Cybersecurity Incidents. We have not experienced any material losses relating to cybersecurity threats or incidents for the year ended December 31, 2024. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the "Technology Risks" discussion within in Item 1. "Risk Factors".

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Park's Board of Directors recognizes the importance of cybersecurity in safeguarding sensitive information. The Board Risk Committee is responsible for overseeing Park's Enterprise Risk Management program which includes responsibility for cybersecurity. The Park information security and business continuity teams, both part of Park's Enterprise Risk Management, manage and oversee the Incident Response Plan and Cybersecurity Response Playbook. The Incident Response Plan and Cybersecurity Response Playbook guide Park's response to cybersecurity issues and events. The Board Executive Committee is engaged in the final determination of whether a cybersecurity issue or event is material, as discussed below. Park's Board of Directors is regularly apprised of cybersecurity risks. Park's information security team and cybersecurity operations team jointly prepare and issue a quarterly report to the full Board of Directors on the status of incidents, health of program, penetration testing results, risk assessments, identifying cybersecurity trends, internal data, issues, events, and key-risk indicator metrics.

companyName: PARK NATIONAL CORP /OH/

ticker: PRK


text: During 2024, we implemented and adopted several technologies to increase our cybersecurity defenses, including an Enterprise Resource Planning solution, a data control and backup solution, security in data access control (single sign-on and multi factor authentication), and data encryption. We also have a firewall installed in all our facilities.

companyName: Atlas Lithium Corp

ticker: ATLX


text: The Governance Committee of the Board of Directors maintains overall responsibility to oversee and assess the effectiveness of the Company's cybersecurity strategy. The Board meets quarterly and any potential threats are reviewed and discussed at that time, unless the information systems team and/or the CEO decide earlier notification is warranted.

companyName: UTAH MEDICAL PRODUCTS INC

ticker: UTMD


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity risk management program includes the following key components:

companyName: QUICKLOGIC Corp

ticker: QUIK


text: As far as internal training and compliance, we spend significant time and resources to communicate the Program to all team members via annual trainings, ongoing communications, and periodic testing of team member capabilities.

companyName: Rocket Companies, Inc.

ticker: RKT


text: Mid Penn's Information Technology and Security management team is responsible for implementing and executing the company's cybersecurity strategy on a day-to-day basis. This team of cybersecurity experts specializes in managing risks for financial services providers. The Chief Information Security Officer has 20 years of experience and is accompanied by an Information Security Officer with ten years of experience in the field. With over twenty years of experience providing secure networks for the banking industry, the Information Technology Operations Manager is highly skilled in network security and risk mitigation. Information Technology and Security management hold a monthly meeting to assess the organization's cybersecurity position and distributes information to the Board of Directors.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Our audit committee is responsible for overseeing our cybersecurity risk management processes, including regarding cybersecurity threats. Our CFO, Anshul Maheshwari, and Senior Vice President of Operations & Technology, Jeff Bertolini, provide briefings to our audit committee on the effectiveness and progress of our cybersecurity risk management program on regular basis. Mr. Bertolini has completed the Chief Technology Officer program at the Wharton School of the University of Pennsylvania and has over 30 years of experience leading all aspects of operations and IT. Our board of directors receives regular reports from our audit committee chair regarding our cyber risk management programs, potential cybersecurity risks, efforts to mitigate such risks, and the audit committee's oversight of these activities.

companyName: SI-BONE, Inc.

ticker: SIBN


text: Our approach consists of, among other things, cybersecurity threat and vulnerability prevention, detection, mitigation and remediation of potential cybersecurity risks.

companyName: Scienture Holdings, Inc.

ticker: SCNX


text: We have a special subcommittee of the Board of Directors with the goal of reviewing the Company's overall cybersecurity risk and response landscape. The special Cybersecurity subcommittee is comprised of board members with diverse expertise including risk management, technology and finance, with two members holding Cybersecurity Oversight Certificates issued by the National Association of Corporate Directors and Carnegie Mellon University.

companyName: CLEAN HARBORS INC

ticker: CLH


text: We monitor and respond to a range of cyber threats, including threats and incidents associated with the use of services provided by third-party providers. We utilize automation and artificial intelligence enabled tools to address threats. Our cybersecurity framework for handling cybersecurity threats and incidents includes steps for identifying the nature of a cybersecurity threat, assessing the severity of the threat (including advancing to key members of management where appropriate for determination of potential materiality) and implementing cybersecurity processes and procedures to address the threat.

