text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: Monitor emerging data protection laws in conjunction with our advisors and implement changes to our processes to comply; Maintain firewall and virus protection software; and Maintain a cybersecurity insurance policy.

companyName: NOCOPI TECHNOLOGIES INC/MD/

ticker: NNUP


text: Our Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 14 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 28 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information System Security Professional ("CISSP") certifications.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY

secItem: Item 1C


text: Company's technology platform and application is hosted on Amazon Web Services (AWS) with a Virtual Desktop Infrastructure (VDI) and operates on Linux. The application architecture is designed with security as a priority, leveraging AWS's robust infrastructure.

companyName: MANGOCEUTICALS, INC.

ticker: MGRX


text: During the last fiscal year, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that materially affected the Company, including its business strategy, results of operations, or financial condition. However, we face ongoing and increasing cybersecurity risks, including from bad actors that are becoming more sophisticated and effective over time, as well as a result of potential defects or disruptions in our or our customers' services. If realized, these risks are reasonably likely to materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Items 1A-C, "Risk Factors."

companyName: Salesforce, Inc.

ticker: CRM


text: The CSIRT receives direction and guidance from various departments including operations, information technology, communications, legal, and human resources while being responsible for maintaining and operating incident response capabilities at Valvoline by collecting, aggregating, and analyzing detected alerts and events from computer systems across the enterprise. Valvoline's CSIRT meets at least quarterly, and more frequently as appropriate, to review and discuss the Company's cybersecurity program. The CSIRT has the authority and system entitlements to confiscate, isolate, or disconnect equipment; investigate suspicious activity; monitor usage; and disable system access in the proper execution of their duties. The CSIRT is responsible for declaring an incident and initiating escalation to the Incident Response Team ("IRT"). The IRT is responsible for coordinating incident response activities across functions and is comprised of cross-functional and multi-management level personnel including, but not limited to, the Senior Director of Information Security, CSIRT Manager, Chief Legal Officer, Chief Audit Executive, Privacy & Compliance Counsel, Chief Technology Officer, Head of Global Insurance, Director of Corporate Communications, Chief Financial Officer, Chief Operating Officer, Chief Human Resource Officer, and Head of Physical Security.

companyName: VALVOLINE INC

ticker: VVV


text: (1)System Monitoring and Testing. We work collaboratively with third-party industry experts and consultants to conduct regular vulnerability assessments and penetration testing from both outside and within our system networks. Our information security team utilizes endpoint software together with technology platforms and applications designed to enable it to monitor user and network behavior and origination points in real time both at our corporate headquarters as well as any of our sites globally. In addition, we conduct quarterly phishing campaign simulations which include notification of the respective Executive Vice President in the event of a failure by an employee in their department.

companyName: SBA COMMUNICATIONS CORP

ticker: SBAC


text: Our operations and other aspects of our business rely heavily on various information technology systems which are largely managed by third parties. We face significant cybersecurity threats, which are continuously increasing in sophistication, including computer viruses, internal and external security breaches, and other cyber-attacks. These threats could disrupt our operations, lead to the loss of confidential information, and hinder our ability to accurately report our financial results in a timely manner. We have adopted a Cybersecurity Policy to create effective administrative, technical, electronic, and physical protections to safeguard the personal information of Company personnel, confidential information concerning our operations and the integrity of the Company's information systems.

companyName: Crucial Innovations, Corp.


text: of Directors and Audit Committee delegated authority from our Board of Directors and in accordance with its charter, our Audit Committee is charged with the oversight of enterprise risk, including risk related to cybersecurity threats. Our Audit Committee Chair is expected to report regularly to our Board of Directors about our Audit Committee's oversight of enterprise risk. Our Audit Committee Chair reports quarterly to our Board of Directors specifically about our cybersecurity incident management and governance.

companyName: MICROVISION, INC.

ticker: MVIS


text: Role in Cybersecurity Risk Management part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See "Item 1A. Risk Factors - General Risk Factors - The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively. "

companyName: SURO CAPITAL CORP.

ticker: SSSS


text: As of December 31, 2023, we are not aware of any material risks form cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. While we maintain a comprehensive cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see " Item 1A — Risk Factors. "

companyName: Perspective Therapeutics, Inc.

ticker: CATX


text: As one of the critical elements of our overall ERM approach, our cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under the heading Governance, our Board of Directors' oversight of cybersecurity risk management is supported by the Compliance Subcommittee, which regularly interacts with our ERM function, our Information Security Director, and other members of management and relevant management committees, including management's Executive Compliance Committee, which reports to our Chief Privacy and Compliance Officer and the Chair of the Compliance Subcommittee. • Collaborative Approach: We have implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: We have established and maintain comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness: We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: UpHealth, Inc.


text: In the event of an incident, we follow a structured incident response playbook, which outlines clear and defined steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (such as legal and human resources), senior leadership, and the board, as appropriate. We also conduct post-incident reviews to identify lessons learned and implement continuous improvements.

companyName: NL INDUSTRIES INC

ticker: NL


text: We have established processes providing for timely review of cybersecurity incidents by a cross-functional subcommittee of our Disclosure Committee to evaluate such incidents for potential disclosure, and to ensure that the members of management responsible for overseeing the operation of our disclosure controls and procedures are informed of such cybersecurity risks and incidents. This subcommittee consists of leading representatives from our information security, accounting, legal and internal audit functions and may be supplemented by other subject matter experts depending on the nature of cybersecurity incidents under review. The subcommittee meets on a periodic and ad hoc basis to receive reports about cybersecurity incidents and our cybersecurity program. The subcommittee escalates certain cybersecurity incidents to the Disclosure Committee within our escalation framework. Additionally, our escalation framework requires that any cybersecurity incidents determined to be material be immediately reported to the Audit Committee.

companyName: ZIMMER BIOMET HOLDINGS, INC.

ticker: ZBH


text: Notwithstanding the robust nature of our defensive measures and security processes and the multi-layered governance system that we have established to mitigate, monitor, analyze, and respond to incidents, cybersecurity threats are increasingly difficult to detect, and the risk of a data breach or cyber-attack is pervasive and severe. While we do not believe our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity threats or incidents, there is no assurance that we will not be materially affected by such threats or incidents in the future. We will continue to monitor cybersecurity risks, stay apprised of changes in the cyber environment, and invest in strengthening our cybersecurity infrastructure. For additional information on our risks related to cybersecurity, please see "Risk Factors—Risks Related to Our Business— Our information systems may experience an interruption or breach in security."

companyName: INTERNATIONAL BANCSHARES CORP

ticker: IBOC


text: As a shell company with no current business or operations, we do not have an established process to oversee and identify material risks from cybersecurity threats nor any board committee or subcommittee responsible for the oversight of risks from cybersecurity threats.

