text: We rely upon the capacity, availability and security of our information technology hardware and software infrastructure. We maintain comprehensive compliance and security programs designed to help safeguard and ensure the integrity of the confidential information we possess, which includes both organization and technical control measures. We routinely conduct employee trainings on important information security procedures and test and measure compliance with these security measures. In addition, we maintain cyber insurance policies that mitigate the financial risk of any potential incident.

companyName: RIGEL PHARMACEUTICALS INC

ticker: RIGL


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.

companyName: GAXOS.AI INC.

ticker: GXAI

secItem: Item 1C


text: The Board, in coordination with the Audit Committee, oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a regular basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with the Company's cyber team and senior leadership team.

companyName: Axogen, Inc.

ticker: AXGN


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, our IT department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: At Urgently, we understand the paramount importance of cybersecurity in safeguarding our operational integrity, customer information, and proprietary data. Our commitment to cybersecurity excellence involves a comprehensive approach to risk management and the continual enhancement of our cybersecurity protocols to address the dynamic nature of cyber threats.

companyName: Urgent.ly Inc.

ticker: ULY


text: Risk Mitigation and Management: A range of controls and measures are implemented to mitigate identified risks, incorporating technical and procedural safeguards.

companyName: Paragon 28, Inc.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee reports to the full Board annually regarding cybersecurity.

companyName: 374Water Inc.

ticker: SCWO


text: We also maintain policies and procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material security risks.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: As part of the cybersecurity risk management program, the Company utilizes cybersecurity assessors, consultants, auditors, and other third parties to assist the internal team with network security, cloud security, endpoint security, data loss prevention, and security information and event management. In addition, the Company utilizes a variety of third-party technology, information systems, and service providers to help identify, isolate, and mitigate security incidents. The Information Security team retains external cybersecurity firms to review and provide feedback on improving our cybersecurity program, including in the areas of data protection, threat and vulnerability management, and end-point protection. Tabletop exercises are conducted to prepare for potential cyber incidents and assess preparedness and processes. Cybersecurity training is provided to users of the Company technology resources, regular simulated exercises are conducted to help recognize phishing emails and other social engineering tactics and provide various methods for users to report suspicious activity that may give rise to a cyber incident or threat. Significant results of such testing and reviews are communicated to our executive management team and our Audit Committee, as applicable, and are utilized in our cybersecurity program's continuous improvement process.

companyName: Spectrum Brands Holdings, Inc.

ticker: SPB


text: >purchase and contracting controls aimed at preventing our entry into purchases or service arrangements: with entities blocked or banned by OFAC or the Federal Trade Commission; or outside of manufacturer authorized distribution channels; and >education of our employees, including cybersecurity-related training and periodic reminders and promotions regarding potential risks.

companyName: COPT DEFENSE PROPERTIES

ticker: CDP


text: Threats and Incidents To date, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. During fiscal 2024, fiscal 2023 and fiscal 2022, the Company did not experience any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations and/or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents or provide assurances that we have not experienced undetected cybersecurity incidents. For additional details regarding the risks the Company faces from cybersecurity threats, see "ITEM 1A. RISK FACTORS — Risks Related to Our Business — Our operations, financial condition or reputation may be impaired if our information or operational technology systems fail to perform adequately or if we are the subject of a data breach or cyber-attack" in this Form 10-K.

companyName: SCOTTS MIRACLE-GRO CO

ticker: SMG


text: The CIO has over 30 years of combined accounting, financial consulting, IT and Committee of Sponsoring Organizations (referred to as COSO) risk-based operational, financial and IT auditing experience, and has had oversight over the Company's cybersecurity activities as CIO for more than five years. The Corporate Control Systems, Advanced Process Controls and Cybersecurity Lead has over 30 years of experience overseeing the Company's refining operational technology systems and serves as the Company's refining operational technology cybersecurity leader. The General Manager, Control Center Operations, has over 10 years of pipeline control systems experience and serves as the Company's midstream operational technology cybersecurity leader.

companyName: HF Sinclair Corp

ticker: DINO


text: Autoliv has not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the registrant. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with or effective in protecting our systems and information. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. For a full discussion of these cybersecurity risks, please see our Risk Factors in Item 1A.

companyName: AUTOLIV INC

ticker: ALV


text: The Audit Committee of the board of directors has oversight of the Company's risk management, including cybersecurity. The Company's senior officers, including its Vice President, Information Technology, are responsible for cybersecurity risk management and regularly communicate with the Audit Committee and the board of directors regarding risks and threats, including the status of current cybersecurity risk prevention and threat detection efforts. Magnolia's Vice President, Information Technology, is the primary individual responsible for assessing and managing cybersecurity risks. He has extensive experience managing information technology departments of oil and gas organizations. This includes responsibilities for securing the solutions, data, and infrastructure for both corporate and field operations technology. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: Reporting to Board of Directors Our CISO, in her capacity, regularly informs our Chief Financial Officer (CFO), GC & CCO, COO and CEO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing Flywire. Furthermore, our CISO reports to the Board of Directors at a minimum twice a year, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity matters, and strategic risk management decisions.

companyName: Flywire Corp

ticker: FLYW


text: The Audit Committee has primary oversight of management's efforts to mitigate cybersecurity and technology risk and respond to cyber incidents. The Audit Committee receives updates throughout the year from the CIO and CSISO on cybersecurity and grid security issues, including compliance with regulations, employee training, and drills, at every regularly scheduled Audit Committee meeting, and engages in discussions throughout the year with management on the effectiveness of Duke Energy's overall cybersecurity program and progress for addressing any identified risks. In 2023, the Audit Committee received four updates on cybersecurity. The Audit Committee also receives periodic updates on Duke Energy's digital transformation and the operation of, and enhancements to, the Company's financial systems and business and operational technical systems. The reviews presented to the Audit Committee are followed with an update to the full Board of Directors by the Chair of the Audit Committee.

companyName: PROGRESS ENERGY INC


text: Define security expectations within the vendor contract including data security obligations, access controls, incident reporting procedures, security assessment calls if necessary and review of incident response plan, business continuity and disaster recovery plan.

companyName: C3.ai, Inc.

ticker: AI


text: The Audit Committee of our Board of Directors oversees our ERM program regarding material risks arising from cybersecurity threats impacting our business. Management provides quarterly reporting on our material enterprise risks to the Audit Committee. In addition to material risks identified through the ERM process, our information technology management provides periodic reporting, at least semi-annually, on our cybersecurity risk profile and risk mitigation strategies to the Audit Committee. This reporting is also made available to the full Board of Directors.

companyName: REGENXBIO Inc.

ticker: RGNX


text: Our CIO has served in various roles in information technology and information security for over 20 years, including serving in senior leadership roles overseeing information technology systems, including previous service at a company in our industry. Our CIO serves on the board of directors of the Chicago chapter of the Society for Information Management where he has the opportunity to interact with senior IT leaders throughout the technology and business fields, including in the industry, government and academic sectors.

companyName: POTBELLY CORP

ticker: PBPB


text: Our Board of Directors has overall oversight responsibility for our enterprise risk management and compliance programs, including cybersecurity. Our Board is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which we are exposed, implement the appropriate protections to address such risks, identify cybersecurity threats and respond to and resolve cybersecurity incidents.

companyName: MASCO CORP /DE/

ticker: MAS


text: Cybersecurity Systems Review. We regularly review our cybersecurity systems, policies and procedures through a series of channels, including but not limited to our Audit Committee and Board of Directors, the BrightSpire IT Partner, our internal Information Security Group, our independent financial auditor, and outside counsel.

companyName: BrightSpire Capital, Inc.

ticker: BRSP


text: Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns (including data privacy risk management) and the steps management has taken to monitor and control such exposures with management. As part of this oversight, the Audit Committee reviews the results of a biannual risk assessment designed to identify and analyze risks to achieving the Company's business objectives, including material risks from cybersecurity threats. The results of the biannual risk assessment are discussed with management and used to develop the Company's internal audit plan.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: An external managed security services provider and industry-leading security tools continuously monitor the Company's systems and network for cybersecurity threats. The Company's cybersecurity teams evaluate the escalated threats, and if necessary, take steps to contain and recover from pervasive threats in accordance with the Company's Security Incident Response Plan. The plan includes reporting and escalation procedures to inform the Executive Committee, Audit Committee, and full Board, as appropriate to enable them to carry out their oversight responsibilities, and to ensure timely compliance with applicable reporting rules. The Company's Business Continuity Management and Disaster Recovery plans include procedures for business recovery and are tested regularly.

companyName: TRACTOR SUPPLY CO /DE/

ticker: TSCO


text: Ventures Corp. acknowledges the crucial necessity of establishing, executing, and sustaining strong cybersecurity measures to secure our information systems. This is undertaken to uphold the confidentiality, integrity, and accessibility of our data.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having a third-party independent Risk Assessor review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.

companyName: Hyperfine, Inc.

ticker: HYPR


text: Our Executive Vice President of Technology has extensive cybersecurity knowledge and skills gained from over five years of work experience on the security team at IRT and an extensive career in the technology and cybersecurity industries as a President and Chief Information Officer at Results Theory, Inc.. Our Executive Vice President of Technology heads the team responsible for implementing and maintaining cybersecurity and data protection practices at IRT and reports directly to the Chief Financial Officer.

companyName: INDEPENDENCE REALTY TRUST, INC.

ticker: IRT


text: During the year ended June 30, 2025, we did not identify any cybersecurity threats at the Sponsor or the Trust that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, even though we take steps to employ reasonable cybersecurity efforts, not every cybersecurity incident can be prevented or detected. Therefore, while we believe there are currently no risks from any potential cybersecurity threat or cybersecurity incident that are reasonably likely to have a material effect on our results of operations or financial condition, the likelihood or severity of such risks are difficult to predict.

companyName: Grayscale Litecoin Trust (LTC)

ticker: LTCN


text: The Company established a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology. The Company's cybersecurity risk management framework is integrated with the Company's Enterprise Risk Management ("ERM") process that is subject to oversight by the Board. Cybersecurity risks are one of the key risks regularly evaluated, assessed and monitored as part of the Company's overall ERM process.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: The Board of Directors (the "Board") is entrusted with the oversight of the management of cybersecurity risk and our cybersecurity program. The Board administers this oversight through its audit committee and the ITSRC. The ITSRC committee chair is responsible for reporting to the Board's audit committee with respect to cybersecurity at least twice per calendar year. The audit committee, as necessary, reports any findings and recommendations to the Board. As cyber threats evolve and as our cybersecurity program matures, the Board will consider further developing specific cybersecurity oversight functions and protocols. For more information on our cybersecurity related risks, see Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: management oversees our cybersecurity risk management efforts. Our senior management team is actively involved in cybersecurity policies, procedures and strategy development.

companyName: Sunshine Biopharma Inc.

ticker: SBFM


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place to respond in a timely and appropriate manner. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.

companyName: Atlanta Braves Holdings, Inc.

ticker: BATRA


text: As part of the nation's critical infrastructure network, we are subject to certain mandatory reliability standards, which include cyber security requirements. We have a formal compliance program to establish, monitor and maintain compliance that includes comprehensive cybersecurity elements designed to protect and preserve our critical information and energy infrastructure systems. We reference industry and government frameworks and best practices to continuously improve our cybersecurity program and we participate in industry groups and information sharing exchanges to understand emerging cybersecurity trends and threats.

companyName: OGLETHORPE POWER CORP


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use, and storage of data.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Our Information Technology ("IT") security department, led by our Vice President of Information Systems ("IS") and Distribution and overseen by our Director of IS, holds primary responsibility for assessing and managing cybersecurity threats. Our Vice President of IS and Distribution has more than 34 years of experience in IT and holds a bachelor's degree in Management of IS; his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Director of IS has more than 20 years of experience in various IT and IS roles, and holds a bachelor's degree in Accounting and Finance.

companyName: WEYCO GROUP INC

ticker: WEYS


text: Identifying and assessing cybersecurity risk is integrated into the Company's overall risk management processes. Cybersecurity risks are identified and addressed through internal information technology security, governance, risk and compliance reviews, as well as periodic third-party assessments. To defend, detect and respond to cybersecurity incidents, the Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and disaster recovery plans. The Company also performs penetration testing to test security controls and monitors emerging laws and regulations related to data protection and information security. In addition, the Company performs third-party risk management (including gathering information via questionnaires and/or service organization controls (SOC) reports) to identify and mitigate risks from third parties such as vendors, suppliers and major customers that process the Company's employee, business or customer data.

companyName: MOVADO GROUP INC

ticker: MOV


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our Cyber Oversight Group utilizes the IRP to: (1) prepare for and protect against cybersecurity incidents; (2) identify and analyze cybersecurity incidents; and (3) contain, eradicate, and help ensure appropriate reporting of cybersecurity events. In the event of a cybersecurity incident, the IRP provides a framework to coordinate the response. The IRP also addresses escalation protocols to senior management responsibility with respect to disclosure determinations related to a cybersecurity incident and provides for Audit Committee and Board briefings as appropriate. We also manage threats to our systems originating or associated with third party service providers by integrating cybersecurity requirements and other provisions into various contracts. Vulnerabilities and risks identified for our third-party vendors are handled through ongoing scanning and reviews.

companyName: PAPA JOHNS INTERNATIONAL INC

ticker: PZZA


text: Information Security Team carries out risk management primarily by outsourcing risks to those companies and agencies that specialize in handling such risks and that have the appropriate resources to do so. Our IT Provider has more than 20 years of experience in the latest technologies, experiences in a variety of network configurations. The IT Provider also has the ability to analyze cybersecurity presence and technology processes to provide reports as needed. The IT Provider currently manages and monitors our network, configures systems and controls, provides assistance and support during an incident and detects threats through antivirus scans, firewalls and base level spam filters. The Information Security Team meets quarterly with our IT Provider and notifies our IT Provider in real time of any major issues. The Information Security Team has engaged Drawbridge in the past for annual testing.

companyName: Gaucho Group Holdings, Inc.


text: Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.

companyName: ALPHA MODUS HOLDINGS, INC.

ticker: AMOD


text: The Board and Audit Committee are responsible for oversight related to cybersecurity, privacy, and data protection and security. The Cybersecurity Subcommittee of the Audit Committee oversees management's efforts and processes to identify, assess, and manage significant cybersecurity and privacy risks and regulatory developments in this area. The cybersecurity and privacy leaders meet with the Cybersecurity Subcommittee to discuss the Company's cybersecurity and data protection risk exposures, including steps management has taken to assess and manage such exposures and their potential impact on the Company's business, operations, and reputation. The Cybersecurity Subcommittee reports periodically on these matters to the Audit Committee and the Board.

companyName: Booking Holdings Inc.

ticker: BKNG


text: Management of Cybersecurity Matters At the management level, the Partnership's cybersecurity risk management activities are led by our Chief Executive Officer and his executive team and is integrated into the day-to-day activities of the Partnership's information technology function and Chief Information Officer, who operates under the supervision of our Chief Financial Officer, and reports regularly to the Audit Committee on cybersecurity risks, typically on a quarterly basis. The Partnership's information technology function has a dedicated cybersecurity team comprised of employees with, on average, nearly 20 years of experience and expertise in cybersecurity, and includes individuals with degrees in Computer Studies and cybersecurity-related certifications including Certified Information Systems Security Specialist (CISSP), Certified in Risk and Information Systems Controls (CRISC), and Certified Information Security Manager (CISM).

companyName: CVR PARTNERS, LP

ticker: UAN


text: A key part of the Company's cybersecurity program is the ITW Cybersecurity Framework, which is based on the National Institute of Standards and Technology's Cybersecurity Framework ("CSF") and is designed to protect the Company's data through rapid identification of and effective response to cybersecurity incidents. The Company's framework includes detailed processes and controls related to backup and recovery, response planning, awareness, vulnerability management and endpoint protection as well as cybersecurity requirements for third-party service providers. The framework is regularly reviewed, assessed, and updated based on input from third party specialists, threat intelligence firms and CSF standard updates.

companyName: ILLINOIS TOOL WORKS INC

ticker: ITW


text: Impact of Risks from Cybersecurity Threats As of the date of this Report, though the Partnership and our services providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Partnership. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT or operational technology ("OT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise of our IT or OT systems.

companyName: CSI Compressco LP


text: Through these processes, we did not identify risks from current or past cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information about these risks, please see the "Risk Factors" in this Annual Report.

companyName: ETSY INC

ticker: ETSY


text: Recognizing the complexity and evolving nature of cybersecurity threats, our technology team periodically evaluates and tests our risk management systems. Our technology team has specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.

companyName: Freight Technologies, Inc.

ticker: FRGT


text: Role of Management Our senior management, with the oversight of the Board, is responsible for the day-to-day management of the material risks the Company faces, including those related to cybersecurity. We believe it is important to work at all levels of the Company's hierarchy to manage cybersecurity risks and threats. Therefore, all users must use an online IT ticketing system, which is monitored around the clock, to report any incidents. Qualified individuals in IT determine what resources to allocate to each case and escalation of an incident, if deemed necessary. The Systems Administrators and IT Director, who has more than 18 years of experience with the Company, communicates on a day-to-day basis with the Chief Financial Officer, and President/Chief Operating Officer who would bring any material cybersecurity issues to the attention of the Company's Chief Executive Officer, the Audit Committee, and the Board.

companyName: NATURAL ALTERNATIVES INTERNATIONAL INC

ticker: NAII


text: We have a process in place for assessing, identifying, and managing material risks from cybersecurity threats and incidents, which is based on industry-recognized frameworks and takes a multifaceted approach to protecting our network, systems, and data, including personal information. To prevent cybersecurity incidents, we deploy a wide range of protective security technologies and tools, including, but not limited to, encryption, firewalls, endpoint detection and response, security information and event management, multi-factor authentication, and threat intelligence feeds. To maintain the effectiveness of this framework, we conduct periodic real-world simulation exercises to test, educate, promote awareness, and identify any refinements needed.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: Our Board of Directors, with the assistance of the Audit Committee, has oversight for the cybersecurity risks facing us and for our processes designed to identify, prioritize, assess, manage, and mitigate those risks. As part of its oversight responsibilities, the Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures (including, as relevant, those stemming from certain cybersecurity incidents) from our Executive VP and Chief Financial Officer.

companyName: Outlook Therapeutics, Inc.

ticker: OTLK


text: Our Chief Information Security Officer reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.

companyName: Guardant Health, Inc.

ticker: GH


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board of Directors. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer who receives reports from our cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Chief Information Security Officer and dedicated personnel are experienced information systems security professionals and information security managers with many years of experience. Management, including our Chief Information Security Officer and cybersecurity team, regularly update the Audit Committee on our cybersecurity programs, material cybersecurity risks and mitigation strategies and provide cybersecurity reports annually that cover, among other topics, third-party assessments of our cybersecurity programs, developments in cybersecurity and updates to our cybersecurity programs and mitigation strategies.

companyName: Progyny, Inc.

ticker: PGNY


text: For a full discussion of our cybersecurity risk management process and policies, please refer to the subsection titled "Operational Risk Management" within the "Risk Management" section of Part II, Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations."

companyName: ANNALY CAPITAL MANAGEMENT INC

ticker: NLY


text: The Chief Information Security Officer plays a pivotal role in informing the Audit Committee on cybersecurity risks. He reports quarterly to the Audit Committee on a range of topics, including: Current cybersecurity landscape and risks; Status of ongoing cybersecurity incidents, threats and strategies; Cybersecurity incident reporting and post-incident reviews; and Compliance with regulatory requirements and evolving industry trends.

companyName: HERITAGE COMMERCE CORP

ticker: HTBK


text: All of the above individuals have played a key role in our transition as a public company, working closely with external cybersecurity advisory specialists to evolve IT and cybersecurity practices to meet public company compliance standards.

companyName: Oklo Inc.

ticker: OKLO


text: Our cybersecurity program includes an incident response plan that includes all relevant and critical members of management and third-party service providers alike. The team is responsible for assessing and managing cybersecurity incident response processes, response times, and communication plans in the event corrective actions and mitigation procedures are required to isolate and eradicate an incident.

companyName: Banzai International, Inc.

ticker: BNZI


text: We continue to assess the risks and changes in the cyber environment, invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities, as well as the broader cybersecurity ecosystem.

companyName: Nexalin Technology, Inc.

ticker: NXL


text: Our Information Security Efforts Cybersecurity Risk, Management, and Strategy The performance, reliability, and security of the networks and technology infrastructure we use or rely on is critical to our operations, our institutions' reputation, and our ability to attract and retain students. We have developed what we believe to be a robust cybersecurity program that incorporates a process of identifying and managing cybersecurity risks across the enterprise. As part of our cybersecurity risk management process, we identify risk by reviewing the elements within our technology stack and processes, including a full scan and identification process of all APEI's digital and physical assets within the organization, covering hardware, software, data, and personnel. Assets are documented and assessed for their value, factoring in their significance and potential cost if compromised. We conduct a threat assessment for both internal (e.g., employees, contractors, etc.) and external (e.g., hackers, malware, etc.) cybersecurity threats, and we have established plans and actions to detect unauthorized activities. We engage third-party consultants to perform assessments, including annual penetration testing, and we maintain a risk register. The risk register includes documentation of identified risks, the potential impact and likelihood of occurrence, mitigation efforts and the required enterprise level response. Each of the identified risks is given a risk classification from low to high depending on the probability of occurrence and the severity of impact.

companyName: AMERICAN PUBLIC EDUCATION INC

ticker: APEI


text: The assessment process spans over five domains of interest: (1) cyber risk management and oversight, (2) threat intelligence and collaboration, (3)

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Accordingly, we have established Cybersecurity standards, policies, and operating procedures, for the purpose of implementing information protection processes and technologies; carrying out Cybersecurity risk detection, identification, assessment, response, and monitoring; assigning responsibility within our organization for risk detection and oversight; implementing Cybersecurity training; governing internal communications regarding Cybersecurity risks; and making required public and regulatory disclosures regarding Cybersecurity threats and incidents. We oversee risks from Cybersecurity threats associated with our use of third-party service providers by requiring our vendors to agree that they have and will maintain appropriate Cybersecurity controls, such as through standard contractual provisions, and by coordinating with key vendors with respect to integration with our systems. Our Cybersecurity risk management program is based on the National Institute of Standards and Technology ("NIST") framework.

companyName: Greenwave Technology Solutions, Inc.

ticker: GWAV


text: Collaboration. We employ a cross-functional, risk-based approach to identify and address anticipated and real-time threats to our cybersecurity. Our internal security, risk, and compliance personnel meet regularly to develop strategies for preserving the confidentiality, integrity and availability of corporate, customer, and other third-party information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents, if applicable, can be made in a timely manner.

companyName: Elastic N.V.

ticker: ESTC


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: The "to be newly formed" management positions responsible for assessing and managing cybersecurity risks will be a Director of Cybersecurity and a Chief Information Officer ("CIO"), who will report directly to our CFO. Presently our CFO is undertaking the actions of both the Director of Cybersecurity and CIO. The CIO will be responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy.

companyName: ADVANCED OXYGEN TECHNOLOGIES INC

ticker: AOXY


text: The Company describes risks related to cybersecurity threats that could materially impact its business strategy, results of operations or financial condition in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.

companyName: OPENLANE, Inc.

ticker: OPLN


text: Board of Directors as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board of Directors. The oversight responsibility of the Board of Directors and its committees is enabled by management reporting processes that are designed to provide visibility to the Board of Directors about the identification, assessment and management of critical risks and management's risk mitigation strategies.

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: Management's role in assessing and managing material risks from cybersecurity threats Our CISO leads Walmart's Information Security organization and has responsibility for overseeing our Company's cybersecurity program. To operationalize our program, we deploy multidisciplinary teams, including cybersecurity personnel and professionals, to address cybersecurity threats and respond to cybersecurity incidents, including for those non-wholly owned subsidiaries whose systems have not been fully integrated into Walmart's networks. Through ongoing engagement with these teams and certain third-party service providers, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and reports cybersecurity incidents that reach established thresholds to senior management and the Audit Committee, which are also analyzed for external reporting requirements.

companyName: Walmart Inc.

ticker: WMT


text: We define cyber risk governance as a program of measures designed to protect our IT assets and information from unauthorized access, attacks or service disruptions. Our risk governance processes were designed by our IT Shared Services (ITSS) team, which maintains knowledge about the types of high-profile security breaches being reported more frequently across the globe. The secure processing, maintenance, and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, and information belonging to our customers, suppliers, and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term business strategies.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 30 years in professional roles supporting and leading cybersecurity and cloud security programs for technology companies, including, (i) our Chief Information Security Officer (CISO), Dustin Pearce, who has previously led the Security and Governance, Risk, and Compliance (GRC) and Infrastructure functions, at Instacart and Slack, respectively, which included responsibility for assessing and managing various aspects of platform security for users, and (ii) our Executive Vice President of Engineering, Shadi Rostami, who has extensive experience in overseeing security for cloud services from an engineering perspective, including at Palo Alto Networks, while serving as Vice President of Engineering with responsibility for overseeing key cloud services, ensuring the security of cloud offerings and developing several cybersecurity solutions. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.

companyName: Amplitude, Inc.

ticker: AMPL


text: The Trust does not have any officers, directors or employees. The Sponsor is responsible for the oversight and overall management of the Trust. The Sponsor is an indirect wholly owned subsidiary of the World Gold Council and relies on the World Gold Council's cybersecurity program for its own risk management. The Trust also relies on the cybersecurity programs of its service providers. The Board of Directors of the Sponsor (the "Board of Directors") receives reports from the Sponsor's officers detailing cybersecurity review processes, any potential risks and any incidents which could impact the Trust. The Board of Directors also periodically receives, and reviews reports from the World Gold Council and the Trust's service providers regarding their cybersecurity programs.

companyName: SPDR GOLD TRUST

ticker: GLD


text: Our Chief Financial Officer supervises our Information Technology Department (the "IT Department") which coordinates with third-party service providers that perform security management roles, including those of a chief information security officer, to identify, assess and manage our cybersecurity threats and risks. Our IT Department and security management team, including third-party service providers, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, internal audits relating to cybersecurity, conducting threat assessments for internal and external threats, third-party threat assessments, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, evaluating our and our industry's risk profile, and evaluating threats reported to us.

companyName: UroGen Pharma Ltd.

ticker: URGN


text: As noted previously, our CISO is a member of the Council, which meets monthly to provide operational direction to the IT Security Team considering the evolving risk landscape. The IT Security Team and the Council, through ongoing communication, monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO or CIO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit and Finance Committee, as appropriate. These reports may be included in, or in addition to, the regular annual reports to the Audit and Finance Committee.

companyName: EASTMAN KODAK CO

ticker: KODK


text: In 2025, we did not identify any cybersecurity threats that materially affected, or are reasonably likely to materially affect, our strategy, operations, or financial condition. However, no program can eliminate all risks, and we cannot guarantee that undetected incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for further details.

companyName: Advanced Biomed Inc.

ticker: ADVB


text: Our EVP, Information Technology and Global Security has over 40 years of global information technology leadership experience, including hands-on management and technology innovation experience. He provides strategic direction for the design, implementation strategy, and Governance of Concentrix Global Infrastructure, Information Security and Application development. Our SVP, Information Systems and Global Security has an undergraduate degree in Information Technology and over 24 years of global experience in cybersecurity strategy and risk management in various leadership roles at large companies and within government, with extensive experience in the development of and enforcement of security policies, protection of sensitive data, responding to cyber and fraud incidents, and integrating security across operations. Our SVP, IT Infrastructure has over 29 years of experience in managing a large, geographically dispersed team that designs, plans, implements, and maintains a complex IT infrastructure and operations. He has also played a critical role in the development of security technologies at Concentrix. Our GVP, Governance, Risk, and Compliance has over 22 years of global experience in information security with specialization in risk management, security tools and technologies, compliance, and privacy. His experience in information security spans advisory and consulting, policy, processes and standards, engineering, and operational support for clients and the internal organization.

companyName: Concentrix Corp

ticker: CNXC


text: Effective incident response involves every part of our organization, including IT teams, legal, technical support, human resources, corporate communications, and business operations. Our Board of Directors oversees all business, property, and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: To that end, the Company has implemented a cybersecurity governance structure. The Board of Directors, some of whose members have broad-based skills in risk and management oversight and/or cybersecurity oversight certifications, oversees the risk management process. The Board of Directors employs an enterprise-wide approach to risk management that supports the Company's business plans within a reasonable level of risk. In the Company's view, risk assessment and risk management entail not only understanding the risks a company faces and what steps management is taking to manage those risks, but also understanding what level of risk is appropriate for that company. The Board of Directors annually approves the Company's business plan, factoring in risk management. It also approves the Company's risk appetite statement, which articulates the Company's tolerance for risk and describes the general types of risk that the Company accepts or attempts to avoid. The involvement of the Board of Directors in setting the Company's business strategy is a key part of its assessment of management's risk tolerance and a determinant of what constitutes an appropriate level of risk for the Company.

companyName: ASSURED GUARANTY LTD

ticker: AGO


text: Network Protection – Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections to segment different sections of the business from each other to strengthen key protection capabilities.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Although we have not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected our business strategy, results of operations, or financial condition, there can be no guarantee that we will not experience such an incident in the future. For additional information regarding the risk we face from cybersecurity threats, see the risk factor entitled "System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation, damage to our reputation, and other potential losses." included in Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K.

companyName: FIVE STAR BANCORP

ticker: FSBC


text: Our global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats. Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification ("GIAC"), Certified Incident Handler certifications. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed. All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.

companyName: C. H. ROBINSON WORLDWIDE, INC.

ticker: CHRW


text: Due to the dynamic nature of risks, threats, vulnerabilities, and the information systems themselves, all information systems that store, process, or transmit sensitive and confidential information are protected by comprehensive defense-in-depth strategies that include strong authentication techniques, firewalls, intrusion detection systems, end point protection, physical security measures, encryption and security awareness training.

companyName: HarborOne Bancorp, Inc.

ticker: HONE


text: Risks from Cybersecurity Threats As of the date of this report, we have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Board of Directors Oversight Our Board's Operational Risk Committee oversees cybersecurity risk.

companyName: F&M BANK CORP

ticker: FMBM


text: In support of such oversight process of our Board of Directors, our management maintains robust cybersecurity management processes. Our cybersecurity function is led by our Executive Vice President, Corporate Development and Administration and our Vice President of our Business Technology Group. Our Vice President of our Business Technology Group has been with us for over 36 years in various roles related to information technology, cybersecurity and support of our business and enterprise systems. He has over 39 years of direct experience in multiple roles related to information technology and cybersecurity and a deep understanding of how information technology data and specialized software and hardware relates to our business operations. Our Vice President of our Business Technology Group also has significant experience in identifying third party cybersecurity risks and integrating acquired companies into our cybersecurity environment.

companyName: SILGAN HOLDINGS INC

ticker: SLGN


text: Audit Committee considers cybersecurity risks and other information technology risks as part of its risk oversight function and evaluates our risk assessment and management policies, including periodic discussions with our senior officers. In addition, management updates the Board of Directors, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: BTCS Inc.

ticker: BTCS


text: The Company has developed and maintained a comprehensive cybersecurity program which is integrated within the Company's enterprise risk management program and encompasses the corporate and operational technology environments, as well as client-facing products and services. Our cybersecurity program has implemented a governance structure and process to identify, assess, manage, mitigate, respond to and report on cybersecurity incidents and risks within an ever-changing threat landscape. We utilize cybersecurity policies and frameworks based on industry and government standards, including the National Institute of Standards and Technology Cyber Security Framework (" NIST CSF "). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: XBP Global Holdings, Inc.

ticker: XBP


text: Potential information security incidents are identified in a number of ways, including, but not limited to: users reporting security violations, system weaknesses, violations of our Acceptable Use Policy which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs. Our Information Security Program mandates that any potential information security incident be reported to a member's direct supervisor, IT Management, and / or the Information Security Officer, to initiate the internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive. Internal communications regarding the potential incident are led by the Information Security Officer and the Incident Response Team ("IRT") in accordance with the CIRP.

companyName: Community West Bancshares

ticker: CWBC


text: As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. For further discussion of the risks related to cybersecurity, see Item 1A. Risk Factors - Risks Relating to Our Business - Information Technology and Data Privacy Risks.

companyName: ALTRIA GROUP, INC.

ticker: MO


text: Cybersecurity threats present a persistent and dynamic threat to our entire industry. The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology. The Company's Board, through its committees, referenced above in ITEM 1 "Business" - Enterprise Risk Management, has ultimate responsibility for risk oversight. In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board's oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy. Management is tasked with the day-to-day management of the Company's cybersecurity risks. The Company's Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity. In addition, the Company's subsidiary boards of directors may also provide additional oversight.

companyName: EVEREST GROUP, LTD.

ticker: EG


text: Role of the Enterprise Risk Manager Our Enterprise Risk Manager is responsible for oversight of the Company's information technology governance and risk program. In this role, the Enterprise Risk Manager provides independent oversight of information technology risk, promotes effective challenge to the Company's information technology systems, and ensures that high-level risks receive appropriate attention. The Enterprise Risk Manager is a member of the Company's Risk Management Group and reports to the Chief Risk Officer, who in turn reports to the Board Risk Committee.

companyName: FIRST BANCSHARES INC /MS/


text: The Board is composed of members who have diverse expertise including, risk and financial management, technology, cybersecurity and finance, equipping the Board with the necessary skill set to effectively oversee cybersecurity risks.

companyName: WORKIVA INC

ticker: WK


text: In the three-year period ended March 31, 2024, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats or incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material threats or incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: Company's cyberattack response plan has been developed in conjunction with independent third parties that specialize in cybersecurity, cloud, and digital infrastructure. The plan includes incident response protocols, disaster recovery strategies, business continuity measures, stakeholder communication and SEC compliance reporting. Simulated cyberattacks are conducted to assess the efficacy of the cyberattack response plan and identify areas of potential risk. Regularly scheduled cybersecurity initiatives include penetration testing to proactively identify and address vulnerabilities in the Company's systems. Each penetration test is documented and reported. Post-test actions are implemented to drive continuous improvement across our systems.

companyName: Guardion Health Sciences, Inc.


text: Both departments have established strict security rules for infrastructure, application and limitations on access rights. New employees are instructed on aspects of cybersecurity, and reminders for safe internet access are periodically sent. Access to our networks for former employees and contractors is immediately revoked upon severance of association, and any hardware such as laptops, company phones, access keys are returned. Each department has also installed equipment and tools to protect and update against the risks of intrusions, cyberattacks, and system obsolescence. Various applications and methods to manage our cybersecurity include, but not limited to, use of EDI (electronic digital interface) for receiving orders, fire walls, virtual private network, antivirus software, encryption, and requiring two factor authentication for remote access after business hours. Redundancy is important as data is routinely backed up daily.

companyName: INTERPARFUMS INC

ticker: IPAR


text: As a financial services company, we face cybersecurity risks and threats, and our customers, suppliers, and third-party service providers face cybersecurity risks and threats. As part of the operation of our business, the Company uses, stores, and processes data for our customers, employees, partners, and suppliers. A cybersecurity incident impacting any of these entities could materially adversely affect our operations, performance, or results of operations. In addition, as a financial services company we are subject to extensive regulatory compliance requirements, including those established by the FRB, MDOB, RIDBR, and NYDFS. To address these risks and regulatory requirements, the Company implemented the Program that is designed to identify, assess and mitigate risks from cybersecurity threats to the data and our systems. The Program adheres to regulatory requirements and the tenets of the FFIEC handbook and the NIST Cybersecurity Framework.

companyName: BROOKLINE BANCORP INC


text: Currently, our Chief Financial Officer is expected to lead our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. Our Chief Financial Officer will be tasked with staying informed about, and monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes we plan to develop and as described above, including the operation of an incident response plan, and report to the Board of Directors on any appropriate items.

companyName: Iveda Solutions, Inc.

ticker: IVDA


text: Our cybersecurity program is designed based on the concepts of control maturity and control efficacy. For control maturity, our cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is assessed annually by an independent third party against our yearly control maturity targets in the context of current cyber threat and industry trends. The NIST CSF assessment results are used to validate the progress made against the current year maturity targets, inform the program's strategic priorities and establish maturity targets for the following year. These assessment results are provided to our Audit Committee and our Board of Directors on an annual basis.

companyName: REPUBLIC SERVICES, INC.

ticker: RSG


text: Engaging independent consultants and other third-parties to assist CTBI in establishing and improving its policies; and Conducting "tabletop" exercises at least annually to test CTBI's processes and policies and using feedback from those exercises to further improve our processes. CTBI also maintains insurance coverage for cybersecurity incidents as part of its overall insurance portfolio.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Monitor Cybersecurity Incidents The cybersecurity sub-committee stays apprised about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity sub-committee implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the cybersecurity sub-committee is equipped with a well-defined incident response plan, which provides a framework to mitigate the impact of cybersecurity incidents The cybersecurity sub-committee regularly informs the risk management committee of matters related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of trustees, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Premier maintains an active Information Security Policy (the "IS Policy") and associated programs, procedures and standards (collectively with the IS Policy, the "ISPP") in alignment with Federal Financial Institutions Examination Council and National Institute of Standards and Technology guidance to help in the mitigation of risks that may impact the Confidentiality, Integrity and Availability (aka "CIA Triad") of systems and information. The components of the IS Program are reviewed and approved annually by senior management and the IS Policy is reviewed and approved annually by either the Risk Committee of the Board of Directors or the full Board of Directors. These annual reviews and approvals ensure the ISPP meets expectations to safeguard Premier and customer confidential information. The ISPP is subject to annual review by our auditors (both internal and external), the FDIC, and the ODFI to ensure it is in alignment with Premier's internal risk management practices, government regulatory expectations and industry best practices. We use auditors and other third party resources, in addition to internal tools and resources, for security monitoring and testing.

companyName: PREMIER FINANCIAL CORP


text: Internally, we have a security awareness program, which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. These trainings are mandatory for all employees and take place throughout the year, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide access to specialized training for certain employee roles, such as application developers. Finally, our privacy and data protection program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.

companyName: Rush Street Interactive, Inc.

ticker: RSI


text: Our organization employs a comprehensive process to oversee and identify cyber threats associated with third-party service providers. For critical systems that handle confidential data, we conduct annual third-party security reviews to evaluate and mitigate potential risks. These reviews include a multifaceted approach combining security questionnaires, in-depth manual assessments of vendor security practices, and automated rating systems to assess vendors' cybersecurity postures.

companyName: Inotiv, Inc.

ticker: NOTV


text: As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect. Additional information on cybersecurity risks we face can be found in Item 1A "Risk Factors" under the heading "Risks Related to Technology, Cybersecurity and Intellectual Property," which should be read in conjunction with the foregoing information.

companyName: KORN FERRY

ticker: KFY


text: Our work on developing and implementing a process to oversee and identify risks from using third-party service providers, suppliers and vendors who have access to our critical systems and information is ongoing.

companyName: Corsair Gaming, Inc.

ticker: CRSR


text: Our President and Chief Executive Officer works directly with third party service providers, as applicable, to identify, assess and manage the Company's cybersecurity threats and risks. In doing so, he seeks to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, automated and manual tools, accessing reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, evaluating the Company's and the industry's risk profile, evaluating reported threats, coordinating with law enforcement relating to threats, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.

companyName: Bluejay Diagnostics, Inc.

ticker: BJDX


text: We have established processes and systems designed to assess, identify, manage, and mitigate cybersecurity risk and threats, including regular and on-going education and training for employees, including information security awareness training, preparedness simulations and tabletop exercises, and recovery and resilience tests. We employ a variety of preventative and detective tools designed to monitor and block suspicious activity and to identify cybersecurity threats. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity professionals and third-party specialists. We also engage a third-party to perform penetration testing and ongoing analysis to identifty potential vulnerabilities and areas for additional enhancement. We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with third-party service providers. We also monitor our email gateways for malicious phishing campaigns and monitor remote connections for cybersecurity threats. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: MetroCity Bankshares, Inc.

ticker: MCBS


text: Additionally, the Company is aware of the risks associated with third-party service providers, it implements stringent processes to oversee and manage these risks. The Company conducts security assessments of third-party technology providers before engagement and maintains ongoing monitoring to ensure compliance with Company cybersecurity standards. The monitoring includes assessments (e.g., reviewing vendor cybersecurity related attestation and disclosures (SOC 2 Type 2, etc.)) by the Company's Chief Information Officer ("CIO") and on an ongoing basis by its security engineers.

companyName: Limbach Holdings, Inc.

ticker: LMB


text: Our information technology cybersecurity team, with oversight from our Board, is tasked with monitoring cybersecurity and operational risks related to information security and system disruption. The Mitek cybersecurity team uses principles of confidentiality, integrity and availability to design and implement information technology systems. The team employs measures designed to protect against, detect, and respond to cybersecurity threats, and has implemented processes and procedures aligned with our enterprise-wide risk management system. These include: • Enterprise-wide security framework and cybersecurity standards; • Cybersecurity awareness and training programs; • Security assessments and monitoring; • Restricted physical access to critical areas, servers and network equipment; and • Cyber incident response, crisis management, business continuity and disaster recovery plans.

companyName: MITEK SYSTEMS INC

ticker: MITK


text: These relationships allow us to utilize specialized knowledge and insights, ensuring our strategies and processes remain in-line with current best practices. These third-parties provide the Company with regular audits, threat assessments, and consultations on security enhancements. Also, during onboarding and periodically thereafter, we conduct trainings for the Company's employees, contractors, and temporary workers about cybersecurity risks, including sending test phishing emails for training purposes to all users of the Company's email system.

companyName: AppTech Payments Corp.

ticker: APCX


text: Risk Identification and Analysis: Prioritization of risks is based on standardized scoring frameworks, focusing resources on addressing the most significant threats.

companyName: Paragon 28, Inc.


text: The Information Security Program is overseen by the Company's Information Security Officer ("ISO"), who reports directly to the Chief Risk Officer. The ISO has held this position with the Company since May, 2024, and has worked at the Company in cybersecurity for almost 12 years and in the information technology industry for more than 16 years. The Chief Risk Officer has held the position at the Company since October 2016, when he joined the Company from the FDIC where he was employed for 24 years and held multiple positions including Senior Risk Examiner for the Division of Risk Management Supervision and Acting Regional Manager for the Division of Insurance and Research. During his tenure with the FDIC, the CRO served from time to time as the Examiner-in-Charge for Berkshire Bank and numerous other banks throughout New England. The ISO is responsible for the implementation, maintenance, and enforcement of the Information Security Program and related policies and standards. The program is evaluated and adjusted at least annually based on the results of testing, monitoring, and the adoption of best practices. Reporting occurs annually on the status of the Information Security Program to the Board's Risk Management, Capital & Compliance Committee. Reporting includes the overall status of the program, material matters related to the program, Key Risk Indicators ("KRIs"), cyber risk assessments results, emerging risks, risk management and control decisions, control testing results, third party security assessments, penetration test results, security breaches or violations, and recommendations for changes to the program.

companyName: Beacon Financial Corp

ticker: BBT


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance – The Board of Directors has responsibility for oversight of cybersecurity risk management and regularly interacts with the Company's ERM function, the Company's Chief Information Officer ("CIO"), and other members of management. • Collaborative Approach – The Company has implemented a comprehensive, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. The Company also collaborates with others in the industry and actively participates in a specific oil and gas threat intelligence group with weekly meetings and up-to-date threat notices. • Technical Safeguards – The Company deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware software and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company performs an annual penetration test for identification of any vulnerabilities; in 2023, this test was performed by a third-party audit firm. • Incident Response and Recovery Planning – The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis, with the participation of executive officers and employees in our IT, legal and operations departments. • Third-Party Risk Management – The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business. In 2023, the Company completed a comprehensive review of certain third-party providers that have access to the Company's data, such as banks, and SaaS vendors, and implemented a third-party risk management service which (i) allows for comprehensive vendor assessments with risk scoring, (ii) informs risk decisions with increased visibility and cybersecurity ratings, (iii) continuously monitors for vendor breaches and other significant events via various data feeds, and (iv) allows for collaboration with vendors to assess and remediate risk. • Education and Awareness – The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices. In addition to our annual required training, the Company promotes awareness through regular phishing simulations and educational opportunities, including an FBI-led training in 2023.

companyName: Callon Petroleum Co


text: We developed our cybersecurity program by integrating proactive training, vulnerability management, and system design with active threat defense mechanisms. Our marketplace services are protected by multiple layers of security including firewalls, endpoint protection, WAF and Bot mitigation. Our "defense in depth" approach to asset protection is backed by AI-powered threat detection and response systems and actively monitored 24/7 by a dedicated team of security professionals. We maintain a formal incident response plan, which is regularly tested and updated to ensure prompt detection, reporting, and mitigation of cybersecurity incidents.

companyName: LIQUIDITY SERVICES INC

ticker: LQDT


text: We engage in periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats. These efforts include tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage assessors, consultants, auditors or other third parties to assist with our assessments and testing. Where appropriate we adjust our cybersecurity policies, standards, processes and practices accordingly based on internal and external assessment and testing results.

companyName: Walmart Inc.

ticker: WMT


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2024, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.

companyName: RENASANT CORP

ticker: RNST


text: When engaging third-parties, we have procedures and protocols designed to protect our information technology systems and our confidential information. For example, before we grant third-parities access to our information technology systems, we require agreements with such third-parties, we require such third parties to complete cybersecurity training and we typically require specific contract terms in our agreements with such third-parties.

companyName: COMPASS Pathways plc

ticker: CMPS


text: Our Board and management exercise oversight over the Company's cybersecurity program, which represents an important component of the Company's overall approach to enterprise risk management.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: The Audit and Risk Committee of the board of directors has responsibility of oversight for our enterprise risk assessment and risk management systems. Our Chief Information Officer ("CIO"), Senior Director of Information Security and other delegated positions are responsible for assessing and managing our material risks from cybersecurity risks. Our CIO has 15 years of experience in cybersecurity and a degree in management information systems. We also have a Cybersecurity Infrastructure Committee that meets monthly. We have implemented an incident response strategy as an element of our overall risk management approach. Our incident response plan entails clearly-defined roles and responsibilities, established communication protocols and measures to mitigate the impact of any cybersecurity incidents. We have experienced adverse IT events in the past, but to date, we have seen no material impact on our business or operations from these attacks or events. We prioritize the detection, response, and recovery from potential breaches and carry cybersecurity insurance which includes cyber breach response services. The scope and coverage of our cybersecurity insurance is reviewed on an annual basis. Risks and potential threats are identified and measured through these monitoring, testing, and response processes procedures and significant risks, and threats are reported by the CIO to the Audit and Risk Committee.

companyName: Acadia Healthcare Company, Inc.

ticker: ACHC


text: Risks from Cybersecurity Threats While we face a variety of cybersecurity risks, such as phishing attempts, ransomware attacks, and unauthorized access attempts, such risks have not materially affected us to date, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see "Item 1A – Risk Factors - We face risks relating to information technology and cybersecurity attacks, loss of confidential information and other business disruptions. "

companyName: AGREE REALTY CORP

ticker: ADC


text: CBIZ's Vice President, IT Security and Compliance reports to CBIZ's Chief Information Officer and is the head of the Company's cybersecurity team. The IT Security Director is responsible for assessing and managing CBIZ's cyber risk management program, informs senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervises such efforts. The cybersecurity team has decades of experience selecting, deploying and operating cybersecurity technologies, initiatives and processes. Additionally, members of the cyber security team have extensive information technology and program management expertise and have earned various cybersecurity certifications. Finally, the cybersecurity team relies on threat intelligence as well as other information obtained from governmental, public or private sources, including external consultants engaged by CBIZ.

companyName: CBIZ, Inc.

ticker: CBZ


text: The Bank's Board devotes significant time and attention to data and systems protection, including protection from cybersecurity and information security risk. The Board oversees the Bank's information security program through setting of policies and principles including the Bank's Information Security Policy and Enterprise Risk Management program. The Board also oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.

companyName: Federal Home Loan Bank of New York


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with Legal, Human Resources and IT. Personnel at all levels and departments are made aware of our cybersecurity policies through periodic training and company-wide communications.

companyName: IGM Biosciences, Inc.


text: The Chief Security Officer or members of management brief the Board on routine and regular cybersecurity risk and threat updates, typically on a quarterly basis. In the event of a significant threat or incident, management and the Chief Security Officer leverage Xcel Energy's incident response processes to assess impacts and resolve incidents. When a significant cybersecurity incident occurs, management communicates with the Board of Directors and relevant committees.

companyName: XCEL ENERGY INC

ticker: XEL


text: The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework. The Risk Appetite Framework requires the cybersecurity organization to document the current risk landscape and the activities undertaken to mitigate risk that exceeds enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls.

companyName: FIRST CITIZENS BANCSHARES INC /DE/

ticker: FCNCA


text: Our management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats. The CISO/CIO oversees the overall cybersecurity risk management program, and the Deputy Chief Information Security Officer ("DCISO") has the primary operational responsibilities over our cybersecurity program, including supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. The CISO, who is also our CIO, has over 23 years of experience managing global IT operations, including strategy, applications, infrastructure, information security, support and execution. The CISO/CIO holds a Master of Science degree in computer science and engineering (with a specialization in Information Assurance) and a Doctorate of Engineering Management/Systems Engineering degree. Our DCISO has served in various roles in information security for over 16 years and holds a Bachelor of Science degree in mathematics and computer science and a Master of Science degree in computer science.

companyName: NOVANTA INC

ticker: NOVT


text: The Vice President of Information Technology and Security and CIO has over 25 years of information technology and security experience and, to enhance governance, reports to the Senior Vice President and General Counsel. The Vice President of Information Technology and Security and CIO is responsible for informing the CEO and other members of senior management, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cybersecurity team. Cybersecurity incidents are managed using the companies' standard process for critical events. In the event of such cybersecurity incidents, the Vice President of Information Technology and Security and CIO communicates and collaborates with the officers of the companies and subject matter experts to address business continuity, contingency, and recovery plans. Senior management will notify the Board, including the Audit Committee, of any significant cybersecurity incidents.

companyName: CONSUMERS ENERGY CO

ticker: CMS-PB


text: Denali's approach to cybersecurity seeks to defend the confidentiality, integrity and availability of our systems and information for our people and our patients.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks, including cybersecurity risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape. Atleos' ERM programs support the Company's strategic objectives and corporate governance responsibilities. The ERM programs include the following primary objectives: • Establish a standard risk framework and supporting policies and processes to identify, assess, respond to, and report on business risks and opportunities, including cybersecurity threats; • Establish clear roles and responsibilities in support of the Company's risk management activities, including cybersecurity; • Ensure appropriate independent oversight of business risks and opportunities and the impacts of related business decisions on the Company's risk profiles and tolerances; • Ensure appropriate communication and reporting of business risks and opportunities including related response strategies and controls to Atleos' executive leadership and Board of Directors; and • Provide relevant training to executives, managers and employees.

companyName: NCR Atleos Corp

ticker: NATL


text: Responsible for assessing and managing our cyber risk management program, the InfoSec GRC organization is comprised of multiple teams that address and respond to cyber risk related to identification and access management, data protection, security architecture and engineering, security operations, insider threat, and cyber defense. The InfoSec GRC oversees compliance with our cybersecurity framework, including benchmarking within the organization and facilitates cybersecurity risk management activities. The InfoSec GRC teams also oversee the review and approval process of policies and the security awareness program. Each team reports directly to the Senior Director of Information Security who is responsible for informing the CIO, information technology leadership and senior leadership teams on the prevention, detection, mitigation, and remediation of the program, including cybersecurity incidents.

companyName: WOLFSPEED, INC.

ticker: WOLF


text: Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CFO is responsible for ensuring that the board of directors comprehends the Company's cybersecurity risk profile and receives updates on the program and its policies on a quarterly basis or as necessary. Our current CFO is Michael Hutchby. Mr. Hutchby has a B.A. in Economics from The Johns Hopkins University and an M.B.A. from the Stern School of Business at New York University. Mr. Hutchby was appointed the Company's CFO, Treasurer and Secretary in June 2019 and previously served as the Company's Controller from October 2013 to June 2019.

companyName: Cherry Hill Mortgage Investment Corp

ticker: CHMI


text: Our Board, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our Chief Information Security Office ("CISO") on, among other things, the threat landscape, the Company's cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company's overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2023 Form 10-K for additional information on our enterprise risk management.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company's business. Real time updates are also provided to the Executive IT Council as needed. The Executive IT Council approves all security related project expenditures and all members are a part of the Company's incident response team.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks that we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.

companyName: LIXTE BIOTECHNOLOGY HOLDINGS, INC.

ticker: LIXT


text: Our management team, including our Chief Digital Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The Chief Digital Officer oversees a team of information security professionals who are responsible for assessing and managing cybersecurity threats on a day-to-day basis. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Digital Officer has served in the role since 2019 and has experience in application security, intrusion detection, penetration testing, complex threat modeling and unconventional cyber-attack vectors.

companyName: Cerevel Therapeutics Holdings, Inc.


text: During the fiscal year ended December 31, 2023, we did not experience any material impact to our business, financial position or operations resulting from previously identified cyberattacks or other information security incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material breaches. For a discussion of these risks, see "Item 1A—Risk Factors—Risk Related to Our Business and Industry—Our business and operations could suffer in the event of an actual or perceived information security incident such as a cybersecurity breach, system failure, or other compromise of our systems and/or information, including information held by a third-party contractor or vendor."

companyName: Xenon Pharmaceuticals Inc.

ticker: XENE