companyName: Greenbacker Renewable Energy Co LLC


text: Risks from Cybersecurity Threats On February 16, 2022, we became aware of a cybersecurity intrusion that caused a network disruption and impacted certain of our systems. Upon detection, we took steps to address the incident, including engaging both internal resources and a team of third-party experts to investigate and respond to this intrusion. While the February 2022 cybersecurity intrusion did not materially and adversely affect our results of operations, such events have the potential to have a material adverse affect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. Such events could also damage our reputation and our competitive position and could result in litigation with third parties, regulatory action, loss of business, potential liability and increased remediation costs, any of which could have a material adverse effect on our financial condition and results of operations. Such security breaches could also result in a violation of applicable U.S. and international privacy and other laws and could have a material adverse effect on our business, results of operations and financial position. See "Risk Factors - Risks Related to Cybersecurity - The failure of our information technology systems, network disruptions, cyber-attacks or other breaches in data security could have a material adverse effect on our business, results of operations and financial position."

companyName: CENTURY ALUMINUM CO

ticker: CENX


text: We continue to face cybersecurity risks related to our business. While these risks have yet to materially affect us, we cannot guarantee that our ongoing and increasingly robust approach towards cybersecurity will be able to prevent cybersecurity incidents that could have a material adverse effect on us. For additional information about cybersecurity risks we face, see the risk factor item "Our business may be adversely affected by IT disruptions, including by impairing our ability to effectively deliver our products or services, which could cause us to lose customers" in Item 1A-Risk Factors.

companyName: Ultra Clean Holdings, Inc.

ticker: UCTT


text: The Board holds oversight responsibility over our strategy and risk management, including material risks related to cybersecurity threats. This oversight is executed directly by the Board through management. Our management, represented by our Chief Financial Officer, Brent Winn, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Mr. Winn is an experienced compliance and risk management professional and has served as Chief Financial Officer since September 2020. Mr. Winn currently oversees key functions for our company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Winn leads our cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Our management will report any material cybersecurity incidents to our Board.

companyName: Medalist Diversified, Inc.

ticker: MDRR


text: We use a risk-based approach to identify, assess, protect, detect, respond to and recover from cybersecurity threats, derived from the Committee of Sponsoring Organizations of the Treadway Commission ("COSO") framework. Our information security program includes, among other aspects, vulnerability management, antivirus and malware protection, access control, and employee training. Risks identified by the Director of IT and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The Director of IT also routinely discusses trends in cyber risks and our strategy with our Cybersecurity Committee and management on a regular basis, in addition to an annual review and discussion with the full board.

companyName: FGI Industries Ltd.

ticker: FGI


text: Although we have implemented what we believe to be an appropriate information security program to protect against, detect, mitigate, and respond to cybersecurity risks, there can be no assurance that such risks, including incidents, may be prevented or timely detected. During the year ended December 31, 2024, we did not experience any material cybersecurity incidents, including cybersecurity incidents that materially affected or are reasonably likely to materially affect the Company, our business strategy, results of operations, or financial condition. See "Risk Factors—Risks Relating to the Operation of Our Business—The security of our information technology systems may be compromised and confidential information, including non-public personal information that we maintain, could be improperly disclosed."

companyName: Essent Group Ltd.

ticker: ESNT


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are periodically reported to the Audit Committee and the Board of Directors, and the Company adjusts its cybersecurity policies, standards, processes and practices as appropriate based on the information provided by these assessments, audits and reviews.

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: As of the date of this report, other than with respect to the Cyber Incident, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. For more information on the Cyber Incident, see Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Cyber Incident". Despite our security measures, however, there can be no assurance that we, or third parties with whom we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors," including "Security vulnerabilities or control failures in our IT infrastructure or multicloud application delivery and security products and services as well as unforeseen product errors could have a material adverse impact on our business, results of operations, financial condition and reputation," and "The Cyber Incident has had and may continue to have an adverse effect on our business, reputation, customer, employee and partner relations, results of operations, financial condition and cash flows."

companyName: F5, INC.

ticker: FFIV


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, notification from external parties (e.g., our third-party information technology provider), and proactive threat hunting in conjunction with our external partners. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event.