companyName: THEGLOBE COM INC

ticker: TGLO


text: At the employee level, we maintain an experienced information technology team tasked with implementing our privacy and cybersecurity program and support the CISO in carrying out reporting, security and mitigation functions. We also hold employee trainings on privacy and cybersecurity, as well as records and information management, and we conduct phishing tests. We generally seek to promote awareness of cybersecurity risk through communication and education of our employee population.

companyName: Rithm Capital Corp.

ticker: RITM


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including the information technology team at the direction of our Chief Financial Officer.

companyName: PlayAGS, Inc.


text: Role of Management The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Amalgamated Financial Corp.

ticker: AMAL


text: Cybersecurity threats are one of the Company's most critical risks, with our Senior Director of Technology assigned as the executive risk owner. Our Senior Director of Technology, in coordination with our senior management team, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. Multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the Senior Director of Technology and the senior management team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Board, when appropriate.

companyName: Acreage Holdings, Inc.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. Cadrenal's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.

companyName: Cadrenal Therapeutics, Inc.

ticker: CVKD


text: Our board of directors provides oversight of our cybersecurity program and helps guide our strategy for managing cybersecurity risks in the context of our overall risk management system. Our cybersecurity program is managed by our Deputy Chief Executive Officer and Chief Financial Officer and our external IT team, who are responsible for leading enterprise-wide cybersecurity execution, protocols, framework, standards and processes. Our Deputy Chief Executive Officer and Chief Financial Officer has extensive operational responsibility for IT, of more than seven years, and he manages our external IT team,

companyName: ACTELIS NETWORKS INC

ticker: ASNS


text: Relevant Expertise of Management: Our CISO has more than 20 years of intelligence, information technology and cybersecurity experience, and holds a Masters degree in the area of Cybersecurity and Information Sciences from The Pennsylvania State University. His prior roles include senior level positions in Defense, Financial Services and High Technology industries. Our CIO has more than 30 years of information technology and cybersecurity experience at various levels. She holds an executive MBA from the Quantic School of Business and Technology, a Graduate Certificate in SAP from Central Michigan University, a Masters in computer information systems from Grand Valley State University and a BA from the University of Michigan. Her prior roles include positions as Chief Information Officer and Vice President of Information Technology and Digital Office of Adient plc, a global automotive seating manufacturer, and Chief Information Officer and Vice President of Information Technology, Power Solutions of Johnson Controls.

companyName: Vertiv Holdings Co

ticker: VRT


text: After we shut down some of our systems, we experienced disruption to certain of our operations, including interrupted manufacturing at our domestic plants and delayed order fulfillment for our retail network and delay of some wholesale shipments. Within a few days of the incident, we were able to resume retail order fulfillment and caught up on fulfilling wholesale orders that were delayed as a result of the cybersecurity incident. We have fully restored the IT systems and data and our investigation has not found evidence that any of our core operating systems for manufacturing, wholesale and retail order processing and fulfillment, or financial reporting were impacted.

companyName: BASSETT FURNITURE INDUSTRIES INC

ticker: BSET


text: The Company's Board of Directors has ultimate oversight of the Company's cybersecurity risk. Senior leadership, including the Chief Digital Information Officer, updates the Board of Directors on the Company's cybersecurity and information security posture at least quarterly at the Company's board meetings, or more frequently as determined to be necessary or advisable. These updates include a review of cybersecurity incidents determined to have a moderate to high business impact, even if immaterial to the Company as a whole. The Audit and Risk Committee has responsibility for assisting the Board in the review and oversight of risks affecting the Company, and oversees the enterprise risk management process, which includes, with the assistance of internal audit, assessing the Company's exposure to cybersecurity risk and the effectiveness of the Company's processes and controls to address and respond to those risks. Management is responsible for hiring appropriate personnel, integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees, as well as for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: Management is responsible for implementing our cybersecurity program. Our Chief Financial Officer works with our Vice President of Global Information & Technology ("IT") and regional IT members to lead our enterprise-wide information security program and manage our Cybersecurity Incident Response Plan. With over 30 years of experience in technology and information systems leadership our Vice President, Global IT oversees a highly experienced professional team within its global network. These teams work closely with internal stakeholders to develop, implement, and maintain a comprehensive security strategy that protects our enterprise and supports our business objectives. They also coordinate incident response efforts and proactively address emerging security threats. The recommendations of the management team are consulted when updating our information security policies, procedures, and standards.

companyName: WD 40 CO

ticker: WDFC


text: We identify our cybersecurity threat risks by comparing our processes to standards set by the NIST, and the ISO specifically basing our policies and procedures on ISO 27001 guidelines.

companyName: TMC the metals Co Inc.

ticker: TMC


text: We have integrated cybersecurity risk management into our broader risk management framework through various mechanisms, including (i) our updates to the Cybersecurity and Data Privacy Committee (the "Cyber Committee", created by our Board of Directors (the "Board") in 2016), which meets at least quarterly; (ii) our annual enterprise risk management update to the Board, and (iii) our information technology and security related internal controls, including vulnerability management programs.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: Our full Board of Directors and our Audit Committee provide oversight of our risk management program, which includes cybersecurity. The Audit Committee, as part of its charter to review the Company's practices with respect to risk assessment and risk management, receives updates on internal control, including those relating to IT general controls and cybersecurity.

companyName: BLOOMIA HOLDINGS, INC.

ticker: TULP


text: The Company's board of directors actively engages with senior management to understand and oversee the Company's various risks, including cybersecurity, and members of senior management regularly attend board meetings to provide periodic briefings or presentations on such risk matters. The Company provides presentations to its board of directors about cybersecurity matters, including review of cyber threats, incidents, trends and risks facing the Company; the Company's defenses against cyber-attacks including personnel, software, hardware and third-party tools and expertise; and the Company's governance, including policies, standards, benchmarks and auditing and testing, as well as remedial, preventative and proactive measures to repair or enhance the Company's cybersecurity defenses. Board engagement in these matters includes dialogue and questions, board member insights and perspectives from their industry experience and subject matter expertise and strategic suggestions and considerations for Company management to evaluate, all as part of the board's oversight of Company cybersecurity risks. The Company's Chief Information Officer and Director of Global Cybersecurity are also available to board members to discuss questions concerning cybersecurity matters.

companyName: DARLING INGREDIENTS INC.

ticker: DAR


text: Cybersecurity Incidents. In 2023, we did not identify any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, see the Technology Risks in Item 1A. "Risk Factors".

companyName: REGIONS FINANCIAL CORP

ticker: RF


text: Board Oversight of Cybersecurity Risks Our Board of Directors receives periodic updates on cybersecurity matters from our Chief Executive Officer (based on consultation with our Chief Information Security Officer ("CISO") and other senior members of our Information Security and/or Technology teams). In addition, a member of senior management responsible for the Company's Information Security team provides an annual briefing to our Board of Directors regarding the overall state of our cybersecurity program, information on the current cybersecurity threat landscape, risks from cybersecurity threats and any cybersecurity incidents that are reasonably likely to materially affect, or which have materially affected, the Company.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of our Board's continuing education on topics that impact public companies.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: The Board has reviewed and discussed with management, the Company's risk assessment process, risk management framework and reporting mechanisms, implementation and monitoring, including as each of these relates to cybersecurity risks. The Audit Committee coordinates and assists the Board in its oversight of risk. The Board and Audit Committee each receive presentations and reports on Company risks, including cybersecurity risks. The Cybersecurity Plan also contemplates that the Board will also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board has discussed the Company's approach to cybersecurity risk management with the members of management, including the Company's Executive Vice President of Information Technology.

