text: Monitoring and Incident Reporting We continuously monitor our enterprise information systems and user activity to detect anomalous activity and identify potential security related incidents. Our cybersecurity monitoring and incident reporting program is informed by NIST guidelines and is internally and externally monitored. When a potential cybersecurity incident is detected, we gather the necessary information to classify the incident by type and severity and activate containment plans and response teams depending on the nature of the incident. Cybersecurity incidents that may impact enterprise business operations, compromise critical systems or result in unauthorized access to critical data will be escalated to the CISO and an internal incident response team comprised of senior IT, business operations and compliance personnel to coordinate any internal and external responses. The CISO and the internal incident team will also elevate any material cybersecurity incidents or unauthorized occurrences that jeopardize the confidentiality, integrity or availability of enterprise information to senior management and the board of directors.

companyName: PennyMac Financial Services, Inc.

ticker: PFSI


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms, and forensic investigators.

companyName: Xometry, Inc.

ticker: XMTR

secItem: Item 1C


text: A third-party monitored network-based intrusion detection and incident response program has been contracted. This system draws logs from systems and firewalls, and is driven by classification and risk-based threat analysis of network traffic. This system automatically analyzes network traffic against a world-wide threat exchange to increase the awareness of newly introduced threats and vulnerabilities.

companyName: Prime Meridian Holding Co

ticker: PMHG


text: As a regulated energy infrastructure company, for decades we have used an incident command system (ICS) as a standardized approach to the command, control and coordination of a variety of emergency situations. In the event of emergencies, including cybersecurity events, we stand up an Incident Command Team to respond to the emergency. We exercise and train the ICT for a variety of emergencies, including, cyber events on a regular basis.

companyName: Northwest Natural Holding Co

ticker: NWN


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor captioned "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions; litigation; fines and penalties; interruptions to our commercial operations, clinical trials or other operations; harm to our reputation; loss of revenue or profits; loss of sales and other adverse consequences."

companyName: Cyclerion Therapeutics, Inc.

ticker: CYCN


text: Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While Rumble On maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: RideNow Group, Inc.

ticker: RDNW


text: The Company recognizes the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard its information systems and protect the confidentiality, integrity, and availability of its data. The Company's information security program is managed by its Vice President, Technology, whose team is responsible for leading Company-wide cybersecurity strategy, policy, standards, architecture, and processes.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: In addition, our Board receives regular presentations from management about cyber risks and controls and has received formal cyber risk training from external advisors. Our Chairman of the Board, Mr. M. Kevin McEvoy, and Ms. Reema Poddar, member of the Board, have each earned a National Association of Corporate Directors ("NACD") Cybersecurity Oversight certification and a Computer Early Response Team ("CERT") Cybersecurity Oversight Certification from Software Engineering Institute, and our Board is composed of directors with diverse qualifications, skills and expertise, including risk management, technology and finance, that we believe equip them to oversee cybersecurity risks effectively.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: With oversight from our audit committee and our board of directors, our management team including our Chief Executive Officer ("CEO"), Chief Financial Officer ("CFO") and Chief Operating Officer and General Counsel ("COO/GC"), is responsible for managing all cybersecurity risks and overseeing our security programs. Our information technology team is comprised of our CAO and other knowledgeable employees, and is responsible for management of our cybersecurity programs. Our information technology team consists of individuals with experience in assessing and addressing cybersecurity risk and is responsible for executing our cybersecurity programs as well as communicating regularly with senior management. Our CEO, CFO and COO/GC have familiarity and oversight experience, appropriate for their positions, regarding general cybersecurity matters and threats affecting business-to-business software and cloud services vendors. In addition, our cybersecurity program includes engagement of other Company management and employees and outside service providers to oversee or perform specific roles in connection with cybersecurity risk assessment and management, and incident management.

companyName: MODIV INDUSTRIAL, INC.

ticker: MDV


text: Our cybersecurity coordinator is responsible for assessing and managing our material risks from cybersecurity threats, in close collaboration with our IT team and reports to our CEO.

companyName: Rocky Mountains Group Ltd


text: Our IT security department maintains a playbook to respond to potential cybersecurity threats. We conduct tabletop exercises for tactical response readiness, perform regular security scans of our environment both from an external and internal perspective, as well as work with a qualified third-party vendor to perform penetration tests of our environment. Any identified risks are included in our overall risk management program, and internal and external auditors validate our IT controls on a regular basis.

companyName: FASTENAL CO

ticker: FAST


text: Our Head of Information Technology, reporting to our Chief Financial Officer, has day-to-day responsibility for preventing, detecting, mitigating and remediating cybersecurity risks. The individual currently serving in this role has over twenty years of experience in information technology and cybersecurity. Our Head of Information Technology leads an incident response team that includes members of executive management, including members of our legal team, and is charged with assessing and managing material cybersecurity risks, and with notifying our executive management committee and disclosure committee of potential material cybersecurity incidents. Executive management provides updates on our cybersecurity risk profile to our Audit Committee on at least a quarterly basis.

companyName: IO Biotech, Inc.

ticker: IOBT


text: Despite these measures, we may not be successful in preventing, mitigating or recovering from a cybersecurity incident, which could have a material adverse effect on our operations or financial results or reputation. While we maintain cybersecurity insurance, it may not be adequate to cover the costs related to cybersecurity incidents we experience. For a description of the primary risks from cybersecurity threats that may materially affect our business and how they may do so, see Part I, Item 1A. Risk Factors in this Annual Report on Form 10-K, including "— Our networks and those of our third-party service providers may be vulnerable to cybersecurity risks."

companyName: Iridium Communications Inc.

ticker: IRDM


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to an event compromising information and systems security, working closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.

companyName: Century Communities, Inc.

ticker: CCS


text: Role of the Board of Directors The Board has delegated responsibility for overseeing the Company's cybersecurity and information technology processes to the Audit Committee. The Audit Committee is responsible for overseeing the implementation and effectiveness of the Company's processes and risk management protocols regarding cybersecurity and information technology, including risks from cybersecurity incidents and vulnerabilities and third-party service providers, and the steps taken by Mr. Tipler and the IT security department to inform themselves about and monitor the prevention, detection, mitigation, and remediation of such risks. Mr. Tipler reports to the Audit Committee regarding material cybersecurity incidents and any remediation efforts and is also responsible for providing quarterly updates regarding the overall effectiveness of the Company's cybersecurity program.

companyName: ENVIRI Corp

ticker: NVRI


text: To assess, identify, and manage potential cybersecurity threats, our Security Operations Center ("SOC") team works in conjunction with a third-party managed security service provider to monitor systems and threats, including those on systems managed by third-parties, such as cloud platforms.

companyName: Keenova Therapeutics plc


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, consolidated financial position, or results of operations. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, consolidated financial position, or results of operations. See "Risk Factors – Risks Related to Our Business."

companyName: Summit Hotel Properties, Inc.