companyName: Public Storage

ticker: PSA


text: The Bancorp's Information Technology ("IT") and Information Security ("IS") teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp's Information Technology and Cybersecurity Risk Management ("IT CSRM") team, as part of the Bancorp's Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp's Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.

companyName: FIFTH THIRD BANCORP

ticker: FITB


text: Structured Framework: Our company-wide cybersecurity policy outlines our security posture and incident response protocol, ensuring clear escalation procedures to inform senior management, the Audit Committee, and the Board of Directors of cybersecurity events as needed.

companyName: SES AI Corp

ticker: SES


text: While processes are in place to minimize the chance of a successful cyberattack, the Company has established incident response policies and procedures to address a cyber threat that may occur despite these safeguards. In these instances, the Company maintains a cybersecurity incident response policy (the "Incident Response Policy") and cybersecurity incident response plan (the "Incident Response Plan") to help ensure a timely, consistent and compliant response to actual or attempted cybersecurity incidents impacting the Company. The Incident Response Plan includes (1) detection, (2) analysis, which may include timely notice to the Audit Committee of our Board if deemed material or appropriate, (3) containment, (4) eradication, (5) recovery and (6) post-incident review. The Incident Response Plan includes leveraging the Company's cross-functional Cybersecurity Incident Committee that is supported by an organizational structure that includes executives across the Information Security, ERM, Finance, Legal, and Investor Relations functions of the business. The Cybersecurity Incident Committee is responsible for assessing the materiality of any cybersecurity incidents and for communicating any such incidents to the appropriate parties outside the Company.

companyName: ModivCare Inc

ticker: MODVQ


text: Our risk management team and information security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We leverage the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines subcategories of security controls and outcomes over five functions: identify, protect, detect, respond, and recover.

companyName: Century Communities, Inc.

ticker: CCS


text: Our cybersecurity risk management processes include the following: a. We leverage the NIST framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. To that end, we regularly monitor the need and implementation of enhancements to security infrastructure, legacy system replacement, emerging technology risk assessment and security integration.


text: The audit committee of our Board oversees our enterprise risk management process, which includes risks from cybersecurity threats. The audit committee regularly receives reports from management with respect to risks from cybersecurity threats and quarterly reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives with the CTO. These risks and mitigation strategies are also periodically reviewed by the entire Board.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: Our senior executive team is responsible for the coordination of cybersecurity across the Company. Our cybersecurity teams, which include employees with appropriate professional certifications, are responsible for assessing and managing our cyber risk management protocols in their respective areas. These activities include the prevention, detection, mitigation, and remediation of material cybersecurity incidents as well as communicating risk management matters to key stakeholders. The cybersecurity teams have experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes, and rely on threat intelligence as well as other information obtained from governmental, public, or private sources. In coordination with our senior management, the relevant cybersecurity teams review risk management strategies to mitigate cybersecurity risks. Additionally, as needed, we engage specialists, consultants, auditors, and (or) other third parties to assist with assessing, identifying, and managing cybersecurity risks.

companyName: Talen Energy Corp

ticker: TLN


text: The Board oversees risks from cybersecurity threats through the same framework it uses to oversee the management of our risk exposure in general. Cybersecurity risks, including operations disruptions, outdated enterprise software and damage reputation, have been specifically incorporated into our enterprise risk management processes. These risks are scored based on impact, likelihood and established controls. Action plans are then established for each of the risks and are incorporated into objectives. Risks are then tracked and integrated into reporting and disclosure processes. Risks are reviewed at least bi-annually by a committee made up of representatives from finance, internal audit, treasury, operations, legal and others. Management at least annually provides to the Board updated information concerning cybersecurity threats, as well as management's efforts to mitigate such threats. The Board then is responsible for overseeing that management responds appropriately. The Audit Committee, which is made up solely of independent directors, is responsible for overseeing Company policies and practices with respect to cybersecurity issues.

companyName: GRAFTECH INTERNATIONAL LTD

ticker: EAF


text: We use a comprehensive due diligence process to manage third-party risks, emphasizing continuous monitoring and to ensure our business partners' cybersecurity practices meet our stringent standards.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Audit Committee and the Board actively participate in discussions with management and amongst themselves regarding cybersecurity risks. The Audit Committee's semi-annual cybersecurity review also includes review of recent enhancements to the Company's defenses and management's progress on its cybersecurity strategic roadmap. In addition, the Cybersecurity Steering Committee receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and may discuss recent threats and how the Company is managing those threats.