companyName: Verano Holdings Corp.

ticker: VRNO


text: Risk Management and Strategy TEP's cybersecurity risk management program is informed by the National Institute of Standards and Technology Cybersecurity Framework. This program includes dedicated investments in people, processes, and technology to manage and reduce cybersecurity risk, including third-party threats. Multiple layers of security controls are deployed across asset and technology classes with a special emphasis on the reliable and safe operation of TEP's utility systems. Cybersecurity controls employed include firewalls, access management, multi-factor authentication, backups, endpoint protection, threat intelligence, and security monitoring. TEP continues to adjust and refine this program in response to the shifting threat landscape, third-party assessments, and industry best practices.

companyName: TUCSON ELECTRIC POWER CO


text: Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program. Our current CISO has been with the Company for more than eight years—serving as our CISO for nearly seven years—and has extensive cybersecurity experience through leadership and consulting roles. His current leadership team comprising seven individuals has over 130 years of combined cybersecurity experience. These and other EIP team members work closely with stakeholders across the Company to implement the program's policies, standards and processes and help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.

companyName: BEST BUY CO INC

ticker: BBY


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include incident management, change management, network segmentation, cyber protection and containment, detection and response, and recovery. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: We regularly check and improve our security measures and educate our employees about them with the help of our information technology team. Key personnel are made aware of our cybersecurity policies through trainings.

companyName: Revolve Group, Inc.

ticker: RVLV


text: • Physical security • User access controls • Vendor risk management • Teleworking protocols • Mobile device management • Comprehensive system monitoring These initiatives collectively reinforce our commitment to safeguarding information and ensuring the resilience of our security infrastructure. Comprehensive contingency and recovery plans are in place to ensure the ongoing provision of services to customers in the event of a cybersecurity incident. These are tested on a regular basis against scenarios of varying degrees by both internal and external resources.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: As of the filing of this report, we do not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect, Alto Ingredients, Inc.

companyName: Alto Ingredients, Inc.

ticker: ALTO


text: The Company operates almost exclusively in a Software-as-a-Service (SaaS) IT environment. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third -party service providers. The internal business owners of the hosted applications are required to document quarterly user access reviews and obtain a System and Organization Controls (SOC) 1 and/or SOC 2 report from our SaaS vendors. With assistance from an external consultant, management conducts an annual review of third -party SOC reports with a specific focus on their data protection procedures. If a third -party vendor is not able to provide a SOC report, management takes additional steps to assess their cybersecurity preparedness and assess our relationship with them on that basis. Our assessment of risks associated with the use of third -party providers is a significant part of the Company's overall cybersecurity risk management framework.

companyName: Presidio Property Trust, Inc.

ticker: SQFT


text: The Audit Committee of the Board of Directors oversees our entity wide risks, including cybersecurity strategy, the assessment of cybersecurity risks, and the actions we take to monitor and mitigate cybersecurity risks. Working directly with executive management, our cybersecurity program is overseen and implemented by our Chief Information Officer ("CIO"), who has over 20 years of experience building and maintaining cybersecurity programs, and a team of skilled individuals, including a Director of Enterprise Security, and a Cyber-Resilience Team, who, together, are responsible for monitoring our networks, providing training to our employees, analyzing the evolution of new threats and strategies for mitigating such threats, and seeking to continually harden our cybersecurity program. The Cyber-Resilience Team is dedicated to recovery efforts and business continuity plans and is knowledgeable across our information technology and operational applications. The Audit Committee reviews, with the CIO and executive management, the company's technology and cybersecurity program, including company plans, programs, policies, assessments and opportunities at its regularly scheduled meetings. Our CIO is responsible for providing regular updates, at least quarterly at regularly scheduled meetings, to the Audit Committee regarding cybersecurity-related situations, intelligence pointing to increased adversary activity, regulatory changes, and improvements or impediments to our cybersecurity posture. The Audit Committee reports on cybersecurity-related matters to the Board of Directors on an annual basis, or more frequently if there are any required matters to report. Based on these updates, the Audit Committee and the Board of Directors may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks and threats may also be escalated to the Audit Committee by the CIO and executive management on an as needed basis.

companyName: GENESIS ENERGY LP

ticker: GEL


text: At the management level, our Chief Technology Officer ("CTO"), SVP, Technology and Information as well as our cybersecurity personnel are primarily responsible for identifying, assessing, monitoring and managing our cybersecurity. Our CTO reports directly to our President and Chief Executive Officer and at least quarterly meets with the Cyber Committee. Our current CTO has over 35 years of industry experience, including serving as CIO/CTO for over 6 years and having extensive experience in developing and leading technology risk management programs. Additionally, our technology staff holds multiple industry standard security certifications, including Cisco Certified Network Associate ("CCNA"), PCI Internal Security Assessor ("PCI ISA") and Certified Ethical Hacker ("CEH").


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications or similar technologies which are monitored by the Franklin Templeton cyber defense team, notifications from employees, borrowers or service providers, and notifications from third party information technology system providers. Franklin Templeton also has a comprehensive threat intelligence program that performs proactive analyses leveraging internal, government and third party provided intelligence to identify and mitigate risks to the firm. Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the Franklin Templeton incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Ford and Ford Credit's global cybersecurity incident response is overseen by Ford's Chief Information Security Officer. Ford's Chief Information Security Officer has served in that role for over 6 years and has over a decade of engineering and operations expertise with cybersecurity technologies and services. He was appointed in 2022 by the Ford Credit Board as Ford Credit's "Qualified Individual" under the Federal Trade Commission Safeguards Rule, and is responsible for overseeing and implementing Ford Credit's information security program and enforcing it. Ford Credit's Chief Technology Officer is Ford Credit's senior member responsible for direction and oversight of the Qualified Individual. Ford's Chief Information Security Officer also reports to Ford Motor Company's Chief Enterprise Technology Officer, who has spent over two decades leading digital and technology organizations at both enterprise software companies and Fortune 50 enterprises. Ford's Chief Enterprise Technology Officer reports directly to Ford's Chief Executive Officer.

companyName: FORD MOTOR CREDIT CO LLC


text: We have a process to record identified risks from cybersecurity threats in our risk register, along with an assessment of the severity of the potential impact and the likelihood of occurrence. This process is designed to facilitate a unified and integrated assessment of corporate risk and governance. The risk register is reviewed periodically by senior management and at least annually by the Board of Directors. Our cybersecurity program is also periodically evaluated by external security consultants, with the results of those reviews reported to senior management and the Audit Committee, as appropriate.