ticker: INN


text: The Bank's Board devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. The Bank's Board oversees the Bank's information security program through setting of policies and principles including the Bank's Information Security Policy and Enterprise Risk Management program. The Board oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.

companyName: Federal Home Loan Bank of New York


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect our business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Annual Report, including the discussion under the heading "Cyberattacks impacting our networks or systems may have a material effect on our operations."

companyName: AST SpaceMobile, Inc.

ticker: ASTS


text: We believe that there will be additional costs associated with these activities but that the disruption to our operations and the costs associated with our cybersecurity experts will largely be covered by adequate insurance. However, there can be no assurance that our insurance carriers will accept liability under these policies, in which event, we would be compelled to pay the expenses of our cyber experts directly, which would increase our costs and have a material adverse effect on our future financial performance.

companyName: JEWETT CAMERON TRADING CO LTD

ticker: JCTC


text: The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls. The CISO is a Certified Information Systems Security Professional (CISSP). The CISO has a Bachelor's degree in Criminal Justice with a minor in Computer Science. The CISO is supported by several managers including the following: • Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience. • Manager of Security Architecture - CISSP with over 20 years experience in Information Technology networking, network security and security engineering.

companyName: FNB CORP/PA/

ticker: FNB


text: The Company maintains specific policies and practices governing our third-party security risks, including our third-party assessment ("TPA") process. Under our TPA process, we gather information from certain third parties who contract with the Company and share or receive data, or have access to or integrate with our systems, in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, utilize encrypted secure file transfer protocols to exchange data. We require counterparties to enter into Business Associate Agreements and Non-Disclosure Agreements that, among other things, require them to maintain security controls to protect our confidential information and data, and notify us of material data breaches that may impact our data.

companyName: MSP Recovery, Inc.

ticker: MSPR


text: We regularly engage third-party experts to conduct information security testing, including penetration testing, on our systems and infrastructure. The Program undergoes periodic external assessments aligned with the National Institute of Standards and Technology Cybersecurity Framework and the Payment Card Industry Data Security Standard. This alignment helps us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Outdoor Holding Co

ticker: POWW


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats and other developments in our cybersecurity management protocols.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: The information security program is designed to protect the confidentiality, integrity, and availability of the Company's information systems and data, and safeguard information systems and data in accordance with applicable local, state, federal or international laws, regulations, or standards.

companyName: Graham Holdings Co

ticker: GHC


text: Helix's IT department holds regular quarterly meetings with the CFO, CAO, and Vice President of Internal Audit to recap cybersecurity risks and incidents and to determine any actions required as a result.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Our Board and management recognize the critical importance of maintaining the trust and confidence of our customers, clients, business pa rtners general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: DUKE Robotics Corp.

ticker: DUKR


text: To more effectively prevent, detect and respond to information security threats, the Company maintains a cybersecurity program, which is supervised by the CIO whose team, including the CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Additionally, the CIO chairs the Information Security Management Committee, which is made up of senior leaders from our Information Security, Compliance, Engineering, Technical Operations, Incident Management, Corporate IT, and Human Resources teams. This committee meets quarterly and drives awareness, ownership and alignment across broad governance and risk stakeholder groups for effective cybersecurity risk management and reporting.

companyName: INTEGRAL AD SCIENCE HOLDING CORP.


text: reports and learnings from any cybersecurity events; and addition to our scheduled meetings, the Audit Committee, CISO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of SideChannel, Inc. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.

companyName: SideChannel, Inc.

ticker: SDCH


text: As part of our overall risk management system, we conduct annual security awareness training for personnel at all levels and functions, issue periodic simulated social engineering tests, and have established protocols to escalate cybersecurity incidents from identification through remediation. These activities are undertaken in collaboration with human resources, IT, and management.

companyName: Denali Therapeutics Inc.

ticker: DNLI


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: Risks from Cybersecurity Threats We have not encountered any cybersecurity incidents, directly or indirectly, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

companyName: Rhinebeck Bancorp, Inc.

ticker: RBKB


text: The Company's business and proprietary information, information technology and operational technology assets are important to its success. The Company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by seeking to mitigate and manage risks while helping to ensure business resilience. The program is applied across all levels of the Company.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: Understanding the potential risks associated with third-party service providers, we shall implement stringent processes to oversee and manage these concerns. We shall conduct thorough security assessments before engaging with any third-party provider and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This involves quarterly assessments by our management and continuous evaluations by our security engineers. This approach is designed to mitigate the risks of data breaches or other security incidents originating from third-party sources. We have not encountered cybersecurity issues that have significantly impacted our operational performance or financial status.

companyName: SEATech Ventures Corp.

ticker: SEAV


text: tasked with the role of evaluating new software tools and technologies before their implementation. The TRC consists of experts from various domains within our organization, including information technology security, compliance, legal, and operations. This TRC conducts assessments to ensure that any new software tools meet our standards for security, compliance and operational efficiency.

companyName: Purple Innovation, Inc.

ticker: PRPL


text: The IT Compliance Committee members rely on the cybersecurity experience of our CISO and DPO, which includes more than 20 years of directing privacy policies at public companies that provide web portal and instant messenger services, and managing cybersecurity and privacy policies at a game developer company. All IT Compliance Committee members have robust experience in their respective fields as well as a general familiarity with cybersecurity matters and an understanding of the potential financial impacts, disclosure obligations, and enterprise risks to the Company as they relate to cybersecurity.

companyName: WEBTOON Entertainment Inc.

ticker: WBTN


text: We also have management level committees, along with Infosec, who support our processes to assess and manage cybersecurity risk as follows: • The ERM Steering Committee, composed of members from senior leadership, including our CISO, regularly assesses and prioritizes enterprise risks and oversees appropriate mitigation plans. • The Technology Risk Steering Subcommittee, composed of members of senior leadership, which includes our Chief Talent and Operating Officer, Chief Information Officer, General Counsel and Chief Compliance Officer, Chief Technology Officer, and Chief Information Security Officer, discusses technology risks, cyber risks, data protection risks and opportunities to enable safe, effective, and efficient execution of business objectives.

companyName: Thoughtworks Holding, Inc.


text: The Company's Security Risk Council, including the Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the Company's Security Risk Council evaluates its significance and briefs the Board on the event.

companyName: PACCAR INC

ticker: PCAR


text: The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company's cybersecurity program. The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls, from the CIO on a quarterly basis, and more frequently when necessary. These reports include updates on the activities of the Executive IT Council. Changes to the Company's information security policies and programs are approved by the Audit and Risk Committee. This information is reported to the full Board of Directors which, together with the Audit and Risk Committee, evaluates and considers the effectiveness of the Company's risk management policies and controls relating to cybersecurity that are described in the section above.

companyName: CASS INFORMATION SYSTEMS INC

ticker: CASS


text: The Company engages third party vendors in connection with our cybersecurity processes, including penetration and vulnerability scanning, auditing of our information security management program (ISMP); and a provider of products and services to secure users, networks, and endpoints against ransomware, malware, exploits, phishing and the wide range of other cyberattacks. In addition, the Company engaged national accounting and advisory services firms to audit the operating effectiveness of our security program, which incorporates cybersecurity in our processes. On an annual basis, the Company conducts a SOC 2 Type II audit and a HITRUST assessment.

companyName: MSP Recovery, Inc.


text: The CISO has served in various roles in information technology and information security for over 30 years, including previously serving as the Deputy Chief Information Security Officer of a large European banking group. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP). The CIO holds undergraduate and masters degrees in computer science and has served in various roles in information technology for over 25 years. The Company's CRO holds an undergraduate degree and has over 25 years of experience managing risks, including risks arising from cybersecurity threats.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk and governance. We also maintain a cross-functional management Security Steering Committee ("SSC"), with members consisting of executive leadership, internal audit, and enterprise risk. The SSC meets quarterly and has a formal charter outlining its responsibility to provide oversite of our comprehensive cybersecurity program. The Audit Committee of the Board of Directors is briefed quarterly by the Chief Information Officer ("CIO") on the cybersecurity program, and both the Audit Committee and SSC are notified between such updates regarding significant new cybersecurity threats or incidents. The full Board of Directors also receives regular reports from the Audit Committee.

companyName: Primoris Services Corp

ticker: PRIM


text: Our membership on the Data Privacy Board, a group comprised of some of the world's largest companies with a mission to help members engage in confidential, leader-level discussion, presents opportunities using unbiased benchmarking and support from peers in various industries. We continue to build privacy resilience across international operating environments.

companyName: VALMONT INDUSTRIES INC

ticker: VMI


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company is not aware of a basis to believe that such risks are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition. For additional information, see Item 1A. Risk Factors—Our internal and customer-facing systems, and systems of third parties we rely upon, may be subject to cybersecurity breaches, disruptions, or delays.

companyName: TRIMBLE INC.

ticker: TRMB


text: The Company has engage d a third-party managed detection and response company to monitor the security of its information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur. The Company also maintains a cybersecurity insurance policy and has engaged a third-party digital forensics and incident response consultant and legal counsel on retainer.

companyName: Builders FirstSource, Inc.

ticker: BLDR


text: Cyber security risk is an area of increasing focus for our Board, particularly as an increasingly significant part of our operations rely on digital technologies. As a result, we have implemented a cyber security program to assess, identify, and manage risks from cyber security threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. This program has been integrated into the Company's overall risk management process.

companyName: SOLAREDGE TECHNOLOGIES, INC.

ticker: SEDG


text: The Company's Board of Directors monitors the Program including policies and practices. The Company's Compliance Committee and Information Security Committee along with the company's Board of Directors oversee areas of operational risk such as information technology activities; risks associated with development, infrastructure, and cybersecurity; oversight of information security risk assessments, strategies, policies, and programs; and disaster recovery, business continuity, and incident response process. The ISO also provides periodic cybersecurity updates to the Board of Directors.

companyName: Texas Community Bancshares, Inc.

ticker: TCBS


text: Our Board of Directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee of our Board is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.

companyName: GERON CORP

ticker: GERN


text: As a result, we have implemented a multi-layered cybersecurity program that includes measures to protect our information systems, including firewalls, network access controls, intrusion detection systems, phishing campaigns, security awareness training and monitoring, network operation center, security operation center, and data encryption, and to monitor our information systems to detect potential cybersecurity incidents, including through the use of automated detection software. Through these processes and the other processes described above, including our incident response plan, our management is informed about cybersecurity threats and incidents affecting us.

companyName: ESTABLISHMENT LABS HOLDINGS INC.

ticker: ESTA


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors. We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See "Item 1A - Risk Factors" in this Annual Report for a further discussion of specific risks related to cybersecurity threats.

companyName: MERCURY SYSTEMS INC

ticker: MRCY


text: We assess, identify, and manage material risks from cybersecurity threats through our cybersecurity risk management program. This program includes cybersecurity policies, standards, and procedures, a cybersecurity incident response plan, regular risk assessments, including as part of our annual enterprise risk management ("ERM") assessment, testing of the Company's internal infrastructure to identify vulnerabilities, cybersecurity insurance, procedures for recovering from disruptions to our operations, workforce cybersecurity trainings, and third-party assessments and programs. We maintain a cybersecurity incident response plan to help enable timely, consistent responses to actual or attempted cybersecurity incidents impacting the Company. This plan provides guidance to address the overall coordination of our response to a cybersecurity crisis and plan for resources, actions, and decisions we may need to be prepared for; a communication plan for timely and accurate dissemination of evolving information to stakeholders during the crisis; and business continuity plans that document strategies and measures to enable core business activities to continue during a cybersecurity event. To support our cybersecurity incident response plan, we conduct exercises simulating cybersecurity incidents to educate and train our management on response capabilities and inform adjustments to our controls and response. We have engaged third-party cybersecurity firms to advise on these exercises. The status and ongoing enhancement of our cybersecurity risk management program is reported to senior management, as well as the Audit Committee of our Board, on a quarterly basis, or more frequently as warranted.

companyName: Lamb Weston Holdings, Inc.

ticker: LW


text: The Company and our Board place a high priority on maintaining security over our financial information that can be accessed via the Internet and mitigating information security risks. The Company engages a third -party security firm to provide threat detection and reports, conduct annual testing of our systems, train our employees and generally advise on cybersecurity processes. At least annually, our information technology team makes a formal presentation to our Audit Committee and the Board to keep them apprised of the level of cybersecurity that exists to protect our financial information, training of the Company's officers and employees, and the latest threats that have emerged, including a presentation from the third -party security firm.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: We have implemented several cybersecurity processes and controls to aid in our efforts to assess, identify, and manage material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We have engaged a third-party cybersecurity firm who serves as our dedicated information technology (IT) and cybersecurity team and helps us oversee, implement and manage these processes and controls.

companyName: CareTrust REIT, Inc.

ticker: CTRE


text: Information Security: We implement organizational, administrative and technical measures based on commercially reasonable procedures using (i) industry standard information security measures prescribed for use by National Institute of Standards and Technology, (ii) security measures aligned with the ISO/IEC 27000 series of standards, (iii) the Sarbanes-Oxley Act and SSAE 18/ISAE 3402, (iv) privacy regulations such as the European Union's General Data Protection Regulation and the California Consumer Privacy Act, (v) business continuity management measures aligned with the ISO/IEC 22301 standard and (vi) other generally recognized industry standards, in each case, designed to safeguard the confidentiality, integrity, and availability of our infrastructure and data and the resiliency of our operations.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Third Party Service Providers. We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures, and process execution including incident detection, investigation, analysis and response, eradication, and recovery.

companyName: RTX Corp

ticker: RTX


text: Our risk management team collaborates with our Chief Information Security Officer ("CISO") and our Head of Legal to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards and have adopted policies and procedures around internal and external notification of cybersecurity incidents.

companyName: iTeos Therapeutics, Inc.


text: Our cybersecurity risk assessment and reporting process leverages the National Institute of Standards and Technology's Cybersecurity Framework and is managed by our CISO, whose team comprises both internal personnel and third-party cybersecurity consultants. The CISO provides periodic reports to management, including our CEO, as well as other executive leadership members, and to the Audit and Finance Committee of our Board, which has oversight for cybersecurity risk management. These reports include updates on critical cybersecurity risks and the threat landscape; updates on the status of ongoing cybersecurity improvement initiatives, the internal control environment, and ongoing internal audit activities; and, if relevant, the status of actions taken with respect to certain cybersecurity incidents identified during the period.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: We regularly update our enterprise-wide Information Security Program to align with industry best practices and applicable regulations. Envestnet's Information Security Program includes a policy framework that leverages elements from National Institute of Standards and Technology Cybersecurity Frameworks, NIST 800-53 Standards, ISO 27001, Cloud Security Alliance, and other relevant industry best practices to protect the confidentiality, availability, and integrity of our data and systems.

companyName: ENVESTNET, INC.


text: Notwithstanding our efforts at cybersecurity, the Company cannot guarantee that it will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on it. To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. With regard to the possible impact of future cybersecurity threats or incidents, see Item 1A, Risk Factors – Risks Related to Our Business.

companyName: SHORE BANCSHARES INC

ticker: SHBI


text: As with all large IT systems, we have been a target of cyberattackers and other hacking activities, as have certain of our third-party service providers. While our cybersecurity program is designed to prevent unauthorized access and protect sensitive information, including through continuous improvement of our cybersecurity measures, and we have not experienced any material cyber threats or incidents to date, we can give no assurance that we will be able to prevent, identify, respond to, or mitigate the impact of all cyber threats or incidents. To the extent future cyber threats or incidents result in significant disruptions and costs to our operations, reduce the effectiveness of our internal control over financial reporting, or otherwise substantially impact our business, it could have a material adverse effect on our business, liquidity, financial condition, and/or results of operations. For additional discussion on our cybersecurity risks, refer to Item 1A. "Risk Factors" of this Form 10-K.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: As part of our cybersecurity risk management program, we have planned "tabletop" exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive leaders. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises for all employees monthly and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents.

companyName: Spirit AeroSystems Holdings, Inc.


text: Enterprise risk management is the responsibility of our executive management team consisting of our chief executive officer, chief financial officer, chief legal officer and our vice presidents of operations, business development and environmental, health and safety. Our executive management team meets on a weekly basis and discusses cybersecurity on an ad hoc basis when it is relevant. Our director of Information Technology, who reports directly to our chief executive officer, and our director of Internal Audit are primarily responsible for management of cybersecurity risk. Our director of Information Technology is an active ISC2 accredited member with 15 years of information technology experience, namely in developing solutions focused on private and hybrid cloud computing systems for small scale organizations. In accordance with our overall enterprise risk management process, our executive management team supervises our director of Information Technology to assess, identify, report and manage material risks from cybersecurity threats and relies on our director of Internal Audit to assess, identify and report those risks. As part of this process, we rely significantly on third-party providers to assist us with our cybersecurity risk management and strategy. These providers supply ongoing services including consulting services, access to a virtual CISO, threat monitoring and detection, threat response and mitigation strategies, updates on emerging trends and developments with policy and procedure guidance. Other service providers offer targeted assistance such as security and forensic expertise on an as needed basis. We also maintain cybersecurity insurance.

companyName: Montauk Renewables, Inc.

ticker: MNTK


text: The ciso is informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity program described above, including through reports prepared by our internal cybersecurity team and the operation of our incident response plan. The ciso meets regularly with leaders of our various information technology management teams and with the Risk Management Committee (a cross-functional management-level committee, which is co-managed by our cfo and chief legal officer and meets at least quarterly), to review and discuss our cybersecurity and other information technology risks and opportunities.

companyName: STARBUCKS CORP

ticker: SBUX


text: We use various tools and methodologies, including third-party services, to assess, identify, and manage cybersecurity threats. For example, we utilize third-party services to monitor the security and integrity of our information systems and the other third-party information systems upon which we rely on an ongoing basis. We also engage a third-party cybersecurity auditor for periodic penetration and vulnerability testing and assessment of our processes. Our information technology department oversees cybersecurity risk management and reports significant incidents to management. We consult with our advisors as appropriate, including on materiality analysis and disclosure matters, and management makes the final materiality determinations and disclosure and other compliance decisions.

companyName: Solid Power, Inc.

ticker: SLDP


text: No cybersecurity incidents were identified this year. One threat was identified: insecurely stored credentials. This was responded to by implementing an encrypted password manager Company-wide. We will continue to monitor for threats to avoid risks to Company or individuals' data, interruptions to business operations, or financial losses. Information about risks or any identified cybersecurity threats are reported by the Director of Technology to the President.

companyName: PCS Edventures!, Inc.

ticker: PCSV


text: Impact of Risks from Cybersecurity Threats The energy industry increasingly depends on information and operational technology to sustain critical functions. However, the rise in cybersecurity incidents, whether caused by deliberate attacks or accidental events, poses substantial challenges. As these threats grow in complexity and scale, the industry's efforts to prevent, detect, mitigate, and remediate such incidents become progressively more demanding and complex.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining and regularly updating a defined and practiced incident response plan ("IRP"); • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Executing scheduled, recurring server and infrastructure patching processes; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; and • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate.

companyName: BKV Corp

ticker: BKV


text: In addition, the CFO provides updates to the full Board upon request, and timely updates regarding unique developments such as regulatory updates or vulnerability developments, based on details provided by the DIT and DIS.

companyName: EAGLE MATERIALS INC

ticker: EXP


text: Through established governance structures, including our problem and incident management process and cyber incident response plan, we have processes and procedures to help facilitate appropriate and effective oversight of cybersecurity risk. These processes and procedures enable our three lines of defense and management to review and manage cybersecurity risks, monitor threats, and provide for further escalation to executive management, our management-level Disclosure Committee, our board-level Risk Committee, or to the full Board, as appropriate.

companyName: Atlantic Union Bankshares Corp

ticker: AUB


text: Board Oversight of Cybersecurity Risks The Audit Committee provides strategic oversight of risk assessment and risk management matters, including risks associated with cybersecurity threats. Certain of our members update the Audit Committee as well as our full Board, as appropriate, on cybersecurity matters, primarily through presentations by our CCO and the Adviser's CISO. Such reporting includes updates on the cybersecurity program applicable to us, the external threat environment, and the Adviser's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on our preparedness, prevention, detection, responsiveness, and recovery with respect to cyber incidents.

companyName: HPS Corporate Lending Fund


text: Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following periodic exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • suspicious repeated login failures; • suspicious network traffic; • malware detection; and • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our Manager's team, including its Head of IT, Head of Risk Management and Chief Legal Officer, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.

companyName: Star Holdings

ticker: STHO


text: the implementation of a comprehensive cybersecurity policy that encompasses but is not limited to social media, acceptable use (devices, wireless, remote access, internet use), information governance, monitoring, authentication, encryption, vulnerability management, third-party management, and recovery; required annual cybersecurity training for all employees with additional supplemental cybersecurity training required based on role; random employee phish testing and follow-up; procedural and automated cyber controls in conjunction with robust detection, mitigation, and recovery capabilities; the formation of a multidisciplinary cybersecurity incident response team; the integration of multiple threat intelligence sources into our cybersecurity tools and processes; the retention of external cybersecurity threat response resources;

companyName: Healthcare Triangle, Inc.

ticker: HCTI


text: The Audit Committee receives periodic reports from management on potential cybersecurity risks and threats and receives presentations on cybersecurity topics from the Company's Information Systems Manager. The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the cybersecurity risk management program as needed.

companyName: Digital Brands Group, Inc.

ticker: DBGI


text: Our CISO holds a degree in information systems design and analysis and advanced degrees in telecommunications and information technology management. He has over 24 years of experience leading Information Security teams and over a decade as a senior leader within Information Security.

companyName: Federal Home Loan Bank of Indianapolis


text: We repeatedly test our software, during the development cycle and once out in the field, including internal assessments of our flagship solutions. We work closely with Tyler's Data Privacy Officer and her team to educate Tyler team members on complementary privacy-by-design principles. We continuously iterate on access management policies for both technological and physical resources.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Enterprise Cybersecurity The Company's Enterprise Cybersecurity team, led by the Chief Information Officer ("CIO"), is responsible for identifying, assessing the severity of, managing and remediating cybersecurity risks to the Company's information technology infrastructure. Risks are identified through vulnerability hunting, infrastructure penetration testing, threat intelligence activities and other processes defined by the infrastructure Governance, Risk and Compliance ("GRC") assessment program utilized by the Company. Furthermore, this team seeks to reduce cybersecurity risks through a number of activities, including annual cybersecurity training for the majority of the Company's employees, phishing tests, compliance assessments, vulnerability and noncompliance remediation and the implementation and maintenance of new cybersecurity technology.

companyName: Aptiv PLC

ticker: APTV


text: Overseeing Third-Party Risk Because we are aware of the risks associated with third-party service providers, we implement processes to oversee and manage these risks. We conduct thorough security assessments of all third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The monitoring includes regular assessments by our Chief Experience Officer. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties.

companyName: Strive, Inc.

ticker: ASST


text: Another component of DTE Energy's cybersecurity team is the Cybersecurity Defense Center (CSDC), which has the primary responsibility for monitoring and responding to cybersecurity incidents. The CSDC maintains an incident response plan designed to protect against, detect, evaluate, and respond to and recover from a cyber incident. The CSDC may receive incident reports from DTE Energy employees, corporate security, or external sources. The incident response plan is intended to be flexible so it may be adapted to an array of potential scenarios. Depending on the incident, the CSDC may decide to engage external resources for assistance with responding to the incident. DTE Energy regularly conducts exercises to help ensure the plan's effectiveness and overall preparedness.

companyName: DTE Electric Co


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: Our Vice President of Information Technology has more than 35 years working as an IT professional, 13 years of which has been at the Company in various roles such as, Programming, Business Analysis, Systems Analysis, Operations, EDI Manager, and Applications Director.

companyName: ROCKY BRANDS, INC.

ticker: RCKY


text: Cybersecurity risks are a part of Xcel Energy's normal course of business. To date, no cybersecurity incident or attack has had a material impact on our business or results of operations. As of Feb. 21, 2024 there have been no material cybersecurity incidents to report.

companyName: XCEL ENERGY INC

ticker: XEL


text: Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. We identify nation state-sponsored threat actors and the rise in sophistication and proliferation of ransomware campaigns as top reasonable material risks to the business. The theft, unauthorized use or publication of our intellectual property and/or confidential business or personal information (whether through a breach of our own systems or the breach of a system of a third party that provides services to us) could harm our competitive or negotiating positions, reduce the value of our investment in research and development and other strategic initiatives, compromise our patent enforcement strategies or outlook, damage our reputation or otherwise adversely affect our business. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.

companyName: InterDigital, Inc.

ticker: IDCC


text: Board oversees our enterprise risk management processes, which includes cybersecurity risk, directly and through its audit committee. The audit committee of the Board assesses with management the Company's major risk exposures and the steps management has taken to monitor and control such exposures. The audit committee reviews management's risk assessment and risk management programs and reports on such matters to the full Board.

companyName: Stereotaxis, Inc.

ticker: STXS


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third-party vendors' information systems. For more information, please see the section entitled "Risk Factors"

companyName: Amesite Inc.

ticker: AMST


text: We believe that cyber safety is everyone's responsibility at Oncor. We take proactive steps to train, re-train, educate and test our workforce on cyber safety practices and work to strengthen the cyber community within our company. We require an annual cybersecurity training of all credentialled individuals and in October 2023 we held our 2nd annual cyber awareness month, which included informational events, speakers and additional training resources to increase our workforce's engagement in cyber safety.

companyName: ONCOR ELECTRIC DELIVERY CO LLC


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of the Company's information security program, including risks of cybersecurity threats. The Risk Oversight Committee and Audit Committee, which support the Board of Directors in the oversight of the Company's information security program are focused on risks from cybersecurity threats, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations. The Risk Oversight Committee members have varied expertise and experience including risk management, technology and finance, equipping them to oversee cybersecurity risks effectively. The Risk Oversight Committee has delegated day-to-day oversight of our information security program to our executive officers, including the Vice President of Information Technology ("VP of IT") along with our Global Cybersecurity Director ("Director"). Our VP of IT is a 24-year information technology industry veteran having served in key information technology roles at a Fortune 500 company with over 15 years of direct influence over cybersecurity roadmaps and operations. The Director is a 30-year veteran of the information technology industry having served in the military and with a Fortune 500 company with over 20 years of cybersecurity experience including leading incident responses, policy development, and building security architectures. The VP of IT and the Director regularly meet with our President and Chief Financial Officer to inform them of matters related to cybersecurity risks and incidents. These meetings are designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant known cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that the Board of Directors has oversight and can provide guidance on critical cybersecurity issues. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Our board of directors provides oversight of cybersecurity risks and has delegated primary responsibility to the audit committee, which is responsible for overseeing our enterprise risk assessments and management policies, procedures, and practices (including regarding those risks related to information security, cybersecurity, and data protection).

companyName: lululemon athletica inc.

ticker: LULU


text: Our CTO has served in this role since 2023 and has over 25 years of experience in the technology industry. Prior to his current role, he served as the CTO of Tyson Foods and before arriving at Tyson, he was the Chief Information Officer at Hewlett Packard, and then CIO at Hewlett Packard Enterprise.

companyName: LENNAR CORP /NEW/

ticker: LEN


text: In response to the growing risks associated with third-party service providers, we have established review processes for assessing the technological and information security controls of our third-party suppliers to attempt to identify material cybersecurity risks associated with such providers, their IT systems, and their access to our IT systems that could significantly disrupt our operations. These processes encompass a range of measures, such as pre-engagement cybersecurity due diligence for providers who access our IT systems or information before their engagement, ongoing monitoring and evaluation of our providers, detailed examination of available System and Organization Controls attestation reports, and inclusion of relevant contractual provisions in our agreements with third-party service providers with respect to areas including cyber protections, notifications, auditing, and risk allocation.

companyName: CONSTELLATION BRANDS, INC.

ticker: STZ


text: Our Senior Director of Information Security is responsible for identifying, assessing, and managing risks from cybersecurity threats. The Senior Director of Information Security manages our cybersecurity program and receives information regarding cybersecurity incidents and threats from our information security management team, through internal cyber risk management processes. The Senior Director of Information Security reports to the Chief Technology and Innovation Officer (CTIO) and provides frequent and up to date reporting on cyber risk to our ERM Committee, a cross functional executive-level steering group, which includes the CTIO and has a wealth of experience in enterprise risk. The ERM Committee meets on a quarterly basis or as necessary to assess and respond to enterprise risks, including cybersecurity, and reports updates to the Board.

companyName: LITHIA MOTORS INC

ticker: LAD


text: Run tabletop exercises with our executive team to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; Conduct regular third-party assessments of our cybersecurity program; Undertake regular reviews of our incident response plan and other policies related to cybersecurity; Run regular cyber penetration testing;

companyName: SENSIENT TECHNOLOGIES CORP

ticker: SXT


text: In addition, the Operations and Nuclear Oversight Committee (ONOC) of the Board of Directors provides oversight of the nuclear safety and cybersecurity of Duke Energy's nuclear power program, which is integrated with the companywide cyber protocols, and the Chair of the ONOC reports out to the Board of Directors on such oversight activities. Duke Energy's nuclear cybersecurity program and associated cybersecurity plan (CSP) were fully implemented in 2017 in accordance with NRC regulation 10 CFR 73.54, "Protection of digital computer and communication systems and networks" and leverage monitoring, testing, drills, audits, assessments, and NRC inspections to continue to validate the effectiveness of the program to protect plant assets from cybersecurity threats.

companyName: PROGRESS ENERGY INC


text: We also conduct tabletop exercises to simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Cybersecurity Tools Our digital risk and security program deploys technical safeguards designed to help protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.

companyName: Premier, Inc.


text: We maintain incident response plans and playbooks that allow for cybersecurity incident response, management and recovery in the event of an incident. These plans are tested on an annual basis.

companyName: FIVE BELOW, INC

ticker: FIVE


text: Key elements of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team of IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; and • cybersecurity awareness training of all our employees.

companyName: TXO Partners, L.P.

ticker: TXO


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including our CFO, leveraging the expertise of our Senior Director, Information Technology and third party service provider. Our CFO has three years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures. Our Senior Director, Information Technology has approximately 20 years of oversight responsibilities for cybersecurity elements and has been involved in the oversight of the implementation of the Company's current cybersecurity measures.

companyName: Alto Neuroscience, Inc.

ticker: ANRO


text: Recovery and restoration from a cybersecurity incident can vary depending on type of attack and materiality of assets and information affected.

companyName: CNL Healthcare Properties, Inc.

ticker: CHTH


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats which include, among other things, operational risks, intellectual property theft, fraud or extortion, harm to employees or customers, violation of privacy or security laws and related litigation and legal risk, and reputational risks.

companyName: VOLITIONRX LTD

ticker: VNRX


text: Our Board, in coordination with the Security Committee, oversees our management of cybersecurity risk. They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Security Committee directly oversees our cybersecurity program. The Board receives periodic updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.

companyName: authID Inc.

ticker: AUID


text: We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and manufacturing-related information ("Information Systems and Data").

companyName: Enovix Corp

ticker: ENVX


text: We maintain various protections designed to safeguard against cyber attacks, including access controls, firewalls and virus detection software. We have established and test our disaster recovery plan and we protect against business interruption by backing up our major systems. We periodically scan our environment for any vulnerabilities and engage third parties to perform annual penetration testing and assess effectiveness of our information security practices. In addition, we maintain insurance that currently includes cybersecurity coverage.

companyName: AvidXchange Holdings, Inc.

ticker: AVDX


text: We have a Chief Information Security Officer ("CISO") and have an IT Steering Committee ("ITSC"). Our CISO is responsible for establishing the cybersecurity vision for the Company, determining and prioritizing cybersecurity initiatives, and keeping abreast of developing security threats. The ITSC reports to the Board and Audit Committee, is chaired by our Head of IT and Software Development ("Head of IT"), and has our CISO, CFO, COO, and SEC Reporting Officer as some of its members. Our CISO brings over three decades of expertise in the IT Industry and is a member of ISACA, showcasing a rich portfolio of industry certifications like the Certified Information Security Manager ("CISM"), Certified Data Privacy Solutions Engineer ("CPDSE"), and Microsoft Certified Systems Engineer ("MCSE"). The CISO also holds accreditations from vendors such as CISCO and Microsoft. Our Head of IT brings two decades of experience in aligning technology initiatives with business goals and managing IT strategy. With a background of over 15 years in insurance and reinsurance, the Head of IT is responsible for ensuring the implementation and adherence to governance and cybersecurity frameworks. Other members of the ITSC hold relevant qualifications and collectively, the ITSC has substantial experience and expertise in cybersecurity, risk, strategy, and management.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2023, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.

companyName: RENASANT CORP

ticker: RNST


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, Security Information and Event Management systems, Extended Detection and Response with 24/7 Security Operations Center, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.

companyName: Passage BIO, Inc.

ticker: PASG


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"), who reports to our Executive Vice President and Chief Financial Officer. Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: Governance of Cybersecurity Risks The Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. IHM and the Company's Chief Executive Officer, Chief Financial Officer, Chief Operating Officer and General Counsel (collectively, the "Executive Leadership Team") are responsible for assessing and managing cybersecurity risks. Certain members of IHM periodically report to the Company's management on cybersecurity issues and management presents information to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters.

companyName: Chatham Lodging Trust

ticker: CLDT


text: We maintain a cybersecurity and information protection program that is supported by policies and procedures designed to protect our systems and assets and the Company's sensitive or confidential business information, including that entrusted to us by our clients and business partners. Identifying and assessing cybersecurity risk is integrated into our overall enterprise risk management ("ERM") processes. Our ERM processes consider cybersecurity threat risks alongside other company risks as part of our overall management activities. Cybersecurity risks related to our business are identified and managed through a multi-faceted approach utilizing various systems, controls, and processes. Our cybersecurity systems, controls and processes are overseen by our cybersecurity information technology team which is managed by our CISO.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: At least once a year, the Board of Directors receives an update on the risk management process and enterprise risks, including those related to cybersecurity and data privacy. If there are any significant or critical cybersecurity threats or incidents, management will provide special reports to either the Audit Committee or the Board of Directors, depending on the severity of the threat or incident. Please see our 2023 Proxy Statement filed April 14, 2023 for more information regarding our ERM program.

companyName: Thoughtworks Holding, Inc.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing applications and hosting.

companyName: Kronos Bio, Inc.


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Mr. Yi, as sole director of our Board of Directors, is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Mr. Peng, our Vice President, provides periodic briefings to Mr. Yi regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity policies and procedures, activities of third parties, and the like.

companyName: Zhuoxun Hongtu Inc.


text: Our cybersecurity risk management program, which is discussed above, is led by our CSO, who has 34 years of experience in various roles involving managing information security of large-scale global security operations, including developing cybersecurity strategy and implementing effective information and cybersecurity programs. Our CSO maintains industry certifications, including an ISC2 Certified Information Systems Security Professional certification.

companyName: BLACK HILLS CORP /SD/

ticker: BKH


text: We take a risk-based approach to the evaluation and oversight of third-party vendors with access to Company systems or data.

companyName: DevvStream Corp.

ticker: DEVS


text: Access to data on the Corporation's networks is granted only if needed for job functions. The Information Security Department approves all changes to access and critical systems are subject to annual review.

companyName: ENB Financial Corp

ticker: ENBP


text: We use a risk-based approach with respect to our use and oversight of third-party service providers. We use a number of means to assess cyber risks related to our third-party service providers, including maintaining vendor questionnaires/conducting due diligence in connection with onboarding new vendors and engaging in periodic reviews thereafter as appropriate. We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: EyePoint, Inc.

ticker: EYPT


text: We also have a policy for responding to and mitigating cybersecurity incidents. Our Chief Information & Technology Officer ("CITO") oversees our incident response procedures, which are reviewed and updated periodically.

companyName: UNIFIRST CORP

ticker: UNF


text: Our policies and processes for assessing, identifying and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on the frameworks established by the National Institute of Standards and Technology ("NIST") and other applicable industry standards. Our cybersecurity program in particular focuses on the following key areas: Collaboration

companyName: CPI Card Group Inc.

ticker: PMTS


text: CIO may report to and brief the Board and the audit committee on cybersecurity matters, including key risks, the potential impact of those exposures on our business, financial results, operations, and reputation, as well as the programs and steps implemented by management to monitor and mitigate risks. The reporting cadence and structure continues to develop.

companyName: Tevogen Bio Holdings Inc.

ticker: TVGN


text: Board Oversight and Management's Role Our cybersecurity program is led by our Chief Information Security Officer (CISO) at the direction of the CFO in coordination with our Director of IT. Our CISO has over 30 years of experience in cybersecurity and cyber risk management. His role includes assessing enterprise cybersecurity risks, developing policies and standards for the cybersecurity program, developing strategies for mitigating cybersecurity risks and informing senior leadership on cybersecurity related issues and activities affecting the organization. The CISO works with the IT and security team to implement cybersecurity controls across the organization.

companyName: Loar Holdings Inc.

ticker: LOAR


text: In July 2023, the SEC adopted a new rule, Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, which requires registrants to disclose material cybersecurity incidents they experience and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance. For registrants, the final rules were effective September 5, 2023, with the new disclosures required beginning in annual reports for fiscal years ending on or after December 15, 2023. With respect to compliance with the incident disclosure requirements, all registrants other than smaller reporting companies must begin complying on December 18, 2023, with smaller reporting companies being given an additional 180 days, or June 15, 2024. The Company adopted these new cybersecurity disclosure requirements in the prior fiscal year, as detailed below.

companyName: QUICKLOGIC Corp

ticker: QUIK


text: Service Providers. Like many companies, the Corporation relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Corporation maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Corporation data. The Third-Party Risk Management Policy applies to any business arrangement between the Corporation and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is reviewed as part of the Corporation's annual Internal Audit Risk Assessment.

companyName: UNIVEST FINANCIAL Corp

ticker: UVSP


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program. On a quarterly basis, our Audit Committee receives updates from our CISO with respect to the status of our cybersecurity initiatives to strengthen our cybersecurity risk management. In addition, our CISO updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. Our Audit Committee discusses the potential impact of cybersecurity risks on our financial condition, results of operations or our reputation. Our Audit Committee periodically reports to the Board regarding its activities, including those related to cybersecurity. The Board also periodically receives briefings from management on our cyber risk management program. Board members receive periodic presentations on cybersecurity topics from our CISO, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: ICU MEDICAL INC/DE

ticker: ICUI


text: Consistent with overall ERM policies and practices, the Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains a global presence, with cybersecurity threat operations functioning 24/7 with the specific goal of identifying, preventing, and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through regular vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers, and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides training for personnel regarding cybersecurity threats, which is designed to reinforce the Company's information security policies, standards, and practices. This training includes certain periodic and mandatory training for Company personnel regarding cybersecurity threats as well as the handling and processing of payment cards. All periodic and mandatory training is scaled to reflect the roles, responsibilities and information systems access of applicable personnel. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, accounting, risk management, internal audit, and other key business functions, as well as the members of the Board and the Audit Committee of the Board in a dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds designed to help ensure that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly interacts with the Company's ERM function, the Company's Chief Information Officer, other members of management, and relevant management committees and councils, including the Company's Cyber Security Committee.

companyName: PENN Entertainment, Inc.

ticker: PENN


text: Key elements of our cybersecurity risk management program include: • Risk assessments designed to help identify significant cybersecurity risks to our critical systems and information; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers to assess, test or otherwise assist with aspects of our security controls; • Cybersecurity awareness training of our employees and senior management, including specific training on emerging AI-driven threats; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • A third-party information security risk management process for certain critical service providers, suppliers and vendors based on our assessment of their criticality to our business and risk profile; and • Quarterly third-party internal and external vulnerability assessments from our cybersecurity firm leveraging the Common Vulnerability Scoring System (CVSS). Bi-annual third-party social engineering and cyber penetration testing with third-party information security company that specializes in conducting such tests.

companyName: Rexford Industrial Realty, Inc.

ticker: REXR


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing the Company's cybersecurity and privacy risk exposures and policies. On a quarterly basis, the CTO reports to the Audit Committee on information technology and cybersecurity matters, including key information technology risks. The CTO also apprises the Audit Committee and full Board of Cyber Security Incidents consistent with our incident response program, promptly.

companyName: Beyond Air, Inc.

ticker: XAIR


text: We have processes to identify, assess, monitor, and manage material risks related to information technology, including cybersecurity threats, vulnerability management, incident management, data protection and retention, and fraud prevention. Our Enterprise Risk Management process evaluates and mitigates cybersecurity risks in alignment with our business objectives and operational needs. We periodically engage third-party security firms and consultants to oversee and identify cybersecurity risks; the results of these assessments are reported to our Audit Committee.

companyName: MARZETTI CO

ticker: MZTI


text: Risk Assessment and Identification We have implemented security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack. As the Company does not have a physical office location, it does not have a local network or in-house servers and proprietary applications. We therefore utilize third-party applications and resources to support our information technology ("IT") needs. All applications utilized by the Company are Software as a Service ("SaaS") offerings. As our applications are developed and managed by third parties, we are dependent on these providers for many functions including disaster recovery during a disaster or cyber incident. We prioritize risks based on their potential impact to our financial condition, operational continuity and reputation. Our goal is to only utilize the most secure and trusted providers for our IT needs.

companyName: Autonomix Medical, Inc.

ticker: AMIX


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have engaged with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems in an ongoing and as needed basis. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Versus Systems Inc.

ticker: VS


text: Board is ultimately responsible for overseeing cybersecurity, information security, and information technology risks, as well as management's actions to identify, assess, mitigate, and remediate those risks. On an annual basis, the Board reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our director Dr. Yuanyuan Huang regularly briefs senior management and the Board of Directors on cybersecurity issues as part of our overall enterprise risk management program, which may include information regarding our exposure to privacy and cybersecurity risks deemed to have a moderate or higher business impact, even if immaterial to us. Dr. Yuanyuan Huang is responsible for implementing cybersecurity policies, programs, procedures, and strategies. Dr. Huang is experienced and qualified because of his education and working experience in related fields.

companyName: STRATEGIC ACQUISITIONS INC /NV/

ticker: STQN


text: We are regularly subject to cyberattacks and other cybersecurity incidents. In response, we evaluate and implement cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our management team collaborates with our Information Security function, led by our Chief Information Officer ("CIO") to gather insights for assessing, identifying and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: Arhaus, Inc.

ticker: ARHS


text: PACCAR's Security Risk Council, which includes the Company's Management and PACCAR's Chief Information Security Officer, meets regularly to cover risks, plans and updates to the security program. It briefs the PACCAR Board of Directors and/or the Audit Committee of the Board of Directors on technology and information security matters. Management and the PACCAR Board of Directors also receive periodic updates on the status of cybersecurity investments to guard against such events. In the event of a security breach, the PACCAR's Security Risk Council evaluates its significance and briefs the PACCAR Board on the event.

companyName: PACCAR FINANCIAL CORP


text: AEP has undertaken a variety of actions to monitor and address cyber-related risks. Cybersecurity and the effectiveness of AEP's cybersecurity processes are reviewed annually with the Board of Directors and at several meetings throughout the year with the Technology Committee of the Board, the principal committee that exercises oversight with respect to these matters. AEP's Chief Executive Officer and executive team participate in interactive threat briefings from AEP's CSO and/or Chief Information & Technology Officer on a regular basis. AEP's strategy and procedure for managing cyber-related risks is integrated within its enterprise risk management processes. These procedures are designed to ensure that any material information regarding potentially relevant cyber incidents is elevated in a timely manner both to the appropriate leadership and, where applicable, to our external financial reporting and disclosure team. AEP's enterprise-wide security program continually adjusts staff and resources in response to the evolving threat landscape. The costs for such investments are material and have remained generally consistent over time, a pattern that is expected to continue. In addition, AEP maintains cyber liability insurance to cover certain damages caused by cyber incidents.

companyName: AEP Transmission Company, LLC


text: We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Risk Factors – Risks Relating to Information Technology and Cybersecurity – Cybersecurity attacks on any of our facilities, or those of third parties, may result in potential liability or reputational damage or otherwise adversely affect our business."

companyName: TIDEWATER INC

ticker: TDW


text: The Company's cybersecurity risk management program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Everi's Security department, Chief Information Security Officer ("CISO"), and Chief Information Officer ("CIO"), with oversight from the Chief Executive Officer ("CEO"), lead the cybersecurity detection, risk reduction and mitigation efforts for the Company. These efforts include, but are not limited to the following: • Monitoring logs and alerts for security issues, events, and breaches; • Preparing and regularly testing Everi's preparedness for attacks, incidents, and breaches, including the use of table-top exercises of simulated cyber incidents with the executive team; • Developing policies and procedures to identify, classify, and define protection and management objectives, and define acceptable use of Company information assets; • Deploying monitoring and data collection tools to monitor the security of devices and processes; • Monitoring and reviewing physical and logical access to Everi data and properties to meet applicable security and regulatory requirements; • Developing and maintaining a vulnerability identification and management program; • Developing and maintaining a security awareness and training program; and • Obtaining System and Organizational Controls Two certifications for products Given the complexity and evolving nature of cybersecurity threats, Everi engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights to maintain and enhance our cybersecurity strategies and processes. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.

companyName: Everi Holdings Inc.


text: We have a cross-departmental approach to addressing cybersecurity risk, including input from employees and our Board of Directors. The Board, Audit Committee, and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process. We have a set of Company-wide policies and procedures outlined in our Employee Handbook that directly or indirectly relate to cybersecurity risks. These policies go through an internal review process and are approved by appropriate members of management. Consistent with best practices and requirements in the Employee Handbook, the Company conducts cybersecurity training on a periodic basis which occurs at least annually. Additionally, the Company continually addresses and maintains internal controls for identity and access management, logging and monitoring activities, performing periodic penetration testing and vulnerability scanning, general IT infrastructure governance and oversight, risk and threat assessment, employee awareness training and ongoing security monitoring. The Company engages a third-party hosting platform which internally manages ongoing vulnerability scanning, threat assessment and incident response through the hosting platform providing redundancy in threat preparedness, detection and response.

companyName: SOBR Safe, Inc.

ticker: SOBR


text: We have expanded investments in IT security and improved access control and identity and authentication management, and engage consultants as needed. We test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party consultants. At the management level, our IT security team monitors alerts and meets to discuss threat levels, trends, mitigation, and remediation. The cybersecurity team collects data on cybersecurity threats and risk areas and conducts risk assessments. We conduct external penetration tests and maturity testing to assess our processes and procedures and the threat landscape. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of our third-party service providers. Our assessment of risks associated with our use of third-party service providers is part of our overall cybersecurity risk management framework.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: The Company is committed to protecting the confidentiality, integrity, and availability of its information systems and the data they contain from cybersecurity threats. The Company recognizes that cybersecurity is a dynamic and evolving area of risk that requires ongoing assessment, management, and oversight. Third parties are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: Precipio, Inc.

ticker: PRPO


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including two factors: authentication, firewalls, anti-malware functionality, email threat protection and access controls, which are evaluated and improved through vulnerability assessments.

companyName: NOBILITY HOMES INC

ticker: NOBH