companyName: Workhorse Group Inc.

ticker: WKHS


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing our strategic risk exposure, and our executive officers are responsible for day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk-oversight function as a whole, as well as through the audit committee.

companyName: Sharplink, Inc.

ticker: SBET


text: We use industry recognized cybersecurity frameworks and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Recognizing that the nature of cybersecurity threats and the particular threat vectors we face continually change, our board, audit committee, senior management, and information technology team continually evaluate and invest in updating and enhancing our Cybersecurity Program.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Management of Material Risks & Integrated Overall Risk Management Assessing, identifying, and managing cybersecurity risks is integrated into our overall risk management framework. The Cybersecurity Program is integrated into the Company's Enterprise Risk Management ("ERM") program and framework. Together, these programs are designed to foster a company-wide culture of cybersecurity risk management. Our Information Security team works closely with stakeholders across technology, legal, risk, and business units to implement and monitor controls. See "Governance" below for additional information on processes used by management to monitor cybersecurity incidents.

companyName: Live Oak Bancshares, Inc.

ticker: LOB


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") for Legal & Regulatory Affairs and General Counsel ("GC") and the SVP overseeing cybersecurity ("SVP Sponsor").

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: Our cybersecurity program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. To this end, we have implemented a cybersecurity program that includes the following elements: A Cybersecurity Manager responsible for developing and maintaining our administrative, technical, and physical cybersecurity controls. Risk assessments designed to identify material cybersecurity risks to our critical systems and information. A Security Operations Center (SOC) to monitor our critical infrastructure and execute immediate, human-led responses to confirmed threats. External technology and security providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity program.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a large library of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber intelligence, insights and assessments of its cybersecurity risk posture and governance.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: On an annual basis, our board of directors receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our board of directors generally receives materials that include a cybersecurity scorecard and other materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Vice President, Information Technology. Our board of directors also receive prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: G1 Therapeutics, Inc.


text: We depend on our information technology to conduct our business operations. This technology is predominantly operated on third-party platforms and services. Our business servers are owned and managed by an experienced third-party provider that addresses issues promptly in the event of a cybersecurity threat or incident.

companyName: Lowell Farms Inc.

ticker: LOWLF


text: Our legal department, a management committee (composed of our Senior Vice President and General Counsel, our Chief Financial Officer, and our Vice President, Finance and Controller) and a third-party service provider (collectively, the "Cybersecurity Risk Management Team") help identify, assess and manage the Company's cybersecurity threats and risks. Our Cybersecurity Risk Management Team identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual tools, automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal audits, conducting third party threat assessments, and conducting vulnerability assessments to identify vulnerabilities.

companyName: Regulus Therapeutics Inc.


text: Education and Awareness. PMI regularly and annually provides its in scope workforce with mandatory cybersecurity awareness education and training addressing information security related tasks in line with our evolving information security policies, standards, procedures, and practice as well as supplemental role-based training and awareness programs.

companyName: Philip Morris International Inc.

ticker: PM


text: Both the Board and the Audit Committee play an important role in the Board's oversight of cybersecurity threats. The Audit Committee receives periodic updates on the Company's risk profile and mitigation strategies and conducts forward-looking discussions about major IT changes that are planned, the risks involved and the Company's potential mitigation strategies. The Audit Committee shares updates with the broader Board. We presently have three Directors, Ann Bordelon, Chair of the Audit Committee, Paulette Dodson, and Noah Glass, who have cybersecurity risk management experience and we continue to monitor whether supplemental experience may be useful as cybersecurity threats continue to evolve.

companyName: Portillo's Inc.

ticker: PTLO


text: The Audit Committee has the primary responsibility of assisting our Board of Directors in overseeing risk related to cybersecurity matters. The Board and/or the Audit Committee receive quarterly cybersecurity-related reports from our Chief Information Officer (CIO), which may address a wide range of topics, such as: cybersecurity strategy, the threat environment, the status of ongoing information security program initiatives, and information security program metrics. Additionally, we have documented protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Board and/or the Audit Committee.