companyName: Barinthus Biotherapeutics plc.

ticker: BRNS


text: Management Oversight Our Director, Cyber Security and Chief Information Officer are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. Keeping senior management abreast of the cybersecurity posture and potential risks facing the Company is viewed as crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Director, Cyber Security leads a team of cybersecurity engineers, manages vendor relationships, and is responsible for implementation and oversight of processes for monitoring enterprise information systems. These processes include the deployment of advanced cybersecurity platforms which continually assess, remediate and provide regular measures and regular system audits so that identified threats and potential vulnerabilities can be addressed. In the event of a cybersecurity incident, the Director Cyber Security is equipped with our Cybersecurity Incident Response Plan. This plan includes an escalation protocol to ensure Company leaders and the Board of Directors are aware of and can oversee response plans, immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. Processes also include escalating potentially material incidents directly to the General Counsel to ensure incidents are reported as required by applicable law and regulation. Both the Board of Directors and the Company's IT Steering Committee, which is comprised of senior executives are kept updated on any material incidents, cybersecurity initiatives and the Company's cybersecurity strategic roadmap.

companyName: Cornerstone Building Brands, Inc.


text: Our CTO regularly briefs the full Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of all material cybersecurity incidents and the results of any third-party assessments. Additionally, our Board has designated a single Board member, who has experience in assessing and managing cybersecurity risk, to lead the Board-level oversight of cybersecurity risk matters, including staying abreast of cybersecurity best practices and briefing the full Board when significant industry developments occur.

companyName: Spire Global, Inc.

ticker: SPIR


text: Respond and Manage. When detected, suspected cybersecurity threats are escalated to the Information Security Team (as described below) in various ways based on the nature of the cybersecurity incident, including but not limited to system engineer escalation, the Cars Commerce helpdesk and in-house and third-party security tools. Cars Commerce employees are also responsible for reporting any suspected cybersecurity or information security event that they observe or experience as soon as possible, by either contacting the Cars Commerce helpdesk, or the Information Security Team directly. The Information Security Team then creates a Security Incident Response Team ("SIRT") which, depending on the incident, comprises of the cybersecurity staff, Systems and Network Engineers, the Chief Technology Officer and the Chief Legal Officer, or other stakeholders as appropriate. The SIRT investigates and manages the impact of cybersecurity incidents in accordance with the security incident response procedures.

companyName: Cars.com Inc.

ticker: CARS


text: Please refer to the risk factor captioned " We are increasingly dependent on information technology; Disruptions, failures or security breaches of our information technology infrastructure could have a material adverse effect on our operations " included in Part I, Item 1A, "Risk Factors," of this report, for further information about cybersecurity risks and potential related impacts on our company.

companyName: B&G Foods, Inc.

ticker: BGS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Our Business, Industry and Operations— If we or our third-party providers fail to protect confidential information and/or experience cybersecurity incidents, such as cyber-attacks, data breaches, hacking attacks or malware, there may be disruptions to our operations, triggering significant liability for us, which could harm our operating results and financial condition, and damage our reputation or otherwise materially harm our business."

companyName: Cipher Digital Inc.

ticker: CIFR


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems. The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • deployment of best in-class solutions to enhance our security posture; • penetration testing performed by a dedicated specialized team that is supplemented with periodic third-party engagements; • periodic third-party reviews of program maturity are conducted based on the National Institute of Standards and Technology ("NIST") Cybersecurity Framework; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations. The program is continually adapting to the evolving threat landscape and technology developments.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: Our audit committee, typically in joint session with our board of directors, meets quarterly with the Vice President of Information Security & Privacy, the Vice President of Information Technology, and/or the CTO who provide updates to it on, among other things, cybersecurity threat landscape, risk assessments, mitigation plans, notable incidents, the status of projects to strengthen our information security systems, engagement of third parties (e.g., consultants and auditors) and third-party tools, and our employee-training programs.

companyName: PAR TECHNOLOGY CORP

ticker: PAR


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Risks Related to Our Business and Industry" as part of our risk factor disclosures in Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.

companyName: Centuri Holdings, Inc.

ticker: CTRI


text: We assess and manage our cybersecurity risk using various mechanisms, starting with threat intelligence, which provides us a necessary viewpoint to help us identify trends, understand how certain attacks may affect us, and prepare for evolutions in threat actor behavior that may require changes to our security posture. We monitor emerging trends and regulations related to information security, and implement appropriate changes, as needed, to our cybersecurity risk management program.

companyName: TORO CO

ticker: TTC


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.

companyName: DESTINATION XL GROUP, INC.

ticker: DXLG


text: Our Board of Directors oversees the management of risks inherent in the operation of our business, with a focus on the most significant risks that we face, including those related to cybersecurity. Our Board of Directors has delegated oversight of cybersecurity, including privacy and information security, as well as enterprise risk management to the Audit Committee. In connection with that oversight responsibility, our VP of IT and General Counsel meet with the Audit Committee on a quarterly basis to provide information and updates on a range of cybersecurity topics which may include our cybersecurity program and governance processes; cyber risk monitoring and management; the status of projects to strengthen our cybersecurity and privacy capabilities; recent significant incidents or threats impacting our operations, industry, or third-party suppliers; and the emerging threat landscape.

companyName: MOTORCAR PARTS OF AMERICA INC

ticker: MPAA


text: Cybersecurity Program Overview As an externally managed company, our day-to-day operations are managed by our Advisor and our executive officers under the oversight of our board of directors. Our executive officers are senior Nuveen Real Estate professionals and our Advisor is a subsidiary of TIAA. As such, we are reliant on TIAA for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details TIAA has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Nuveen Global Cities REIT, Inc.


text: Within our organization, our CIO, who reports to our CEO, oversees cybersecurity. Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom. Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries. The SDIS maintains Certified Information Systems Security Professional and Certified Information Security Manager certifications and holds a degree in information technology management.

companyName: APOGEE ENTERPRISES, INC.

ticker: APOG


text: To manage vendor risk, we conduct ongoing risk assessments based on the vendor's published Systems and Operational Controls ("SOC") reports, information provided in vendor security questionnaires, and any publicly available information including ongoing litigation or external disclosures.

companyName: SUN COMMUNITIES INC

ticker: SUI


text: The Security Governance Committee meets regularly and receives prompt and periodic information, as needed or applicable pursuant to Bank policies and plans, from the Information Security Department which in turn provides periodic, regular and prompt reporting to senior management. Reports include topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, project development and implementation, any cybersecurity incidents or threats occurred, as well risk assessment, management and monitoring updates, as applicable and as needed.

companyName: Federal Home Loan Bank of Atlanta


text: The Company maintains cybersecurity prevention and response plans and procedures (the "Cybersecurity Policies") that set forth the Company's plan to prevent, manage, report and resolve cybersecurity events. The Cybersecurity Policies set forth the Company's policies and procedures for cybersecurity event prevention, including the Company's (i) network and computer systems acceptable use policy, (ii) data backup procedures, (iii) business continuity plan, (iv) data retention policy, (v) disaster recovery plan, (vi) email use and security policy, (vii) network change management procedures, and (viii) password and authentication requirements policy. The Cybersecurity Policies also (i) provide indicators that Company employees should be aware of to recognize a cybersecurity event, (ii) outline the roles and responsibilities for Company employees and other third parties with respect to the Company's cybersecurity incident response team ("CSIR Team"), (iii) set forth the steps to take in response to a cybersecurity incident, including reporting the incident, investigating the incident, preserving non-affected systems and data, informing, as appropriate, Senior Management (as defined below), insurance carriers, law enforcement and other parties that may be affected by the incident and (iv) include the processes for maintaining business continuity.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Our cybersecurity strategy leverages administrative safeguards that include policies, procedures and processes to assess, identify and manage risks from cybersecurity threats. We have adopted a Cybersecurity Incident Response Policy (the "CIRP"), which provides a framework and procedures for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.

companyName: Valaris Ltd

ticker: VAL


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, EDR tools, and PEN test exercises that focus on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the executive management team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Our cybersecurity program is integrated into our overall risk management program and includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer (CISO) in connection with our Chief Technology Officer, Chief Legal and People Officer, our Senior Vice President of Legal and Vice President, Internal Audit. Such individuals have extensive prior work experience and expertise spanning over three decades in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, managing cybersecurity operations and incident response, and incorporating security and privacy by design into software development programs, and our CISO has both CISSP and CRISC certifications.

companyName: Sunrun Inc.

ticker: RUN


text: We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk assessment and management system incorporates risks from cybersecurity threats alongside other risks to the Company. We also have a management level risk management council that supports our processes to assess and manage cybersecurity and other risks. Our information security team oversees and implements security controls designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data, including protected health and personal information. These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication. We provide annual security awareness training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address.

companyName: National Vision Holdings, Inc.

ticker: EYE


text: We rely on third parties, including cloud vendors, for various business functions. We select key third-party service providers based on several factors, including the type of data processed and the nature of services offered, and we oversee such key third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Governance.

companyName: iTeos Therapeutics, Inc.


text: As part of the QNB's overall risk management processes, it has established both the Information Technology Committee and the Information Security Committee. The Technology Committee comprises the executive management team, selected department heads, and the Information Security Officer ("ISO"). The Technology Committee reports to the Board of Directors. The second committee is the Information Security Committee, composed of QNB's Chief Operating Officer ("COO"), the Information Technology Director, and the ISO. The Information Security Committee reports to QNB's Audit Committee. QNB's COO presents a detailed report on information systems and cybersecurity matters to the Board of Directors at least once annually. The Board of Directors also receives and reviews copies of minutes of all meetings of the Audit Committee and the Information Technology Committee. The Audit Committee receives minutes from the Information Security Committee and audit reports related to Technology and Cyber control testing.

companyName: QNB CORP.

ticker: QNBC


text: Our Board of Directors has oversight responsibility for risks to our company, including incidents related to cybersecurity threats. There are more changes coming.

companyName: South East Asia Development, Corp.


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of the Booz Allen and client information provided to the supplier, we also require suppliers to complete our security questionnaires (based on data categorization) and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity risks alongside other company risks as part of our overall risk assessment process. Our enterprise risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigation strategies. We employ various tools and services for such purposes, including network, cloud and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises. We also have a cybersecurity risk assessment process, which surfaces cybersecurity risks by measuring our posture against industry standards and engaging third parties to assess our information security program.


text: trust security architecture, which implements strict identity verification, least privilege access and network segmentation to reduce with leading cybersecurity firms for independent security audits, risk assessments, and compliance rev iews as described below.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: As an important cybersecurity risk mitigant, Manhattan provides mandatory training to its new hires and quarterly training of its employees, including phishing simulation tests and follow-up tests as needed, along with monthly cybersecurity newsletters and other cyber risk-related communications.

companyName: MANHATTAN ASSOCIATES INC

ticker: MANH


text: Our processes also address oversight and identification of cybersecurity threat risks from our use of third-party service providers, including those in our supply chain. This involves, among other things, conducting pre-engagement risk-based diligence, implementing contractual security and notification provisions, and ongoing monitoring as needed.

companyName: DURECT CORP


text: Depending on the relevant information systems environment, we implement and maintain various technical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, incident detection and response measures, a vulnerability management policy, disaster recovery/business continuity plans, risk assessments, implementation of security standards/certifications, encryption of certain data, network security controls, data segregation, access controls, asset management (such as tracking and disposal of our information systems), systems monitoring, and cybersecurity insurance.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: The Company recognizes the importance of a cybersecurity risk management program designed to assess, identify, and manage risk associated with cybersecurity threats. Our cybersecurity risk management program (the "Program") is consistent with the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, which incorporates bank regulatory guidance and principles from the National Institute of Standards and Technology Cybersecurity Framework and includes the following risk-based principles: • Identification, measurement, mitigation, monitoring and reporting of cybersecurity threats based on internal and external information sharing and resources; • Safeguards designed to protect against identified threats, including documented policies and procedures, controls, and employee education and awareness; • Processes to detect cybersecurity events and improve incident response, including routine testing of incident response, recovery and business continuity plans and processes; and • Third-party risk management process to manage cybersecurity risk with service providers, suppliers, and vendors.

companyName: UWHARRIE CAPITAL CORP

ticker: UWHR


text: As further described in Item 1A. "Risk Factors – Risks Related to Cybersecurity, Data Security, and Privacy, Information Technology and Intellectual Property," the Department of Homeland Security's ("DHS") Transportation Safety Administration has issued a series of security directives that require us to take a number of actions, including among other things, to appoint personnel, report confirmed and potential cybersecurity incidents to the DHS Cybersecurity and Infrastructure Security Agency and provide vulnerability assessments. We have adopted a cybersecurity program, which uses technology and processes designed to help mitigate cybersecurity risks, with our information technology ("IT") and operational technology ("OT") teams working together to protect, identify, detect, mitigate and respond to potential cybersecurity incidents that threaten our Company. Our cybersecurity program includes a process for overseeing and identifying cybersecurity risks associated with our third-party service providers.

companyName: HF Sinclair Corp

ticker: DINO


text: Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, incident response, vulnerability assessment, threat intelligence, third-party risk management, change management, and business resilience. The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function. The second line of defense function is separated from the first line of defense function through organizational structure and overall cybersecurity management is independently reviewed by a third line through the audit function. The department, as a whole, consists of information security professionals with varying degrees of education and experience. Individuals within the department are generally subject to professional education and certification requirements. In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

companyName: FIRSTSUN CAPITAL BANCORP

ticker: FSUN


text: Our full board of directors is responsible for overseeing and managing risk to our business. Given the extent of our IT systems and the nature of our business, management has determined that it is not currently necessary to make regularly scheduled reports to the board regarding our IT systems and cybersecurity. However, management continually reassesses the most significant risks to our business and would promptly report to the board of directors any material change in the level of risk to our business from cybersecurity threats. Management will continue to consult with our third-party IT firm to monitor this risk and adopt any recommended security protections and best practices.

companyName: CKX LANDS, INC.

ticker: CKX


text: Our cybersecurity program is led by our Chief Information Officer (CIO) and the Chief Information Security Officer (CISO). They are supported by Information Security Officers who work closely with our operational teams. Our CIO and CISO have more than 35 years of collective experience in the cybersecurity field. The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems. The CISO has served in similar roles at three major public companies and is a recognized cybersecurity leader. He regularly engages with peer CISOs, cybersecurity experts and organizations, including the Cloud Security Alliance (CSA) and the NIST, to stay informed on the latest industry developments. The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk framework. This also helps ensure that the highest levels of management are kept abreast of our cybersecurity posture and potential risks.

companyName: ROYAL CARIBBEAN CRUISES LTD

ticker: RCL


text: As a U.S. Government contractor, we may be prone to a greater number of those threats than companies in other industries. We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective. As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future. See Item 1A of this Report for more information on our cybersecurity risks.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: We also have a robust and rigorous oversight process for managing cybersecurity risks related to our third-party service providers. The process includes: conducting due diligence and background checks on the potential service providers; verifying their cybersecurity credentials, capabilities, and track record;

companyName: AGREE REALTY CORP

ticker: ADC


text: We engage third-party providers to conduct evaluations of our security controls, through penetration testing, independent audits or consulting on best practices. These evaluations include testing both the design and operational effectiveness of our security controls.

companyName: EGAIN Corp

ticker: EGAN


text: Board of Directors has oversight of our cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.

companyName: GIFTIFY, INC.

ticker: GIFT


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer ("CIO"), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: Energy Services of America CORP

ticker: ESOA


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce detection time and improve recoverability These include the ongoing monitoring of our systems, including with the assistance of third-party vendors, conducting exercises with employees and senior management, including our executive officers, to promote awareness and improve internal processes. In addition, to promote security awareness throughout the Company, employees with an email address received training and access to security awareness materials in 2024. Further, we are implementing a program for the assessment and monitoring of security standards and control procedures for external suppliers and vendors.

companyName: CNH Industrial N.V.

ticker: CNH


text: Our DO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually. These briefings have included a range of topics, such as: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; • Metrics demonstrating company and industry-standard prevention of common threats; and • Regulatory changes impacting cybersecurity requirements and strategy.

companyName: TriSalus Life Sciences, Inc.

ticker: TLSI


text: Our cybersecurity program is spearheaded by its software department, with support from external advisors and approval from executive management. The stakeholders have been identified and know their roles within the cyber security process as well as having all roles be documented.

companyName: USBC, Inc.

ticker: USBC


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • integration with software development procedures and processes throughout the lifecycles of our products. • a team comprised of IT security, IT engineering and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems and designated security champions throughout the Company's departments; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; • a third-party risk management process for service providers.

companyName: Playtika Holding Corp.

ticker: PLTK


text: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, phishing simulators, incident response tabletops, cybersecurity insurance and business continuity planning for the protection of the Company's assets. Additionally, the Company's cybersecurity function is audited on an annual basis by a third party using the MITRE ATTACK framework.

companyName: FIRST FINANCIAL BANCORP /OH/

ticker: FFBC


text: Risk Management and Strategy Angel Oak Capital, an affiliate of our Manager, has engaged a third-party managed information technology service provider (the "IT Service Provider"), to serve as Angel Oak Capital's dedicated information technology manager. We have no employees and are externally managed by our Manager, an affiliate of Angel Oak Capital, and as such rely on our Manager for the implementation and execution of our risk management program, and, as it pertains to the assessment, identification, and management of material risks from cybersecurity threats, our Manager relies on the IT Servicer Provider. As an affiliate of Angel Oak Capital, our Manager is subject to and participates in the cybersecurity policies and procedures of Angel Oak Capital. The IT Service Provider provides Angel Oak Capital a system and organization controls report on itself consistent with SOC 2 as part of annual reviews of the IT Service Provider.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Our Board of Directors addresses cybersecurity risk management as part of its general oversight function and delegates cybersecurity risk management oversight to our Audit Committee. Our management team is responsible for assessing and managing our material risks from cybersecurity threats and provides updates to the Audit Committee on major developments regarding cybersecurity matters. The Audit Committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and reports any findings and recommendations, as appropriate, to the Board of Directors for consideration.

companyName: SCIENTIFIC INDUSTRIES INC

ticker: SCND


text: End users did not have permission to access PHI unless the end user's account had the proper end user role permissions (e.g., HCPs or hub service providers). These end user roles were assigned according to the customer's needs to see the information. At all times, such information was segregated so that one customer could not access records containing PHI that were associated with another customer.

companyName: OptimizeRx Corp

ticker: OPRX


text: Security Operations - Ensuring continuous operational coverage of security events and alerts, maintaining and executing processes for triage, containment, investigation and escalation/communication and threat intelligence.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: Coordinating incident response or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information and/or cyber security incidents;

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: We regularly conduct internal risk assessments to identify reasonably foreseeable security risks or threats and to evaluate and categorize those risks or threats based on the likelihood and potential impact to the security, confidentiality and integrity of our IT systems and sensitive business information. Our risk assessments are developed from industry best practices and frameworks, including external third-party maturity assessments. As part of our information security program, we regularly assess the sufficiency of our safeguards to control potential risks. As part of our risk assessment process, we regularly measure, analyze and report security and risk metrics and share those findings with the Board and senior management. We have invested and continue to invest in risk management measures in order to protect our IT systems, operations and sensitive business information.

companyName: PRA GROUP INC

ticker: PRAA


text: Cybersecurity operational measures Led by our CIO, the Company's data protection, information, cyber and technology services team collaborates with subject-matter experts throughout the business to identify, monitor and mitigate material risks, as well as to monitor compliance with the Company's security polices, applicable laws and regulations. The Company's security monitoring team manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained security analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities and with support of the Company's Incident Response Plan. The Incident Response Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The Incident Response Plan organizes resources to manage and resolve events that harm or threaten the security of information assets. The Incident Response Plan includes involvement of the Company's Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The Incident Response Plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.

companyName: Oak Valley Bancorp

ticker: OVLY


text: Old Republic depends upon technology-based information systems to conduct business. The Company uses computer systems and other electronic information resources, including both proprietary and third-party technology systems and tools, to process, transmit, receive, and store certain personal, confidential, and proprietary information; to communicate with customers, service providers, and other third parties by email and other electronic means; and perform various business operations, including transferring significant amounts of funds.

companyName: OLD REPUBLIC INTERNATIONAL CORP

ticker: ORI


text: To further bolster our cybersecurity controls, we also have a third-party risk management program in place applicable to all of its contractors, vendors, and service providers which includes risk assessments, cybersecurity questionnaires, data privacy addendums, and contractual flow-downs of legal and regulatory requirements. We also require our contractors, subcontractors, vendors and service providers to report security incidents to us without undue delay.

companyName: HACKETT GROUP, INC.

ticker: HCKT


text: The VP of IT leads the operational oversight of company-wide cybersecurity strategy, policies, processes, and support staff. Additionally, the VP of IT works across all relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The VP of IT reports and provides regular updates to the Chief Operations Officer and Chief Financial Officer on the cybersecurity program as well as periodic updates to executive management, as needed. Our VP of IT has worked in the information technology field for over 19 years at biotechnology companies including publicly-traded organizations.

companyName: Scholar Rock Holding Corp

ticker: SRRK


text: Blue Owl's cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems. These third parties assess and report on Blue Owl's compliance with applicable laws and regulations and its internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement. Annual penetration testing of its network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by Blue Owl IT Management. When Blue Owl engages vendors and other third party partners who will have access to sensitive data or client systems and facilities, its infrastructure technology team assesses their cybersecurity programs and processes.

companyName: Blue Owl Capital Corp II


text: Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity. Our program sets guidelines for identifying, measuring, monitoring, and reporting the risks associated with third parties through the life cycle of the relationships, which includes planning, due diligence and third-party selection, contracting, ongoing monitoring, and termination. Our program includes the identification of third parties with risks related to information security. Third parties that access, process, collect, share, create, store, transmit, or destroy our information or have access to our systems may have additional security requirements, depending on the levels of risk, such as enhanced risk assessments and monitoring, and additional contractual controls. We also conduct reassessments of our third-party risk, using a risk-based approach to determine frequency. Where appropriate, the Company seeks to incorporate contractual language with third-party service providers that address the collection, use, sharing, and retention of user data, as well as compliance with appropriate security terms.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: Other threats may include the compromise of customer personally-identifiable information. We continually monitor for threats to avoid risks to Company or individuals' data, interruptions to business operations, or financial losses.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: Oversee Third-party Risk We are aware of risks associated with third-party service providers, and the Company employs a third-party risk management program that includes a systematic evaluation of potential risks associated with engaging third-party vendors, suppliers or partners that may have access to Company sensitive information, systems, or networks. This process is also intended to provide for the security and integrity of the Company's data that may be stored on third-party systems. The process identifies and addresses potential security vulnerabilities, safeguarding Company information assets and reducing the overall risk of cyber threats. The Company's assessments begin during the onboarding of third parties and may continue throughout the relationship, based upon an assessment of third-party risk. Those assessments also include Company audit rights, third-party notification obligations, and security requirements for the retention of Company data. The Company maintains a team consisting of employees, contractors and consultants to oversee this process.

companyName: MSA Safety Inc

ticker: MSA


text: Griffon also has a Cybersecurity Management Committee, consisting of executives from Griffon and technology leaders from Griffon's business segments, that monitors and assesses progress and performance by Griffon's business segments in the area of cybersecurity; the results of such assessments are reported to the Audit Committee from time to time. The Chief Information Officers of each of HBP and CPP regularly provide updates on material cybersecurity risks to our senior management and to our Audit Committee, and along with their technology teams, are responsible for assessing and managing cybersecurity risks. Each of our business segment Chief Information Officers has over 20 years of experience in cybersecurity, information security, policy, architecture, engineering and incident response.

companyName: GRIFFON CORP

ticker: GFF


text: We depend on and engage various third parties and service providers, including suppliers, custodians, transfer agents, property management companies, and joint venture partners, to operate its commercial real estate and investment business. We rely on the expertise of risk management, legal, information technology, and compliance personnel of TIAA when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.

companyName: Nuveen Global Cities REIT, Inc.


text: Results of cybersecurity risk assessments and tabletop exercises are reported to governance committees and aid in the development of our cybersecurity strategy, which takes into account the Company's strategic objectives and our ability to navigate potential internal and external disruptions. The overarching objective of our cybersecurity strategy is to reduce risk and enhance the resilience of our assets. Four key components support this objective: enabling our cyber defense posture, creating and retaining cyber-aware customers, considering identities at system access, and preparing a cyber-resilient workforce. Our cybersecurity team operates under eight distinct programs, each led by a subject matter expert. Each program has its own strategy, projects, and initiatives designed to achieve the overall strategic objective and its key components.

companyName: BOK FINANCIAL CORP

ticker: BOKF


text: The Audit Committee is responsible for the review of risks relating to our information technology system, including cybersecurity, emerging cybersecurity developments and threats and our strategy for mitigating cybersecurity risks. Our entire Board of Directors is responsible for overseeing management's risk assessment and risk management processes designed to monitor and mitigate information security risks. The CIO and Director of Cybersecurity reports on cybersecurity matters semi-annually to the Board, primarily through the Audit Committee. Management provides benchmarking information and updates on key operational and compliance metrics to the Audit Committee. In addition, cybersecurity training is provided to the Audit Committee, to educate directors on the current cybersecurity threat environment and measures companies can take to mitigate the risk and impact of cyberattacks. As described above, management is actively involved in assessing and managing the Company's material cybersecurity risks. The CIO and the Director of Cybersecurity primarily lead these efforts. The CIO, reporting to the Company's Executive Vice President and Chief Financial Officer, manages the global information technology and cybersecurity programs. The CIO holds bachelor's and master's degrees in business administration, specializing in information systems and quantitative methods from Loyola Marymount University. The CIO has over 25 years of information technology expertise with extensive experience in enterprise risk management, including analysis, development, evaluation, and testing of control objectives and procedures to mitigate risks. The Director of Cybersecurity oversees and helps to ensure appropriate capabilities and controls are implemented in the areas of network security, endpoint protection, data protection, incident response, identity, and access management. Additionally, in this role, the Director of Cybersecurity works closely with third-party security partners surrounding monitoring and incident response services.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: At the Group level, CRH conducts a semi-annual bottom-up risk assessment focused on CRH's operating companies and business units, including cybersecurity-related risks, which evaluates the impact and likelihood of the identified cyber risks and the effectiveness of existing security measures, policies, and procedures. CRH also requires that each operating company completes a self-assessment regarding its cyber controls and risk, including user awareness training, email security protection, multi-factor authentication, system patch management, identity management, network segregation, antivirus and web protections, asset inventory, privileged access management, logging, monitoring, and incident response capabilities. As described further below under "Cybersecurity Governance", CRH's Board and senior management receive regular briefings on cybersecurity risks facing CRH and are closely involved in identifying cybersecurity risks, developing CRH's plan for managing such risks, and continuously refining CRH's cyber defenses in response to the information gathered through the above-mentioned risk assessments.

companyName: CRH PUBLIC LTD CO

ticker: CRH


text: Our CISO leads our Information Security Department, is responsible for the information security program, which includes cybersecurity, and reports to the Chief Risk Officer. Our CISO joined the Company in 2012. He has over two decades of experience, involving both information technology and information security. He has a Master of Business Administration in Cybersecurity, graduate studies certificate in cybersecurity and has achieved four certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Data Privacy Solutions Engineer and Cisco Certified Network Associate.

companyName: SOUTHSIDE BANCSHARES INC

ticker: SBSI


text: Our IRP includes clear communication guidelines, outlining procedures for engaging executive management, internal and external legal counsel, the Audit Committee, and the Board. These protocols also encompass a framework for evaluating our regulatory reporting obligations to entities such as the SEC in the aftermath of a cybersecurity incident.

companyName: Extra Space Storage Inc.

ticker: EXR


text: Board of Directors Our Board of Directors ("Board") and its committees oversee the risk management functions of the Company. Our Audit Committee plays a significant role in oversight of risks, including cybersecurity. At least quarterly, the Audit Committee receives an update on cybersecurity matters from the Company's Senior Vice President of Information Technologies and Engineering and our Vice President & Global Chief Information Security Officer ("CISO"). These updates address a broad spectrum of cybersecurity topics including recent developments, evolving technology practices, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, cybersecurity considerations arising with respect to the Company's third-party service providers, and other cybersecurity considerations. Our Vice President of Internal Audit also updates the Audit Committee at least quarterly on internal audit matters, including those related to information technology and security. Additionally, the Company's Cybersecurity Incident Reporting process (described below), provides that potentially significant cybersecurity incidents be promptly reported to the Chairman of the Audit Committee, who will also receive ongoing updates regarding any such incident as appropriate. Cybersecurity incidents determined to be material are reported to the Board of Directors promptly following such determination.

companyName: Helmerich & Payne, Inc.

ticker: HP


text: Part I - Item 1C. Cybersecurity Both the CIO and the CISO have expertise assessing and managing cybersecurity risks. The CIO has served in her current role since 2019 and served in similar technology leadership roles before her current role. She has eighteen years of executive leadership experience in the financial services industry and twenty-eight years of overall technology experience, during which time she has led large scale business transformation, delivered innovative technology strategies and has overseen and modernized complex technology portfolios.

companyName: HARTFORD INSURANCE GROUP, INC.

ticker: HIG


text: We employ an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to imitate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.

companyName: Public Storage

ticker: PSA


text: Our operations rely on both on-premises and cloud-hosted IT solutions for critical business processes such as compliance, reporting, marketing, e-commerce, operations, product development, manufacturing, distribution, data management, and stakeholder communication. Recognizing the paramount importance of cybersecurity in today's digital landscape, we are committed to safeguarding our information assets, protecting consumer data, and maintaining the integrity and availability of our systems. To this end, we have implemented a comprehensive cybersecurity risk management framework designed to identify, assess, mitigate, and prevent potential cybersecurity risks, aligning with industry best practices and all applicable regulatory requirements. We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology's Cybersecurity Framework ("NIST-CSF"), which outlines the core components and responsibilities necessary to sustain a robust and well-balanced cybersecurity program.

companyName: AMERICAN WOODMARK CORP

ticker: AMWD


text: As of the date of this report, other than the risks discussed in "Risk Factors," the Company knows of no risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: WESTERN ALLIANCE BANCORPORATION

ticker: WAL


text: Management's Responsibilities Our information security program is led by our corporate Chief Information Security Officer ("CISO"), who works closely in a cross-functional capacity with key corporate and operational business stakeholders, including our Chief Information Officer. They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience. The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, maintaining our cybersecurity program, and other information security incidents. The CISO provides regular updates on our cybersecurity posture and preparedness to senior management.

companyName: Science Applications International Corp

ticker: SAIC


text: v. Education and Awareness - The Company conducts cybersecurity training, both formally through mandatory courses and informally through written communications and other updates. Employees are tested periodically with phishing tests to reinforce training. The Company has held webinars and also sends periodic emails to its customers with tips and suggestions to protect themselves against cybersecurity incidents.

companyName: CENTRAL PACIFIC FINANCIAL CORP

ticker: CPF


text: through policy, practice and contract (as applicable), require employees, as well as third parties who provide services on our behalf, to treat customer information and data with care;

companyName: AXON ENTERPRISE, INC.

ticker: AXON


text: Management has implemented risk management structures, policies and procedures, and Management is responsible for our day-to-day cybersecurity risk management. Our Chief Data and Information Officer (CDIO) is responsible for our day-to-day assessment and management of cybersecurity risks. Our Enterprise Enablement function facilitates a cross-departmental approach, ensuring the executive leadership team receives quarterly updates on cybersecurity from various teams. This strategy promotes a comprehensive stakeholder engagement and enhances management oversight on cybersecurity. The updates cover progress on ongoing cybersecurity initiatives, insights from any potential threats or incidents, outputs and action plans from external vulnerability and penetration tests, and key performance metrics in line with industry standards.

companyName: Inogen Inc

ticker: INGN


text: We also provide new hire and annual security awareness and privacy training to employees. We conduct monthly phishing assessment exercises to ensure employees are aware and educated about phishing threats and are trained to identify and report them. In addition, targeted training is conducted for key departments dealing with sensitive data types.

companyName: QXO BUILDING PRODUCTS, INC.


text: The Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.

companyName: Wingstop Inc.

ticker: WING


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, and along with the emerging use of artificial intelligence ("AI"), could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.

companyName: Ladder Capital Corp

ticker: LADR


text: JFG's CISO has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across JFG's global businesses. He has over twenty years' experience managing cybersecurity in the financial and consulting services industries.

companyName: Senior Credit Investments, LLC


text: We utilize a commercially available third-party hosted cloud network environment with commercially available systems, software, tools and monitoring to provide security to protect its information and data and alert it to potential information security breaches. The third party engaged by us to oversee and host its network was engaged, in part, because of its experience with information security and data protection and products designed to manage against information and data security breaches. We conduct mandatory annual cybersecurity training for employees and have information security and data privacy policies and procedures in place applicable to our directors, officers, and employees.

companyName: GETTY REALTY CORP /MD/

ticker: GTY


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies and contract research organizations. We manage cybersecurity risks associated with our use of these providers using several approaches, as deemed necessary, including security questionnaires, review of compliance reports, audits and the imposition of information security contractual obligations on vendors.

companyName: Repare Therapeutics Inc.


text: As a heavily regulated financial services company, the Company has developed a comprehensive cybersecurity process that is designed to protect the security of confidential information. Two of the more significant risks to the Company, both in terms of financial and reputational harm, are a data security breach and/or ransomware attack which cause a material financial loss to the Company and/or materially harms its operational integrity or reputation with its customers as a safe and trustworthy institution. In order to mitigate this risk and comply with the regulatory standards required by the Company's and the Bank's regulators, the Company has developed a cybersecurity program and framework which is administered by a team of experienced professionals and supported by external technology and consulting services. Set forth below is an overview of the Company's cybersecurity process, the role of management and the Board, and whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU