text: Third-Party Auditors and Consultants in Cybersecurity Risk Management Our cybersecurity team also periodically engages third-party cybersecurity experts for risk assessment and system enhancements. We utilize third-party auditors and assessors in connection with our cybersecurity risk management program to identify gaps and develop policies, procedures, and strategies designed to improve the program posture. We also use third-party consultants to obtain and will use them to maintain relevant organizational cybersecurity certifications, including UN Regulation 155 Vehicle Cybersecurity Approval. As a general matter, we have from time-to-time utilized third-party cybersecurity consultants on an ad hoc basis in specific instances, including (i) to address potential cybersecurity threats and incidents, (ii) to conduct cybersecurity assessments and penetration testing on high value systems and applications; and (iii) to develop internal capabilities to improve our cybersecurity defense.

companyName: Lucid Group, Inc.

ticker: LCID


text: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks. We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics; conducting (directly or through third parties) regular audits and threat assessments for internal and external threats; subscribing to reports and services that identify cybersecurity threats; analyzing reports of threats and actors; conducting vulnerability assessments to identify vulnerabilities; evaluating our and our industry's risk profile; conducting tabletop incident response exercises; and evaluating threats reported to us.

companyName: Travere Therapeutics, Inc.

ticker: TVTX

secItem: Item 1C


text: We employ capabilities, processes, and other security measures we believe are designed to reduce and mitigate these risks and have requirements for our suppliers to do the same. Despite having thorough due diligence, onboarding, and cybersecurity assessment processes in place for our suppliers, the responsibility ultimately rests with our suppliers to establish and uphold their respective cybersecurity programs. Our ability to monitor the cybersecurity practices of our suppliers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks, and other assets owned or controlled by our suppliers. When we become aware that a supplier's cybersecurity has been compromised, we attempt to mitigate the risk to the Company, including, if appropriate and feasible, by terminating the supplier's connection to our information systems. Notwithstanding our efforts to mitigate any such risk, there can be no assurance that the compromise or failure of supplier information systems, technology assets, or cybersecurity programs would not have an adverse effect on the security of the Company's information systems.

companyName: Fisker Inc./DE


text: We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. Our program leverages best practices and is guided by industry frameworks, including the National Institute of Standards and Technology Cyber Security Framework. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.

companyName: TENET HEALTHCARE CORP

ticker: THC


text: Board of Directors' oversight of risks from cybersecurity threats Our Board of Directors, which has primary responsibility for overseeing risk management, has delegated risk management oversight responsibility for information systems, information security, data privacy and cybersecurity to the Audit Committee. Several of our Board members, including certain members of our Audit Committee, have backgrounds or professional experience in risk management, digital platforms, information technology or cybersecurity.

companyName: Walmart Inc.

ticker: WMT


text: The DCSI is responsible for hiring appropriate personnel, leading enterprise-wide cybersecurity strategy, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Our Head of IT meets regularly with our Chief Financial Officer to discuss our cybersecurity threat landscape, address opportunities for improvement and issues, and evaluate solutions to cover identified gaps. Our Head of IT, in collaboration with members of senior management, reports significant cybersecurity matters to our Audit Committee, consistent with the Incident Response Policy.

companyName: Invivyd, Inc.

ticker: IVVD


text: Our process for identifying, assessing, and managing risks related to cybersecurity generally involves CyberTeam regularly meeting with our executive leadership team, and when appropriate, our board and/or audit committee to discuss cybersecurity related risks identified and the potential likelihood and severity of each risk.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: To further protect its information and cyber assets, FirstEnergy has required since late 2022 that applicable prospective third-party vendors complete a privacy impact assessment, which is designed to identify potential privacy and cyber security risks for those vendors requiring access to personally identifiable information, and based on the results, include appropriate contractual provisions to mitigate any identified risks. FirstEnergy is also currently evaluating its current third-party vendors to identify which vendors have similar access to personally identifiable information and expects to complete its analysis by the end of 2024.

companyName: FIRSTENERGY CORP

ticker: FE


text: The CISO provides periodic reports to the Audit Committee (Audit Committee) of the Board of Directors (Board), the full Board, as well as to the Company's Chief Executive Officer and other members of senior management, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects intended to strengthen its information security systems, assessments of the information security program (including remediation, mitigation, and management of identified vulnerabilities), and the emerging threat landscape. The information security program is regularly evaluated by internal and external consultants and auditors with the results of those reviews reported to senior management and the Audit Committee, which is comprised entirely of independent directors and has oversight responsibility for these risks.

companyName: Merck & Co., Inc.

ticker: MRK


text: Board of Directors are currently implementing as oversight procedure for IT governance and cyber security risk management. It is expected that IT governance and cybersecurity will be included in the company's quarterly management review meetings under the supervision of our senior leadership, including our Chief Executive Officer and Chief Financial Officer, with regularly meets with and provides periodic briefings to our Board of Directors regarding our cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.

companyName: Allarity Therapeutics, Inc.

ticker: ALLR


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CIO, who has over 20 years of expertise in overseeing corporate information technology functions, and our CISO, who has 20 years of experience in the cybersecurity industry.

companyName: Veritone, Inc.

ticker: VERI


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity incidents that we believe have materially affected, or are likely to materially affect, the Company.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: We employ a range of tools and services to inform our risk preparedness, identification, assessment and remediation processes, including, among others, continuous monitoring, regular reoccurring security and compliance activities, training, threat intelligence, business processes, change management, strategic planning, annual assessments, and periodic testing and assessments performed by qualified security personnel and by third-party firms. As part of the above-described processes, we engage with third-party firms to perform independent assessments, including internal and external penetration tests, configuration assessments, security plan and program assessments, compliance assessments, and incident response readiness exercises to help identify areas for continued focus, improvement and/or compliance.

companyName: USA TODAY Co., Inc.

ticker: TDAY


text: We are a clinical stage biopharmaceutical company with no commercial operations or revenue streams and our sole business activity has been ongoing research into our drug therapies. We have certain processes for assessing, identifying and managing cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems, which are built into our overall risk management program. Our processes are designed to preserve the confidentiality, integrity, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Such processes include physical, procedural and technical safeguards, and response plans on our systems. We engage an external consultant to manage cybersecurity tooling and incident response, as well as general information technology, or IT, systems, which enhance our cybersecurity oversight. We consider the internal risk of oversight programs of the third-party consultant before engaging them in order to help protect us from any related vulnerabilities. As our company grows, we plan to expand our strategy for cybersecurity in alignment with nationally accepted standards.

companyName: Rein Therapeutics, Inc.

ticker: RNTX


text: To help identify, assess, and mitigate cybersecurity threats that we face to our business, S&TO, in addition to its own capabilities, partners with Cisco's Talos Threat Intelligence Group and third parties, including governments and peer companies, to share and receive threat intelligence and other information. S&TO actively monitors for and evaluates cybersecurity vulnerabilities, threats, and incidents observable on the internet and the dark web. In addition to monitoring risks from threats to our own business, we operate third-party risk management programs to help identify and manage risks from cybersecurity threats arising from third-party suppliers and service providers on which we rely. These programs leverage on-going security-focused risk assessments based on industry practices, audits, and contractual requirements.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: While we face a number of ongoing cybersecurity risks in connection with our business, such risks have not materially affected us to date, including our business strategy, results of operations, or financial condition.

companyName: American Bitcoin Corp.

ticker: ABTC


text: Our Board of Directors ("Board") receives regular updates from management and external consultants which may address a broad range of cybersecurity and IT topics, including trends, regulatory developments, data security policies and practices, cybersecurity incidents, and ongoing efforts to further strengthen our security posture. Our Board reviews key metrics related to cybersecurity on a quarterly basis, and is notified of applicable cybersecurity incidents if and when they occur.

companyName: AECOM

ticker: ACM


text: Managing Material Risks & Integrated Overall Risk Management We attempt to integrate cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.

companyName: Cactus, Inc.

ticker: WHD


text: Our management team has taken additional steps to implement our cybersecurity risk management program. For example, we have implemented periodic management reviews of our controls related to provisioning of user access to certain third-party hosted applications that we use in connection with the business and risks posed by certain critical vendors; this includes reviewing System and Organizational Control audit reports of such vendors. We maintain cybersecurity insurance coverage intended to mitigate our financial exposure to certain cybersecurity threats, and we consult with external advisors regarding opportunities and enhancements to strengthen our cybersecurity processes and practices.

companyName: Seritage Growth Properties

ticker: SRG


text: Energy Vault's CIO has more than 25 years of cybersecurity and risk management experience across multiple market verticals, including extensive experience overseeing critical and complex cybersecurity teams spanning multiple federal agencies and private industry. Further, the Audit Committee has a combined nine years of experience in organizational cybersecurity and risk management.

companyName: Energy Vault Holdings, Inc.

ticker: NRGV


text: The Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.

companyName: WSFS FINANCIAL CORP

ticker: WSFS


text: We are a clinical-stage biotechnology company and continue to mature as a public company since our initial public offering in 2020. We have developed cybersecurity policies, procedures and practices and an enterprise risk management program designed to align to the nature, size and scale of our business operations and cybersecurity threat profile.

companyName: COMPASS Pathways plc

ticker: CMPS


text: The Company recognizes that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, each employee is required to complete information security and data privacy training to build awareness of cybersecurity risks to the organization. The Company has engaged third party vendor Knowbe4 to send each employee an email that mimics a potentially harmful phishing attempt each month and to report to management the results of the phishing security test.

companyName: RAVE RESTAURANT GROUP, INC.

ticker: RAVE


text: Our management team oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.

companyName: Clearwater Analytics Holdings, Inc.

ticker: CWAN


text: Our management team, including our Chief Technology Officer, Mr. Wan Xin, is responsible for assessing and managing our material risks from cybersecurity threats. Mr. Wan bears the critical responsibility of assessing, monitoring and managing our cybersecurity risks and digital assets. Possessing extensive experience in the field of information security, Mr. Wan's substantial professional knowledge and experience are indispensable to the formulation and implementation of our cybersecurity strategy. Under Mr. Wan's supervision, our management team has primary responsibility for our overall cybersecurity risk management program and supervises our internal cybersecurity personnel.

companyName: GigaCloud Technology Inc

ticker: GCT


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, and privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive cybersecurity reviews of systems and applications, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, utilize an expert third party to continuously monitor and respond to possible threats, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes. We regularly collaborate with leading security providers, industry groups, and industry peers to exchange information on trends and best practices to address new and evolving cybersecurity risks.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Our Board of Directors (the "Board") maintains oversight responsibility for our ERM program. This oversight is facilitated primarily through the Risk Oversight Committee of the Board (the "Risk Committee"), which reviews the ERM program, related assessments and remediation activities for subsequent review by the Board. As part of its ERM oversight responsibilities, the Risk Committee is responsible for oversight of the Company's cybersecurity risk management, including the Company's material programs, policies and safeguards for information security, cybersecurity and data security. At least quarterly (and more frequently as required), the Risk Committee and Audit Committee meet with management, including the Chief Information Security Officer (the "CISO"), to discuss, assess and determine the allocation of resources to risk matters, including cybersecurity risks, which enables effective integration of risk practices into strategic planning and enterprise decision-making.

companyName: CONDUENT Inc

ticker: CNDT


text: Mr. Coniglio oversees the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents. Since 2021, we have retained a third-party information technology provider to develop and maintain our information technology infrastructure, cloud network, and assist in the development of cybersecurity and information technology policies. Our third-party provider is MSPAlliance Cyber Verified, which has been examined by an independent third-party public accounting firm and has successfully met the applicable 10 control objectives and underlying controls and requirements.

companyName: NewLake Capital Partners, Inc.

ticker: NLCP


text: Cybersecurity Risks As discussed above and under " Item 1A —Risk Factors—Risk Factors—General Risk Factors," we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time. While to our knowledge we have not to date experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.

companyName: IAC Inc.

ticker: IAC


text: Primary responsibility for assessing and managing our cybersecurity risks rests with our CISO, who reports to our Executive Vice President, Operations, Technology & Data Analytics ("EVP OP"). Both are members of our Security Committee, which is a governing body that drives alignment on security decisions across the Company. The Security Committee includes management across the departments and functions of the organization to enable transparency and alignment with the business' strategic goals and objectives. The Security Committee responsible for managing and implementing the Company's cybersecurity programs has many years of valuable business experience managing risks and developing and implementing cybersecurity policies and procedures. Our CISO has extensive experience in information security, managing cybersecurity programs and cybersecurity risks, and has served in various roles in information technology and information security for almost 30 years, including serving as the CISO at another large public company.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: In the case of the discovery of a material incident, we have a third-party under retainer to assist with incident containment and response. The third-party company provides forensic and investigation assistance to our incident response team, as needed.

companyName: AdTheorent Holding Company, Inc.


text: We engage consultants, auditors or other third parties in connection with our risk assessment processes. These parties assist us with designing and implementing our cybersecurity policies and procedures, as well as to monitor and test our safeguards, and investigations on an as needed basis. We contractually require third-party service providers to implement and maintain appropriate security measures, consistent with applicable laws, to implement and maintain reasonable security measures in connection with their work with us.

companyName: Merus N.V.


text: In conclusion, our information security program is underpinned by strong leadership, adherence to industry standards, proactive monitoring, and collaboration with internal and external stakeholders. By prioritizing cybersecurity and risk management, we uphold our commitment to safeguarding our assets, maintaining operational resilience, and protecting the interests of our stockholders.

companyName: CONNS INC


text: The Technology Committee of our board of directors is responsible for overseeing our information security and technology programs, including management's actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. Our Chief Information Security Officer provides quarterly reports to the Technology Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes. The Technology Committee of our board of directors reviews and approves our information security and technology budgets and strategies at least annually.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: We have established certain processes designed to assess, identify and manage cybersecurity risks, which are built into our information technology functions and are designed to help protect our information assets and operations from internal and external cyber threats. Our cybersecurity risk management processes target integral areas such as data protection, access control, incident response and vulnerability management and are integrated into our overall enterprise risk management process. As part of our overall enterprise risk management process, our company's information technology functions, including our Information Technology department leaders and third-party service providers, identify, assess and evaluate cybersecurity risks impacting our operations across the Company.

companyName: Immunovant, Inc.

ticker: IMVT


text: Our cybersecurity program (the " Cybersecurity Program ") includes processes to identify, assess, and manage material risks from cybersecurity threats. The Cybersecurity Program processes utilize a risk-based approach and include written cybersecurity and information technology policies and procedures, including a cybersecurity incident response plan.

companyName: HUNTINGTON INGALLS INDUSTRIES, INC.

ticker: HII


text: In addition, under the Plan, we have established a cross-functional management group comprised of our Chief Legal Officer, Chief Financial Officer, Vice President Internal Audit, Vice President Compliance, Senior Vice President Finance & Corporate Controller and CISO. The Plan provides that any cybersecurity incident that is elevated for the review of the Response Team will also be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required or advisable in connection therewith, following any necessary consultation with the Company's senior management, Disclosure Committee, Audit Committee and/or Board of Directors.

companyName: YUM BRANDS INC

ticker: YUM


text: The Company integrates risk management into its overall cybersecurity strategy and has implemented processes designed to identify, assess, prioritize, and manage risks to protect data, intellectual property, and information assets. As part of our risk governance and management, the Company has developed procedures to identify and evaluate risks, measure them against predefined criteria, devise and execute strategies to mitigate identified risks, continuously monitor and review risk profiles, and communicate risks to management and relevant stakeholders. Addressing cybersecurity risks involves a comprehensive approach that encompasses both internal assessments and external information sources. For instance, the Company engages in security assessments conducted by internal and external experts to ensure compliance with security policies and industry frameworks; and vulnerability assessments to discover vulnerabilities in networks, systems and applications. The Company has strategically reduced its hardware footprint by eliminating on-premise datacenters and moving IT infrastructure into cloud-hosted and Software as a Service (SaaS) providers. As a result, the Company believes it is streamlined and agile to respond quickly to market fluctuations and changes in the industry. Additionally, the Company leverages cloud-hosted and SaaS providers that offer Service Level Agreements (SLAs) and adhere to compliance and regulatory requirements for the industry. We oversee third-party service providers by conducting vendor diligence upon onboarding and additional monitoring. Vendors are assessed for risk based on the nature of their services, access to data and systems and supply chain risk. The Company performs ongoing risk assessments that evaluate IT systems and assess the likelihood of occurrence, estimate potential impact, and plan for remediation.

companyName: Vireo Growth Inc.

ticker: VREOF


text: We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.

companyName: FIRST COMMONWEALTH FINANCIAL CORP /PA/

ticker: FCF


text: See "Risks Related to All Segments – Our business operations are continually subject to cyber-based security and data integrity risks from vulnerabilities related to our IT systems, operational technology infrastructure and supply chain relationships" in "Item 1A. Risk Factors" for a discussion of cybersecurity risks affecting the Registrants.

companyName: PPL ELECTRIC UTILITIES CORP


text: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident, and such plans are evaluated annually.

companyName: Revance Therapeutics, Inc.


text: Cybersecurity represents a critical component of our overall approach to risk management. Our cybersecurity policies, standards and practices are fully integrated into our enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by our Board. Our cybersecurity policies, standards and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multilayered methodology, with specific the goals of: (i) identifying, preventing and mitigating cybersecurity threats to us; (ii) preserving the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protecting our intellectual property; (iv) maintaining the confidence of our tenants, vendors and airport partners; and (v) providing appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: Sky Harbour Group Corp

ticker: SKYH


text: We strive to proactively manage third-party risks to minimize any adverse effects on our business that may arise due to a cybersecurity incident affecting third-party systems and vendors. While we rely on third-party vendors to manage and maintain their own cybersecurity defense programs, we are developing a vendor risk management program to assess our exposure to these external cybersecurity risks.

companyName: ANAPTYSBIO, INC

ticker: ANAB


text: Management has assigned responsibility for the security risk program to the Chief Security Officer who has multiple years of experience in the Defense Industrial Base. The Chief Security Officer is informed about and monitors prevention, detection, mitigation and remediation efforts through a team of security professionals, many of whom are Certified Information Systems Security Professionals, Certified Information Security Managers or have received other cybersecurity certifications. The team has extensive experience selecting, deploying and operating cybersecurity technologies, initiatives and processes that aid in preventing, remediating and mitigating known and unknown security threats.

companyName: XCEL ENERGY INC

ticker: XEL


text: Xerox Holdings has established a structured third-party risk management program, with a primary focus on assessing and mitigating potential cyber risks linked to external vendors and partners who have access to the organization's digital assets or play a role in storing and processing data. This also extends to the software supply chain supporting our products and services. A thorough due diligence process is conducted on all prospective third parties to evaluate their overall security posture and alignment with Xerox Holdings' organizational standards. Additionally, ongoing assessments are regularly conducted on selected existing vendors and partners to confirm their continuous compliance with Xerox Holdings' cybersecurity standards and policies. Where applicable, we also include security and data privacy addendums in our third-party contracts. Xerox Holdings also engages with external managed security service providers to support certain day-to-day operational activities in addition to in-house cybersecurity staff as part of the cybersecurity program.

companyName: XEROX CORP


text: The Company's Infrastructure Director is responsible for managing cybersecurity risks, including the prevention, detection, mitigation, and remediation of cybersecurity incidents. The Infrastructure Director has 20 years of experience in the creation and management of enterprise security risk programs. The Infrastructure Director reports to the EVP, Global Supply Chain & Import, who oversees the Company's management of cybersecurity risk. Through these activities and monitoring, both internally and externally, any events or incidents identified will be escalated to the appropriate Business Team Member in accordance with the Company's Incident Management Plan.

companyName: LIFETIME BRANDS, INC

ticker: LCUT


text: Our Audit Committee shares oversight responsibility with the full Board for our information security and technology risks, including cybersecurity. Anywhere's Chief Information Security Officer (CISO) reports to the Audit Committee on a quarterly basis and once a year to the full Board on the cybersecurity program, including the Company's cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape. Two Audit Committee members have significant business experience with respect to cybersecurity risks, namely the chair of the committee, who oversaw information security and data privacy as an Enterprise Risk Officer of a Fortune 500 publicly-traded company and a member who is the Chief Product Data, Analytics and Technology Officer of a Fortune 500 publicly-traded company.

companyName: Anywhere Real Estate Group LLC


text: Monitoring Cybersecurity Incidents The Security Committees are continually informed about the latest developments in cybersecurity, including potential threats and risk management techniques. The Security Committees, and in particular senior IT leadership, IT cybersecurity and internal audit members serving on the Security Committees, implement and oversee processes for the regular monitoring of our information systems. The Company follows the National Institute of Standards and Technology ("NIST") framework to design and implement security processes, tools and procedures, and regular system audits identify and lead to prompt remediation of potential vulnerabilities. In the event of a cybersecurity incident, senior IT leadership and the Security Committees are equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact, internal and external communication plans, and notification requirements.

companyName: AMC ENTERTAINMENT HOLDINGS, INC.

ticker: AMC


text: Our Information Technology ("IT") security department, led by our Chief Information Officer ("CIO") and overseen by our Vice President of Information Systems ("IS"), holds primary responsibility for assessing and managing cybersecurity threats. Our CIO has more than 35 years of experience in IT and holds a bachelor's degree in Management of IS; his in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Vice President of IS has more than 20 years of experience in various IT and IS roles, and holds a bachelor's degree in Accounting and Finance.

companyName: WEYCO GROUP INC

ticker: WEYS


text: The Chief Information Security Officer (" CISO ") leads our information security organization responsible for overseeing our information security program. Our CISO has over 25 years of experience in various roles involving information security, including risk management and security leadership. Team members who support our information security program have relevant education, professional certifications and industry experience, including but not limited to, holding similar positions at large technology companies. The team provides regular reports, no less frequently than monthly, to senior management and other relevant teams, including, but not limited to, the Chief Executive Officer ("CEO"), Chief Operating Officer ("COO"), Chief Information Officer ("CIO") and Chief Legal Officer ("CLO").

companyName: EchoStar CORP

ticker: SATS


text: Key Elements of Our Cybersecurity Program. We maintain cybersecurity policies that articulate Agilent's expectations and requirements regarding technology use, data privacy, risk management, and incident management. Regular exercises and assessments against recognized cybersecurity frameworks are conducted to improve the effectiveness of our processes. These are conducted by third party organizations in addition to internal audit teams. Cybersecurity is considered the responsibility of every Agilent employee, with regular education and best practice sharing to raise awareness of threats. Layered controls are implemented to prevent and detect cybersecurity threats, with policies and processes designed to provide timely notifications and compliance with legal requirements. These include controls to assess third party suppliers and their services.

companyName: AGILENT TECHNOLOGIES, INC.

ticker: A


text: As of the date of this filing, the Company's business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents; however, we cannot provide assurance that they will not be materially impacted in the future by such risks or any future material incidents. For additional information regarding the Company's cybersecurity risks, please refer to "Item 1A - "Risk Factors" on page 19.

companyName: NACCO INDUSTRIES INC

ticker: NC


text: As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs. These programs identify and assess threats and evaluate risk. Further, these programs support a coordinated response when responding to incidents. Periodic exercises and tests verify these programs' effectiveness.

companyName: OCEANFIRST FINANCIAL CORP

ticker: OCFC


text: The members of our information technology team actively monitor threats to the information technology environment and work with our third-party service providers to monitory cybersecurity threats. In light of the Company's current size and limited personnel, management believes relying on experienced third-party providers is the most prudent and cost-effective of the date of this Annual Report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition. For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to the "Risk Factors" section of this Annual Report.

companyName: STREAMLINE HEALTH SOLUTIONS INC.


text: employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including physical security measures to prevent access to data processing systems, firewalls, intrusion prevention and detection systems, email security controls, anti-malware functionality and access controls, endpoint detection and response systems, all of which are evaluated and improved through internal and external vulnerability assessments and cybersecurity threat intelligence;

companyName: Profound Medical Corp.

ticker: PROF


text: Cyber Incident Response: We maintain a cross-functional cyber incident response plan with defined roles, responsibilities and reporting protocols, which is evaluated and tested on a regular basis. The Company has a process for employees to report suspected or confirmed cybersecurity threats or incidents. Generally, if a suspected or confirmed breach is identified, a Cybersecurity Incident Manager from the Global Information Security Team is assigned to evaluate and escalate the issue as needed to the VP Security. The Company's response to cybersecurity incidents (which includes prompt steps to protect our systems and information by containing and mitigating the impact of any incident) is managed by the VP Security, in consultation with the CIO, and when appropriate, with the CFO, COO, CEO and our Chief Legal Officer. These leaders will assess the materiality of a particular incident (alone or in combination with other factors), and the Chief Legal Officer will determine whether any reporting or notification responsibilities have been triggered. The CEO is responsible for informing our Board and the Audit Committee regarding any significant incidents, and coordinates management's recommendations concerning materiality.

companyName: CELESTICA INC

ticker: CLS


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO") and Audit Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish an 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: Our chief information and operations officer is a member of our leadership team and has been in this role for 15 years. With more than 25 years of experience in information technology in the investment banking industry, he is responsible for overseeing more than 100 employees in our information security and technology departments who possess relevant educational and industry experience. The information security and technology departments are responsible for various functions of our information and cybersecurity program, including implementing and maintaining policies and procedures; developing, implementing and governing various service level agreements; ratifying security standards; reviewing project implementations; performing third-party vendor assessments; and operating programs such as threat intelligence, vulnerability management, security information event management, and information governance.

companyName: PIPER SANDLER COMPANIES

ticker: PIPR


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition for the years of financial statements presented in this report.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring in an effort to detect and prevent significant cybersecurity threats. Magnolia uses email and spam filtering and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: Cybersecurity Program Overview As part of our overall risk management processes and procedures, we have instituted a cybersecurity program designed to identify, assess, and manage material risks from cybersecurity threats. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely. Through our cybersecurity program, the current threat landscape is actively monitored in an effort to identify material risks arising from new and evolving cybersecurity threats. We may engage external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, as needed. We also depend on and engage various third parties, including suppliers, vendors, and service providers in connection with our operations. Our risk management, legal, and compliance personnel identify and oversee material risks from cybersecurity threats associated with our use of such entities.

companyName: Chicago Atlantic BDC, Inc.

ticker: LIEN


text: Further, the Company also maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, and the Audit Committee annually reviews such coverage.

companyName: American Homes 4 Rent

ticker: AMH


text: In order to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, we perform third-party risk assessments designed to help protect against the misuse of IT by third parties and business partners and generally request that third-party service providers provide us information about their security policies and procedures. We monitor security incidents involving our third-party providers and adjust our procedures as necessary.

companyName: KADANT INC

ticker: KAI


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a Cybersecurity Working Group ("CWG") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we have a CWG which is responsible for monitoring both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: Despite our rigorous efforts, incidents may occur, and we are prepared to deal with them through our formal Incident Response Plan. Events such as human errors, computer viruses or other malicious code, unauthorized access, cyber-attacks, or phishing attempts concern all organizations. Our Incident Response Team is trained to contain incidents, mitigate impacts, resolve or remediate issues, and notify affected parties as appropriate. The team is made up of key security, privacy, and legal professionals who work with eHealth Technology and Business Teams and our managed security services.

companyName: eHealth, Inc.

ticker: EHTH


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.

companyName: NESTOR PARTNERS


text: Additionally, Deutsche Bank Group's Information Security Management System has been certified according to ISO 27001 for all information security domains defined in that standard since 2012. To maintain the ISO 27001 certification, Deutsche Bank Group performs a full recertification process every three years, with the latest taking place in 2021. In the years a full certification process does not take place, the Deutsche Bank Group performs a certification-follow-up, designed to ensure compliance between certification intervals. The latest certification follow-up was in 2023. The next full recertification will take place in September 2024.

companyName: RREEF Property Trust, Inc.


text: Our management team, including our CIO and our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and CISO collectively have over five decades of IT and cybersecurity experience in technology companies, including two decades in senior-level leadership roles. Additionally, our CISO holds Certified Information Security Manager and Certified in Risk and Information Systems Control certifications, They are assisted by a cross-functional Information Security Steering Committee.

companyName: EXTREME NETWORKS INC

ticker: EXTR


text: Safeguarding the Company's information technology ("IT") systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share is a critical concern. As such, the Company has processes in place to assess, identify, and manage material cybersecurity threats and incidents. The Company's cybersecurity strategy includes policies, procedures, and technology that proactively safeguard its operations against cybersecurity threats. The Company utilizes IT that enables its team to access both operational and financial performance data in real time, while, at the same time, identifying and preventing cybersecurity threats and risks. The Company aims to incorporate industry best practices throughout its cybersecurity processes and its cybersecurity framework leverages internationally recognized standards, including the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover). These processes incorporate preventative, detective and corrective controls to identify relevant cyber risks and include network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within its network as well as evaluation and monitoring of detected security events. The Company continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats. Continuous monitoring of the Company's networks and systems for threats and vulnerabilities is a key component of the Company's strategy, supported by the analysis of threat intelligence from external sources. This multi-layered approach enables early detection and facilitates prompt response to potential cybersecurity threats.

companyName: PARK AEROSPACE CORP

ticker: PKE


text: Our Board of Directors, in coordination with the Audit Committee, oversees the Company's risk management process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, and ongoing updates regarding any such incident until it has been addressed.

companyName: Matterport, Inc./DE


text: At the management level, our CIO is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company's goals and needs. Our CIO has extensive experience with respect to cybersecurity matters as a result of over 20 years of relevant work experience. Our cybersecurity function is supported by highly trained cybersecurity personnel with substantial industry experience as well as our network of specialized consulting partners, regional IT leaders and our global IT infrastructure team. Our CIO receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.

companyName: ESAB Corp

ticker: ESAB


text: The Company employs email security tools provided and managed by our Provider to protect against email-based attacks. These tools include an email security gateway and an additional automated email filtering security. These tools provide advanced, AI-powered phishing detection and remediation for all Microsoft 365 email users in the environment.

companyName: RESERVE PETROLEUM CO

ticker: RSRV


text: Cyber Risk Management and Strategy Processes to identify, assess, and manage risks presented by cybersecurity threats are integrated into our overall ERM program and are informed by industry cybersecurity standards, including the NIST Cybersecurity Framework. Our CISO, in collaboration with the team responsible for the ERM program and the information security team, conducts a risk assessment process to regularly evaluate, monitor, manage, and mitigate cybersecurity risks. This process is also supported by periodic security testing and monitoring.

companyName: Toast, Inc.

ticker: TOST


text: As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Corporate Governance and Oversight," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with and receives reports from the Company's ERM function, the Vice President of IT and Digital, the Company's Chief Information Security Officer ("CISO"), and other members of management. • Collaborative Approach: The Company has integrated cybersecurity risk management into its broader risk management framework to promote a Company-wide culture of cybersecurity risk management. To that end, the Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response: The Company has established and maintains a comprehensive incident response plan that fully address the Company's response to a cybersecurity incident, and this plan is tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company conducts security assessments of all of its electronic information-related third-party service providers before the Company engages them, and the Company maintains policies and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. • Education and Awareness: The Company provides regular, mandatory training for the Company's personnel regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management, disaster recovery and business continuity plans, risk assessments, achievement of certain security certifications, encryption of certain data, network security controls, data segregation for certain data, access controls, physical controls, systems monitoring, employee training, penetration testing, and asset management and disposal.

companyName: Silence Therapeutics plc

ticker: SLN


text: We have not identified any risks from known cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. The company is currently in the process of implementing a more formalized cybersecurity program.

companyName: Spectaire Holdings Inc.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.

companyName: CrossAmerica Partners LP

ticker: CAPL


text: Material Impact Analysis: Management assesses the potential for substantial harm to the organization, considering factors such as data integrity, patient privacy, and operational continuity.

companyName: QHSLab, Inc.

ticker: USAQ


text: Although we believe that our resiliency planning and security controls are appropriate to our exposures to system outages, service interruptions, security incidents and breaches, our information technology systems remain vulnerable to attacks by increasingly sophisticated actors who attempt to cause harm to, or otherwise interfere with, the normal use of our systems. Like other companies with international operations, we have been subjected to targeted and non-targeted attacks and other cyber incidents and continue to face numerous cybersecurity threats on a regular basis, including regular attempts to penetrate our information technology infrastructure and breaches of our security systems by our employees, both accidental and intentional. Our suppliers, contractors, service providers, and other third parties with whom we do business also experience cyber threats and attacks that are similar in frequency and sophistication. Moreover, in many cases, the Company relies on controls put in place by our suppliers, contractors, service providers, and other third parties to defend against and otherwise respond to cyber threats and attacks, which may prove insufficient.

companyName: Sotera Health Co

ticker: SHC


text: Our team of experienced cybersecurity professionals has primary responsibility for our overall cybersecurity risk management program, including assessing and managing material risks from cybersecurity threats. Our CISO, Mark Schertler, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Schertler has over 40 years of experience in the field of cybersecurity. Mr. Schertler leads a team of experienced cybersecurity professionals who have extensive experience in the field of cybersecurity, including experience in cybersecurity consulting, cloud security, security architecture, application security and serving as a chief technology officer.

companyName: Intapp, Inc.

ticker: INTA


text: We design and assess our cybersecurity risk management program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") – i.e., we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business, but our use of the NIST CSF as a guide does not mean that we meet the particular technical standards, specifications, or requirements of all of the NIST CSF.

companyName: REDWOOD TRUST INC

ticker: RWT


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.

companyName: NEUROONE MEDICAL TECHNOLOGIES Corp

ticker: NMTC


text: We use service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources. We maintain a vendor management program designed to manage cybersecurity risks associated with our use of these providers. The program includes conducting a risk assessment or auditing for certain vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify, mitigate and manage cybersecurity risks associated with a particular provider.

companyName: Tvardi Therapeutics, Inc.

ticker: TVRD


text: Assessment of Cybersecurity Risk The potential impact of risks from cybersecurity threats to the Company is assessed on an ongoing basis. During the reporting period and through the issuance of this Annual Report on Form 10-K, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results, and financial condition. For additional information about cybersecurity risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.

companyName: Interactive Brokers Group, Inc.

ticker: IBKR


text: AEP has undertaken a variety of actions to monitor and address cyber-related risks. Cybersecurity and the effectiveness of AEP's cybersecurity processes are reviewed annually with the Board of Directors and at several meetings throughout the year with the Technology Committee of the Board, the principal committee that exercises oversight with respect to these matters. AEP's Chief Executive Officer and executive team participate in interactive threat briefings from AEP's Chief Security Officer and/or Chief Information & Technology Officer on a regular basis. AEP's strategy and procedure for managing cyber-related risks is integrated within its enterprise risk management processes. These procedures are designed to ensure that any material information regarding potentially relevant cyber incidents is elevated in a timely manner both to the appropriate leadership and, where applicable, to our external financial reporting and disclosure team. AEP's enterprise-wide security program continually adjusts staff and resources in response to the evolving threat landscape. The costs for such investments are material and have remained generally consistent over time, a pattern that is expected to continue. In addition, AEP maintains cyber liability insurance to cover certain damages caused by cyber incidents.

companyName: AEP Transmission Company, LLC


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology.

companyName: MADRIGAL PHARMACEUTICALS, INC.

ticker: MDGL


text: Key Management Personnel As disclosed above, the primary responsibility for our overall information security strategy and directive resides with our COO, Louis Swingrover, with reliance on our information security team. With over 25 years of cumulative experience in the field, our information security team brings a wealth of expertise to our organization. The team includes individuals with backgrounds in Information Technology, Data Science, Enterprise Applications, and Business Development. Their in-depth knowledge and expertise are instrumental in developing and executing our cybersecurity strategies.

companyName: ExchangeRight Income Fund


text: Peapack Private's Chief Information Officer, Chief Technology Officer, and Information Security Officer are accountable for managing and ensuring compliance with the Bank's information security program. Included in the responsibilities of this management team is the oversight and the administration of the cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience.

companyName: PEAPACK GLADSTONE FINANCIAL CORP

ticker: PGC


text: Our information technologies, system networks, information technology infrastructure, enterprise applications and financial reporting platforms are critical components of our operations. Our business operations rely on the secure processing, transmitting, collecting and storage of sensitive and confidential data. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats, as defined in Item 106 (a) of Regulation S-K.

companyName: Stabilis Solutions, Inc.

ticker: SLNG


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.

companyName: CONTINENTAL RESOURCES, INC


text: As of December 31, 2024, we've implemented a set of comprehensive cybersecurity and data protection policies and procedures. Our employees and contractors receive regular cybersecurity awareness trainings, including specific topics related to social engineering and email frauds. We have capable employees and consultants with significant expertise and certifications in cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as alert management of such attacks.

companyName: Tarsus Pharmaceuticals, Inc.

ticker: TARS


text: Chief Executive Officer and Chief Financial Officer are primarily responsible to assess and manage our material risks from cybersecurity threats. Chief Financial Officer oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy"

companyName: Bone Biologics Corp

ticker: BBLG


text: The Audit Committee of our Board of Directors receives periodic reports from the Vice President, Information Technology, concerning the Sangamo's significant cybersecurity threats and risk and the processes we have implemented to address them. The Board of Directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: SANGAMO THERAPEUTICS, INC

ticker: SGMO


text: We recognize the importance of protecting our information and our information technology systems, and assessing, identifying and managing cybersecurity-related risks have been integrated into our risk management processes. We focus on information technology and cybersecurity measures at both an enterprise-wide operational level and an individual employee level. We have in place various methods and levels of information technology and cybersecurity measures which are aimed at protecting our information and information technology systems to help secure long-term value for our stockholders and other stakeholders. By way of example, these measures include the following: • industry standard targeted controls and security frameworks, including the National Institute of Standards and Technology (NIST), to protect our environment, including antivirus, antimalware, multi-factor authentication, complex and regularly changed passwords, email security and firewalls to protect our assets and our ability to maintain operations; • use of technologies to help detect, identify and manage risks within our environments, including endpoint detect and response (EDR), security information and event management (SIEM) and vulnerability management; • a formal cybersecurity incident response plan designed to respond to security incidents in a systematic and complete manner, and involves senior executives, external technical, legal and other resources, including an incident response retainer with our third-party security operations center; • regularly monitoring and assessing our cybersecurity programs using external parties including a third-party security operations center, cyber maturity assessments, penetration tests and other targeted controls assessments; • central systems backup processes and associated disaster recovery plans; • membership in an information sharing and analysis center (FS-ISAC) so that we may stay informed about challenges specific to the financial services industry and contribute to the overall cybersecurity community; and • employee training and awareness programs addressing cybersecurity and data privacy challenges we face in our industry.

companyName: TWO HARBORS INVESTMENT CORP.

ticker: TWO


text: Management takes several steps intended to mitigate the impact of cybersecurity and information security risks and incidents, including an annual management risk assessment (including cybersecurity risk), continued enhancement of information security and data loss prevention controls, maintenance of a robust crisis response plan, engaging an external consultant (described above), and ensuring that the Company maintains cybersecurity insurance coverage deemed appropriate. Management oversight procedures include: (i) a methodology to ensure cybersecurity events are promptly escalated and that appropriate internal and external reporting occurs; (ii) a monthly Information Security Governance Council meeting with site IT managers; and (iii) quarterly meetings between senior executives and our Internal Audit department to discuss the outlook for the following year, focusing on the current risk environment.

companyName: CELESTICA INC

ticker: CLS


text: We utilize a set of third parties for technical and non-technical evaluation of our security posture, including regular assessment of our products for vulnerabilities. We also perform an annual external "red team" assessment that provides an attack simulation for our security operations team to identify and triage.

companyName: TRIMBLE INC.

ticker: TRMB


text: Our business strategy, results of operations or financial condition have not been materially impacted by cybersecurity threats, including as a result of any previous cybersecurity incidents. Although we cannot predict the cybersecurity incidents we may face in the future, we believe we have implemented reasonable cybersecurity protections and do not have reason to believe our business strategy, results of operations or financial condition will be materially impacted by cybersecurity incidents in the future. For a discussion of risks from cybersecurity threats, please see "Item 1A. Risk Factors."

companyName: Sterling Real Estate Trust


text: Chief Executive Officer and Chief Financial Officer oversee our cybersecurity processes, including those described in "Risk Management and Strategy" above. The cybersecurity risk management program includes tools and activities to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents.

companyName: IMAC Holdings, Inc.

ticker: BACK


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see Part I, Item 1A- Risk Factors in this Annual Report on Form 10-K.

companyName: Eos Energy Enterprises, Inc.

ticker: EOSE


text: To inform our incident detection and response process, our cyber intelligence operations team regularly performs exercises to simulate real threat scenarios that would be carried out by a perpetrator by utilizing the actual tools and methodologies that would be deployed in such an attack (so called "red team" activities).

companyName: EQUIFAX INC

ticker: EFX


text: Our CISO is also responsible for reporting on the status of our information security program and related efforts and processes to Company senior management periodically, and to the Audit Committee on a quarterly basis. In addition, our CISO reports cybersecurity matters to Company senior management and the Audit Committee on an as-needed basis. At each regularly scheduled meeting of our board of directors, the Chair of our Audit Committee provides quarterly updates regarding significant matters discussed, reviewed, considered and approved by the committee since the last regularly scheduled board meeting (including cybersecurity matters, as and if applicable), as well as timely updates outside of quarterly updates on an as needed basis. Lastly, our CISO promptly informs Company management and our Audit Committee of cybersecurity incidents that meet established reporting thresholds or when otherwise determined appropriate, as well as provides ongoing updates regarding such incidents until they have been resolved.

companyName: IAC Inc.

ticker: IAC


text: Our cybersecurity processes are based on the cybersecurity standards set by the Center for Internet Security and the National Institute of Standards and Technology ("NIST"). We regularly engage outside assessors and consultants to identify potential cybersecurity risks and suggest best practices.

companyName: STEELCASE INC


text: The Company has cybersecurity insurance designed to cover certain expenses relating to cybersecurity incidents. The Company also carries other insurance that may cover ancillary aspects of a cybersecurity incident; however, damage and claims arising from a cybersecurity incident may exceed the amount of any insurance available.

companyName: KITE REALTY GROUP TRUST

ticker: KRG


text: conduct regular email phishing campaigns for Company employees to evaluate employee responses to such campaigns, identify vulnerabilities and advise on possible attack preparedness and responses;

companyName: Green Brick Partners, Inc.

ticker: GRBK


text: Information security, including cybersecurity, is the risk of unauthorized access, use, disclosure, disruption, modification, recording or destruction of the firm's information or systems. As a large company in the financial services industry, we do business with a large number of clients, counterparties, and third-party service providers, and the nature of Schwab's business involves the secure processing, storage, and transmission of confidential information about our clients and us. We process, record, and monitor a high volume of transactions, and our operations are highly dependent on the integrity of our technology systems. As a result, we face extensive cybersecurity risks. It is through a combination of specialized internal and external teams, coupled with security software tools, that Schwab identifies, assesses, and manages material cybersecurity risk, and implements and enhances over time our cybersecurity policies, procedures, and strategies to reduce risk. We also maintain processes and procedures for identifying and investigating cybersecurity threats and remediation should an incident occur. Though the impact of prior cybersecurity events experienced by the Company has not been material to the Company's strategy, results of operations, or financial condition, we continue to face increasing cybersecurity risks.

companyName: SCHWAB CHARLES CORP

ticker: SCHW


text: Role of Management Company management has established a Cybersecurity Governance Committee that is comprised of the Information Technology Manager and senior members of management. The Committee meets periodically to discuss cybersecurity program updates and challenges, watch for potential threats from both external and internal sources, monitor compliance in existing or emerging business practices, and respond to stakeholder inquiries. The Information Technology department is comprised of professionals with extensive expertise and led by its manager with over 20 years of experience in network security, cybersecurity and enterprise risk management. The manager is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: These assessments are used to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. Our program leverages industry standards and frameworks and is designed to protect the confidentiality, integrity, and availability of our information assets and systems.

companyName: Tectonic Financial, Inc.

ticker: TECTP


text: The CISO, who reports to the Chief Information Officer (CIO), is the management position with primary responsibility for the development, operation, and maintenance of our information security program. The CISO has been with the Company for 40 years, is a certified CISSP, CRISC, and CIPM and oversees a team of experienced individuals. In addition to the working committee meetings described above, the CISO and CIO meet regularly with the Company's President and with other members of senior management to review the current state of the cybersecurity program and emerging threats to the Company.

companyName: DILLARD'S, INC.

ticker: DDS


text: Training and Awareness We train our users throughout the year using a wide variety of methods on cybersecurity-related topics, including how to identify and report potential social engineering including phishing through emails, text messages and phone calls. Formal training on cybersecurity practices begins when an employee is hired and is re-administered annually. We also require third-party contractors with access to our systems be trained on these topics. In addition, special training is held both formally and informally for groups that entail higher threat risks.

companyName: Antero Midstream Corp

ticker: AM


text: Operational Leadership and Incident Response Our Vice President of Information Technology, or VP of IT, leads company-wide cybersecurity strategy, policy, standards, and processes. This role includes working across departments to assess and address cybersecurity risks and participating in management's updates to the Audit Committee.

companyName: Voyager Therapeutics, Inc.

ticker: VYGR


text: Our information security processes are overseen by our IT Manager, Chief Accounting Officer, and Chief Financial Officer, and are supported by a cybersecurity monitoring service provider, who works to help identify, assess, and manage the Company's cybersecurity threats and risks. Our IT Manager, as well as our service provider, work to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including, for example, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging a third-party vendor to audit our security protocols in certain systems, and deploying automated monitoring tools across certain systems. Depending on the environment and system, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response policy, risk assessments, network security controls for certain environments, periodic back-ups of certain data, access controls for certain environments, employee training addressing awareness of cyber risks and how to detect certain cyberattacks, and cybersecurity insurance.

companyName: NETSTREIT Corp.

ticker: NTST


text: Our management team, including our Chief Legal Officer and Head of Operations and external IT consultants, is responsible for assessing and managing our material risks from cybersecurity threats. Our Chief Legal Officer is a former federal prosecutor and deputy chief of cybercrime in the U.S. Attorney's Office for the Eastern District of Virginia, as well as a former law firm partner conducting and overseeing investigations, prosecutions, and cases relating to cybercrime, hacking, trade secrets, large-scale identity theft, national security, data breaches, and related cybersecurity and data privacy matters. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience, in close cooperation with external IT consultants, includes significant experience of leading and managing IT infrastructure and security operations teams for various sized global companies across several different industries.

companyName: Unity Biotechnology, Inc.


text: Cybersecurity incidents may be detected through a variety of means and indicators, which may include, but are not limited to, alerts from customers, employees, vendors, service providers, other third parties, and/or automated event-detection notifications. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response coordinator follows the procedures pursuant to the CSIRP to investigate the potential incident, including classifying the nature and severity of the event.

companyName: Brixmor Property Group Inc.

ticker: BRX


text: Board Oversight and Governance We have implemented processes, to help facilitate oversight of information security risks by Corebridge's senior management and Board of Directors. These processes enable our operations and risk management functions that monitor cybersecurity risks and examine control performance to report and escalate cybersecurity risks to our senior management and the Board of Directors, as appropriate.

companyName: Corebridge Financial, Inc.

ticker: CRBG


text: Depending on the environment, we are in the process of implementing various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident response plan, incident detection, vulnerability management policy, network security controls, access controls, physical controls, systems monitoring, vendor risk management program, employee training, penetration testing, systems monitoring.

companyName: SunPower Inc.

ticker: SPWR


text: The Audit Committee receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. On a quarterly basis, the Audit Committee discusses the Company's approach to cybersecurity risk management with the Company's CSO and Company management. This discussion may include reports on cybersecurity risks, which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties.

companyName: Upland Software, Inc.

ticker: UPLD


text: Cybersecurity and risks related to our information technology ("IT") are an important focus of our Board of Directors' risk oversight. Our Board of Directors, with assistance from the Audit Committee, oversees the Company's enterprise risk management process, which includes cybersecurity risk management. The Audit Committee, a member of which holds a Certificate in Cyber Risk Governance and a Qualified Risk Director designation from the DCRO Institute, receives regular reports from our Chief Information Officer ("CIO"), along with members of senior management, on the identification and status of cybersecurity risks and management.

companyName: TUTOR PERINI CORP

ticker: TPC


text: To help identify and assess risks, we and our Former Manager engage third-party advisors, leveraging standards such as the National Institute of Standards and Technology security framework ("NIST"). The results of these assessments inform the development of cybersecurity controls and risk mitigation strategies, which are then implemented throughout the Company.

companyName: FTAI Aviation Ltd.

ticker: FTAI


text: Further, we use third-party service providers to perform a variety of functions throughout our business, such as software-as-a-service providers, data hosting companies, contract research organizations, and contract manufacturing organizations. We have certain vendor management processes designed help to manage cybersecurity risks associated with our use of these providers. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management processes may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, security questionnaires and the imposition of contractual obligations related to cybersecurity on the provider.

companyName: HOOKIPA Pharma Inc.

ticker: HOOK


text: Our cybersecurity program is integrated with the enterprise risk management framework and governance processes utilized by management and our board to oversee enterprise risk. Our board of directors has delegated oversight of cybersecurity risk to the risk oversight and sustainability committee to assist in fulfilling its oversight responsibilities with respect to management's identification, prevention, evaluation, management, and monitoring of our critical enterprise risks. The risk oversight and sustainability committee receives quarterly updates from our Head of Global IT or counsel regarding cybersecurity, including updates regarding recent cybersecurity incidents in the industry and the cybersecurity threat landscape, and is notified between such updates regarding significant new cybersecurity incidents, as appropriate. The board of directors receives regular reports from the risk oversight and sustainability committee.

companyName: KADANT INC

ticker: KAI


text: As discussed below, members of management report to the Audit Committee which reports to the entire Board about cybersecurity threat risks, among other cybersecurity related matters, at least annually.

companyName: NCR Atleos Corp

ticker: NATL


text: Our CIO is a member of our executive management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. Our CIO has over twenty-five years of extensive experience in information technology and security, and works in coordination with other members of the management team, including, among others, the Chief Financial Officer and Chief Compliance Officer and their designees. We believe our business leaders have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats.

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: In July 2023, the SEC adopted rules requiring the disclosure of material cybersecurity incidents. To ensure compliance with the SEC requirement, Cars Commerce has a review process to determine whether the impact of a cybersecurity threat is material and requires disclosure of the cybersecurity incident. In compliance with the SEC rule and Cars Commerce's process, if such a cybersecurity incident occurs and the appropriate representatives from the Information Security Governance Committee determine that the cybersecurity incident is material, Cars Commerce will make the appropriate disclosures in a Current Report on Form 8-K within the required timeframe.

companyName: Cars.com Inc.

ticker: CARS


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Our internal computer systems, or those of our contract research organizations or other contractors or consultants, may fail or suffer cybersecurity incidents, which could result in a material disruption of our product development programs, and could subject us to liability," which disclosures are incorporated by reference herein. In the last three fiscal years, we have not experienced any material cybersecurity incidents.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: Pursuant to its charter, the Audit Committee of the Board of Directors (the "Board") has oversight of the Company's information security program, including, but not limited to, risks regarding cybersecurity threats. In particular, the Audit Committee reviews with management the Company's key IT Systems and evaluates the adequacy of the Company's information security program, compliance, and controls.

companyName: Dorman Products, Inc.

ticker: DORM


text: The secure collection, maintenance, processing and transmission of financial and operational data, ordering, point-of-sale processing and payment information, including personal data, is critical to our operations and the experience of our customers. We have implemented technologies and tools to evaluate our cybersecurity measures and maintain a cyber-risk management strategy related to our technology infrastructure that includes monitoring emerging cybersecurity threats and assessing appropriate responsive measures.

companyName: Aramark

ticker: ARMK


text: Our CISO is well-qualified in the area of cybersecurity and data protection. These qualifications include: (i) 23 years of experience in cybersecurity, security risk management and IT auditing; (ii) the designation of Certified Information Systems Security Professional ("CISSP"); and (iii) a Bachelor's degree in Computer Information Systems. Our CISO also previously held the Certified Information Systems Auditor ("CISA") and Certified in Risk and Information Systems Controls ("CRISC") certifications.

companyName: CNO Financial Group, Inc.

ticker: CNO


text: Our chief information security officer, who reports both to our chief risk officer and our chief information officer, manages the cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of our information technology assets and data under our control. Our chief information security officer has approximately six years of experience with the FHLB in successively more responsible roles and has led teams to design, secure, implement, and audit numerous technology solutions. Our information security group is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by the Board and management committee. They are experienced and knowledgeable in both technology and cybersecurity and maintain industry recognized security certifications.

companyName: Federal Home Loan Bank of Cincinnati


text: As part of its oversight of the Company's overall risk management, the audit committee is periodically updated by our CFO concerning cybersecurity threats and risks and the processes the Company has implemented to address them.

companyName: Y-mAbs Therapeutics, Inc.


text: We design and assess our program based on recommendations from trusted sources, such as the National Institute of Standards and Technology and the Center for Internet Security, as well as information security standards issued by the International Organization for Standardization, including ISO 27001. In 2024, our cybersecurity systems and processes achieved ISO 27001 certification. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Seer, Inc.

ticker: SEER


text: Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are directed by the Head of IT in consultation with the legal team and our third-party security advisor. Currently, the Head of IT role is held by an individual who has over 20 years of information technology experience. The Head of IT reports to the Chief Legal Officer.

companyName: NEKTAR THERAPEUTICS

ticker: NKTR


text: The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended. We utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks and events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: Uniti Group LLC


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the Head of IT who reports to our Vice President of Finance, to manage the risk assessment and mitigation process.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Chief Information Officer ("CIO"), who is responsible for management of our Information Technology program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments.

companyName: OXBRIDGE RE HOLDINGS Ltd

ticker: OXBR


text: The Company employs a tiered structure of management and oversight for cybersecurity, characterized by distinct layers of responsibility and decision making, which includes operation staff, management, and senior management and board-level governance. As discussed in more detail below under "Cybersecurity Governance," this involves management responsibility through a specialized Cyber Risk Committee (the "CRC") and oversight of that committee by a group of the most senior leaders of the Company, which comprise the Company's Executive Committee. At the Company's Board of Directors (the "Board") level, the Audit Committee oversees our cybersecurity risk management program.

companyName: REGENCY CENTERS LP