companyName: GARTNER INC

ticker: IT


text: Our CISO is a certified information security manager, and has primary responsibility for our cybersecurity program, and the management and oversight of our information security department. Our CISO has more than 20 years of experience in information technology, including 13 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment. Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties. Findings are actioned on throughout the year and reported to various committees. The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center.

companyName: FIRST MERCHANTS CORP

ticker: FRME


text: CTO's President and Chief Executive Officer, Senior Vice President, Chief Financial Officer and Treasurer, and Senior Vice President, General Counsel and Corporate Secretary each hold degrees in their respective fields, and have an average of over 20 years of experience managing risks at CTO, the Company and similar companies, including risks arising from cybersecurity threats.

companyName: Alpine Income Property Trust, Inc.

ticker: PINE


text: We use third-party service providers to perform a variety of functions throughout our business, such as account management, payment processing, cloud-based infrastructure, data center hosting, and content delivery to customers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the provider.

companyName: Sweetgreen, Inc.

ticker: SG


text: Our cybersecurity risk management efforts leverage the National Institute of Standards and Technology (NIST) cybersecurity framework, that also aligns with the SP800-53 r5 Information Security controls framework. Our cybersecurity personnel identify and assess risks using various methods and security tools designed to help prevent, identify, protect, detect, escalate, respond, and recover from identified vulnerabilities and security incidents in a timely manner.

companyName: INTELLINETICS, INC.

ticker: INLX


text: Employees are the first line of defense against cybersecurity measures. Each employee is responsible for protecting Company and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.

companyName: NB Bancorp, Inc.

ticker: NBBK


text: Cybersecurity Incident Reporting and Management We have not experienced any cybersecurity incidents that have a material impact on our business strategy, results of operations, or financial condition. Nor have we identified vulnerabilities to known threats that are reasonably likely to materially affect the same. However, we remain vigilant and prepared to respond effectively to any incidents, should they arise.

companyName: Maiden Holdings, Ltd.

ticker: MHLA


text: In addition, we collaborate with third party software as a service providers and other service providers to maintain policies and procedures governing our third-party security risks. We evaluate and ensure such third parties maintain appropriate security controls to protect our confidential data, and notify us of material data breaches that may impact our data.

companyName: Karat Packaging Inc.

ticker: KRT


text: Our information security program is overseen by our Executive Director of Information Technology ("IT"). The Executive Director of IT reports to the Chief Financial Officer and oversees the team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, and processes. The Executive Director of IT possesses over twenty-five years of experience in information technology and approximately ten years in cybersecurity risk management.

companyName: Xeris Biopharma Holdings, Inc.

ticker: XERS


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: The board oversees cybersecurity risk management by evaluating whether management has current cybersecurity policies and procedures, regularly assesses, and monitors cybersecurity risks and receives regular reports on the organization's cybersecurity posture.

companyName: CXApp Inc.

ticker: CXAI


text: In addition, our management team has established an Enterprise Risk Management Program (the "ERM Program"), which includes processes designed to identify, assess, categorize, and monitor key current and evolving risks facing AppFolio, including cybersecurity risks. Management is made aware of current and evolving cybersecurity risks through ERM Program reporting. Furthermore, in the event of a material or potentially material cybersecurity event, senior members of management are promptly informed of such event and oversee triage, response, and disclosure efforts pursuant to the terms of a documented incident response plan.

companyName: APPFOLIO INC

ticker: APPF


text: IT leadership will, as required, present to the IT steering committee, information regarding any IT risks identified and the mitigation plans to reduce the Company's residual risks. The IT steering committee will be regularly updated as to the occurrence, mitigation and resolution of cyber security incidents. Any cyber security incident that is considered significant in nature will be shared by IT leadership with the IT steering committee in accordance with the agreed communication and escalation processes. The IT steering committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.

companyName: INNOSPEC INC.

ticker: IOSP


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our Enterprise Risk Management Assessment framework. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence.

companyName: A10 Networks, Inc.

ticker: ATEN


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: As a component of our overall risk management system and processes, we have a risk-based cybersecurity program, dedicated to protecting our data as well as data belonging to consumers (including UWC Members), employees and suppliers. We devote significant resources and utilize a defensive in-depth strategy, with multiple layers of security controls to protect the security of our computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of all information we own, or is in our care, and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage. These processes include technical, administrative and physical controls and processes, as well as contractual mechanisms to mitigate risk. We also have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including the regular review of System & Organization Controls ("SOC") reports, relevant cyber attestations, and other independent cyber ratings.

companyName: Mister Car Wash, Inc.

ticker: MCW


text: Business Continuity and Incident Response plans have been cohesively established and employed to provide frameworks for responding to and recovering from events such as natural disasters or security events. Our Director of Business Continuity and CISO, respectively, are responsible for the facilitation of these plans, as needed, and testing each on at least an annual basis. The owners of these plans are responsible for identifying an appropriate group of cross-enterprise subject matter experts and convening them to ensure a comprehensive response. These groups, under the leadership of our Chief Operations Officer ("COO"), provide appropriate internal notifications of material security events and response activities to our General Counsel, Chief Risk Officer, Chief Executive Officer, and board of directors or other appropriate corporate executives.

companyName: Business First Bancshares, Inc.

ticker: BFST


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, our results of operations or our financial condition under the heading "We face risks associated with security breaches or cyberattacks" included as part of our risk factors disclosures in "Item 1A. Risk Factors" of this Annual Report on Form 10-K.

companyName: SYNAPTICS Inc

ticker: SYNA


text: Risk Management and Strategy MPC has processes in place designed to protect our information systems, data, assets, infrastructure and computing environments from cybersecurity threats and risks while maintaining confidentiality, integrity, and availability. These enterprise-wide processes are based upon policies, practices and standards that guide MPC on identifying, assessing, and managing material cybersecurity risks and include, but are not limited to: • placing security limits on physical and network access to our information technology ("IT") and operating technology ("OT") systems; • employing internal IT and OT controls designed to detect cybersecurity threats by collecting and analyzing data in MPC's centralized cybersecurity operations center; • utilizing layers of defensive methodologies designed to facilitate cyber resilience, minimize attack surfaces, and provide flexibility and scalability in MPC's ability to address cybersecurity risks and threats; • providing cybersecurity threat and awareness training to employees and contractors; • limiting remote network access to our IT and OT network environments; and • assessing our cybersecurity resiliency through various methods, including penetration testing, tabletop exercises with varying scenarios and participants ranging from individuals on our operations teams to executive leadership, and analyzing our corporate cybersecurity incident response plan.

companyName: MPLX LP

ticker: MPLX


text: As a small company our IT systems and assets are limited mainly to accounting and administrative systems and email communications, all of which are cloud based.

companyName: VYCOR MEDICAL INC

ticker: VYCO


text: Our CIO and our Vice President of IT ("VP of IT") are primarily responsible for our overall information security, strategy, policy, security engineering, operations and cybersecurity threat detection and the management of cybersecurity risks. Our CIO and VP of IT, collectively, have over fifty years of experience working in the information technology and cybersecurity field and have extensive experience assessing and managing cybersecurity and information technology programs and cybersecurity risk. Our CIO and VP of IT hold degrees in the information technology and cybersecurity fields, as well as hold certain cybersecurity and other relevant technology certifications. The CIO meets with our Chief Executive Officer ("CEO"), on a weekly basis, and the CFO, on a monthly basis, to discuss all relevant business risks, including cybersecurity risks and threats. In addition to regular reports from our CIO and vice president of internal audit regarding our program for managing our information security risks, including data privacy and protection risks we face, the CIO and VP of IT also meet quarterly with the Risk Committee to inform them of current cybersecurity risks and threats, as well as cybersecurity enhancement projects. Our full board of directors receives an annual update regarding the current cybersecurity environment from our CIO, which may include presentations from external consultants. Our Enterprise Risk Management ("ERM") committee, which includes several members of senior management, including our CFO, our CIO, and a Certified Information Systems Auditor, also presents all of our top organizational and operational risks, including information security-related risks, focus areas and accomplishments throughout our various businesses, to the Risk Committee on a quarterly basis.

companyName: Ryman Hospitality Properties, Inc.

ticker: RHP


text: We have developed a well-defined and frequently updated information security incident response plan that outlines procedures to be followed in the event of a cybersecurity incident. The plan is periodically drilled with incident response team members and includes robust processes for identification, categorization, escalation and reporting of incidents. Team members are regularly trained on key cybersecurity subjects to ensure awareness. In June 2024, a cybersecurity incident occurred involving CDK, a third-party provider of certain information systems used by us, that triggered our information security incident response plan. Although the incident disrupted our operations, we believe our response plan operated substantially as we intended and the incident did not materially impact our financial condition or results of operations. The incident, however, provided us an opportunity to test our response plan, refine our procedures and consider improvements.

companyName: LITHIA MOTORS INC

ticker: LAD


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Our batteries and our website, systems and data we maintain may be subject to intentional disruption, other security incidents or alleged violations of laws, regulations or other obligations relating to data handling that could result in liability and adversely impact our reputation and future sales."

companyName: Enovix Corp

ticker: ENVX


text: The Strategy and Risk Committee of the board of directors is composed of board members with diverse experience that allows them to oversee cybersecurity risks effectively. We have a Vice President, Information Technology with over 20 years of experience at Koppers in various positions of increasing responsibility within the IT function, working on initiatives related to enterprise resource planning systems, mobile computing, data analytics, SOX compliance, and cybersecurity. Prior to working at Koppers, the Vice President, Information Technology worked at a global technology consulting company implementing software solutions. This position plays a pivotal role in informing management, the Strategy and Risk Committee and the board of directors on cybersecurity risks. An update on the cybersecurity program is provided to the board of directors quarterly. As of the date of this report, we have not experienced a material information security incident.

companyName: Koppers Holdings Inc.

ticker: KOP


text: Key elements of our cybersecurity risk management program include: • Risk Governance – A structured set of cybersecurity policies, standards and guidelines, including incident response and disaster recovery procedures, to help the organization meet compliance and business goals. We update policies periodically based on evolving regulatory and threat landscapes. • Risk Identification – We leverage a set of tools designed to identify cyber security risks and manage vulnerabilities according to impact and likelihood. • Risk assessments - Designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • Risk Response - A security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents. • External Service Providers - We utilize external service providers, where we consider appropriate, to assess, test or otherwise assist with aspects of our security controls. • Risk Monitoring and Review – Monitoring of threats through threat intelligence feeds and security tools, the use of a Security Information and Event Management (SIEM) system for real-time detection, and periodic reassessments of risks as technology and threat landscapes evolve. • Training and Awareness – A dynamic role-based cybersecurity awareness training of our employees, incident response personnel, and senior management; • Incident Management – Protocols that are designed to respond to cybersecurity incidents, including procedures for response, containment, eradication, and recovery. • Integration with Business Strategy – Cybersecurity risk considerations are factored into key business decisions and strategies, and cybersecurity initiatives are aligned with organizational risk appetite and priorities.

companyName: StandardAero, Inc.

ticker: SARO


text: The CISO and ISSO are to report to other members of senior management on a regular basis regarding all aspects of the organization's information systems posture. Our internal employees and users are responsible for adhering to the organization's information security policies, procedures, practices, and not undertaking any measure to alter such standards on any information systems. Additionally, end users are to report instances of non-compliance to senior authorities, specifically those by other users. End users – while undertaking day-to-day operations – may also notice issues that could impede the safety and security of our information systems and are to also report such instance immediately to senior authorities. Our vendors, contractor and other third-party entities are responsible for adhering to the organization's information security policies, procedures, practices, and not undertaking any measure to alter such standards on any such system components.

companyName: Cycurion, Inc.

ticker: CYCU


text: The Bank's risk management program and strategy are designed to ensure confidential information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Bank's information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Bank and customer information. Minimally, these controls include identity and access management, data encryption, data loss prevention, incident response, security monitoring and alerting, third party risk management, and vulnerability management.

companyName: GUARANTY BANCSHARES INC /TX/


text: In many instances we rely on third-party providers to facilitate providing products and services to our customers. As a part of our overall cybersecurity risk management framework and, in addition to assessing our own cybersecurity preparedness, we also have a process in place to manage cybersecurity risks associated with third-party service providers. To help mitigate adverse impacts from a cybersecurity incident, we assess third-party vendors as a part of our vendor onboarding and continued due diligence which includes processes to assess information security posture. Depending upon the level of perceived security risk, we may impose security requirements upon a supplier, including: maintaining an effective security management program; abiding by information handling and asset management requirements; and notifying us in the event of any known or suspected cyber incident. We periodically conduct (or engage a third party to conduct) reviews of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of hosted applications, depending upon the level of risk, are required to provide a report as to their controls (e.g., a System and Organization Controls (SOC) 2 or ISO 27001 (Information and Security Certification) or similar report).

companyName: UNITED COMMUNITY BANKS INC

ticker: UCB


text: We have experienced cyber-attacks or other malicious activities that disrupted our business in the past. Any future failure or disruption of our information technology infrastructure and communications systems or those of third parties that we use in our operations could harm our business in the future. On February 23, 2023, we experienced a network outage that affected its internal servers and IT telephony. We immediately activated our incident response and business continuity plans designed to contain, remediate and recover from the situation. We engaged the services of certain cyber-security experts and outside advisors to assist in the evaluation of the situation, and once we determined that the outage was due to a cybersecurity incident, we promptly notified appropriate law enforcement authorities. In addition, on February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems.

companyName: DISH DBS CORP


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2023, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Seer, Inc.

ticker: SEER


text: The Company's cybersecurity strategy and risk management is overseen by the Board of the Directors (the "Board") and implemented and managed by the Company's Enterprise Information Security Steering Committee, a cross-functional team of senior executives representing business functions across Robert Half and chaired by the Chief Information Security Officer ("CISO"). The CISO oversees the Enterprise Information Security team ("EIS").

companyName: ROBERT HALF INC.

ticker: RHI


text: The CISO manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO and cybersecurity teams hold relevant certifications, including, but not limited to, Certified Information Systems Security Professional, Security+ Certification, Factor Analysis for Information Risk Analyst, Certified Information Systems Auditor, Security Systems Certified Practitioner or Certified Federal Information Security Management Act Compliance Practitioner. We also supplement our cybersecurity program with third-party experts, who provide assessments of our program, testing of our environment, monitoring support, as well as insights into evolving trends in this space.

companyName: AVIENT CORP

ticker: AVNT


text: The Bank, as part of its risk management process, has implemented an information security program that encompasses the Bank's cybersecurity efforts. The Bank's goals of confidentiality, availability and integrity of its information are key to this process and program. The Bank's goals of protecting confidential information and safeguarding our digital assets are foundational objectives of the program.

companyName: PEOPLES FINANCIAL CORP /MS/

ticker: PFBX


text: We routinely conduct thorough security assessments of our third-party service providers that have access to our electronic information (including data centers operated by third parties and cloud computing platforms) and we maintain policies and procedures to oversee and identify cybersecurity risks associated with our use of third-party service providers. Our policies and procedures also include technical controls and processes, as well as contractual mechanisms to mitigate risk. Assessments are performed biannually by the Cybersecurity Leadership Team and on a regular basis by their staff.

companyName: CubeSmart

ticker: CUBE


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.

companyName: American Outdoor Brands, Inc.

ticker: AOUT


text: We seek to routinely refine our cybersecurity approach to adapt to changes in the threat landscape and manage emerging security risks. In order to evaluate risks from cybersecurity threats associated with the company's use of certain third-party technology providers, we have incorporated a risk-based assessment into the corporate information technology (IT) procurement process designed to assess the security risk of certain third parties providing new technology solutions to our environment.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: The IPRC is the management-level governance body that oversees our management of cybersecurity threats and data privacy risks and supports the strategic goals of our information security programs. The IPRC also oversees the appropriate remediation and response to cybersecurity incidents in accordance with applicable legal and regulatory requirements as well as our Information Security Incident Response Plan. The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, Wyndham Destinations, the CTO, and General Counsel and Corporate Secretary. The IPRC members include our CISO, the senior legal officer in the privacy function, the business segments general counsel, the Chief Accounting Officer, and the Managing Director RCI North America & Global Marketing and Operations. The CISO leads a team of information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading "Cybersecurity Risk Management and Strategy."

companyName: Travel & Leisure Co.

ticker: TNL


text: Our efforts are led by ACV's Chief Information Officer ("CIO") who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Luxfer's IT Steering Committee continues to carry out internal phishing simulations to engage employees with cybersecurity, raise awareness, and educate employees on how to recognize and report phishing attacks. Through the simulations, we are able to test our employees' reaction to phishing emails and collect important metrics such as click rate. Data collection allows us to pinpoint trouble spots and target additional trainings to specific teams or locations. This information is also reported once to Luxfer's Senior Leadership Team and is an important supplement to our overall IT security training program.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR