text: These cybersecurity threats and related risks make it imperative that we expend resources on cybersecurity. The Board and/or our Audit Committee oversee our cybersecurity risk exposures and the steps taken by management to identify, monitor and mitigate cybersecurity risks to align our risk exposure with our strategic objectives. With respect to such cybersecurity risk oversight, the management will report to the Board and/or Audit Committee on incidents of material cybersecurity risks facing us and any third parties and the measures that may be taken to mitigate such risks. In addition to such reports and updates, the management will provide updates to our Board and/or our Audit Committee as to changes to our cybersecurity risk profile or certain newly identified risks. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident identification, mitigation, recovery and notification to legal counsel, senior leadership and the Board or Audit Committee, as appropriate.

companyName: TLGY ACQUISITION CORP

ticker: TLGYF


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which includes periodic "phishing" testing; • intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior; • access management and access controls which aim to implement "least privilege" access; • protection of sensitive data through "at rest" and "in transit" encryption; • industry-standard monitoring and protection software; • a defined vulnerability management program; • periodic cybersecurity assessments, including with the support of independent third-party consultants; • developing plans for recovering from security incidents and maintaining business continuity in the face of cyberattacks; and • a cybersecurity incident response plan that provides controls and procedures to support timely and accurate reporting of cybersecurity incidents.

companyName: Strategic Education, Inc.

ticker: STRA

secItem: Item 1C


text: The Exelon Board of Directors is responsible for oversight of risks from cybersecurity threats. As part of its responsibility and as documented in the 2022 Cybersecurity Oversight Policy, the Board of Directors oversees Exelon's cybersecurity program and Exelon's enterprise-wide risk related to cybersecurity, including management's identification, assessment, and mitigation of cybersecurity risks. At each regular quarterly meeting, the Board of Directors engages with the CISO and a cross-functional management team regarding the risks from cybersecurity threats. The CISO and professionals from the legal and compliance departments brief the Board of Directors on relevant topics, including information security and operational security, legislative and regulatory developments, and notable external cyber events relevant to Exelon and the industry more broadly. Management engages with the Board of Directors on risks from cybersecurity threats as appropriate outside of the quarterly meetings.

companyName: EXELON CORP

ticker: EXC


text: These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: Foxx Development Holdings Inc.

ticker: FOXX


text: In doing so, our Information Security Team, which is comprised of dedicated privacy and security professionals and run by our Chief Information Security Officer ("CISO"), stays abreast of security industry and threat trends and regularly seeks to improve our cybersecurity risk management program. Our executive leadership team, with input and guidance from our CISO, is responsible for our overall enterprise risk management system and processes, and regularly considers cybersecurity risks in the context of other material risks to the Company. Our CISO, who has over 15 years' experience in cybersecurity and 30 years' experience in software engineering, design, and development, has been with the Company for more than ten years and has helped grow the Company's Information Security Team into its current mature form.

companyName: BENTLEY SYSTEMS INC

ticker: BSY


text: Furthermore, we have established an organizational unit within the legal and compliance department that provides independent compliance testing and review for our regulatory obligations, industry standards, and policies and procedures. It supports the IT and cybersecurity department by conducting formal assessments of compliance measures, consulting on control development and enhancement, and facilitating third-party assessments.

companyName: ONE Gas, Inc.

ticker: OGS


text: The Risk & Compliance Committee receives regular updates on cybersecurity risks and incidents and the cybersecurity risk management program through direct interaction with the Chief Information Officer and provides periodic updates regarding cybersecurity risks and the cybersecurity risk management program to the full Board of Directors. Our Chief Information Officer has significant experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.

companyName: MVB FINANCIAL CORP

ticker: MVBF


text: This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company.

companyName: Novo Integrated Sciences, Inc.

ticker: NVOS


text: We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk are incorporated into our comprehensive Enterprise Risk Management ("ERM") program, which we use to identify, aggregate, monitor, report, and manage risks.

companyName: STIFEL FINANCIAL CORP

ticker: SF


text: We have processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.

companyName: TPG Inc.

ticker: TPG


text: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional description of cybersecurity risks and potential related impacts on us, refer to the risk factors captioned "Our use of information technology and third-party service providers exposes us to cybersecurity breaches and other business disruptions that could adversely affect us" and "The use of information technology by our third party commercial partners and service providers exposes us to business disruptions or other negative impacts that could adversely affect us" in Item 1A, Risk Factors, in this Annual Report on Form 10-K.

companyName: Keurig Dr Pepper Inc.

ticker: KDP


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional service firms, threat intelligence service providers, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and forensic investigators.

companyName: CERUS CORP

ticker: CERS


text: Role of Management Our information security management team oversees the design, implementation, and maturation of security practices to protect critical business processes, information systems and information technology assets across our enterprise. Management is primarily responsible and accountable for the awareness, oversight and control of enterprise information security and the implementation of cybersecurity policies, procedures, and strategies. Our information security and risk assessment teams regularly communicate to management the effectiveness and efficiency of our information security program's risk management processes. Management reviews such assessments, reports any potential threats and vulnerabilities and responds accordingly, including by providing regularly scheduled reports and escalating items, as necessary, to the Disclosure Committee and the Board's Risk Committee.

companyName: PRA GROUP INC

ticker: PRAA


text: Cybersecurity incidents meeting certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.

companyName: CoreCivic, Inc.

ticker: CXW


text: We have developed and maintain a cybersecurity risk management program, consisting of cybersecurity policies, procedures, compliance and awareness programs to mitigate risk and to ensure compliance with security, availability and confidentiality trust principles. The cybersecurity process has been integrated into our overall risk management system and process, and is solely internally managed.

companyName: My Size, Inc.

ticker: MYSZ


text: The Audit Committee receives regular reports from our VP of Information Technology on our cybersecurity risks. In addition, our VP of Information Technology updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.

companyName: Seer, Inc.

ticker: SEER


text: We intend to use a cross-functional approach to identifying, preventing, assessing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of cybersecurity incidents and support appropriate public disclosure and reporting of incidents as required in a timely manner.

companyName: Trio Petroleum Corp

ticker: TPET


text: We consider cybersecurity, along with other top risks, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. We have implemented a robust cybersecurity program that employs various controls and activities aimed at identifying, protecting against, detecting, and responding to cybersecurity threats. These controls, including endpoint and network monitoring, endpoint protection, and network security measures, safeguard our assets from unauthorized access and attacks. We prioritize data protection through data classification and access management designed to permit access only by authorized personnel. Our cybersecurity incident response plan, integrated into the enterprise risk management framework, outlines a structured process for handling cybersecurity incidents involving assets or data. It guides our cybersecurity incident response team in containing, eradicating, and recovering from incidents while minimizing damage and disruption. The plan includes a clearly defined notification framework for timely communication to relevant parties, that may include our management team, Board of Directors and Audit Committee, based on the incident's severity and potential impact. Controls and related activities are designed taking into consideration recognized third party cybersecurity frameworks.

companyName: STARWOOD PROPERTY TRUST, INC.

ticker: STWD


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents and recommend mitigating actions. Despite our best efforts, no security measure is entirely foolproof. In the event of a cybersecurity incident, we utilize a range of standard incident response practices to attempt to identify, analyze, contain, and recover the event with the goal of minimizing the impact and restoring normal operations. We require that our employees receive periodic cybersecurity trainings including phishing campaigns and general awareness campaigns.

companyName: Select Water Solutions, Inc.

ticker: WTTR


text: Our cybersecurity risk management program includes: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; and • cybersecurity awareness training of our employees and senior management.

companyName: Evoke Pharma Inc

ticker: EVOK


text: Our cybersecurity risk management and processes are led by our Vice President, Finance and Administration, with support of management, internal personnel and third-party providers. While management is responsible for the day-to-day management of cybersecurity risks, our Board of Directors, through its Audit Committee, has oversight of the Company's processes, policies and procedures for assessing, identifying, and managing material risks from cybersecurity threats including the integration and establishment of cybersecurity processes into the Company's overall risk management system or processes. On a quarterly basis, our VP Finance and Administration, presents necessary updates on our cybersecurity and other information technology risks that may affect us.

companyName: IntelGenx Technologies Corp.


text: The ISO has over 15 years of experience in cybersecurity, and such expertise is primarily related to cybersecurity assurance, compliance, digital forensics, investigations, process design and collegiate instruction. The ISO also holds various certifications in areas relevant to cybersecurity risk monitoring, including, a master's degree in IT security, a bachelor's degree in criminal justice with a minor in business administration, and certifications in IT, cell phone, and mobile device forensics. The ISO, working together with the Company's Chief Information Officer and Chief Risk Officer, handles the development and implementation of the Information Security Policy and Program and, together with the Company's information technology staff and third-party vendors and other outside resources, the ISO monitors the Company's information technology systems for threats and implements changes to those systems in an effort to protect the systems from attack. The ISO also coordinates the risk assessment process, facilitates annual employee training, and prepares an annual report to the Company's board of directors that contains a summary of any cybersecurity incidents occurring during the report year, and an analysis of the results of the Information Systems Audit and the Company's performance against the Information Security Policy and Program. The ISO reports directly to the Bank's Chief Risk Officer, independent of the Company's technology department, and the responsibilities of this role are in conjunction with security, fraud and other special projects concerning risk and operational issues identified. The Bank's Chief Risk Officer reports directly to the Chief Executive Officer.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate and respond to cybersecurity threats. This program, in conjunction with our enterprise risk management assessment processes, addresses cybersecurity risks to the corporate information technology, or IT, environment including systems, hardware, software, data, people and processes.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: We are committed to safeguarding the personal information of our customers and potential customers as well as our own sensitive data and information. The full Board of Directors (the "Board") is responsible for the Company's general risk oversight, including cybersecurity and data privacy risks. Members of the Company's senior management also have day-to-day responsibility for risk management and establishing risk management practices. The Board oversees senior management in their risk management capacities, regularly reviewing and analyzing the Company's risk levels and reviewing and analyzing inventory risk each quarter as part of their review of quarterly financial statements. Members of the Company's senior management have an open line of communication to the Board and have the discretion to raise issues from time-to-time in any manner they deem appropriate.

companyName: URBAN OUTFITTERS INC

ticker: URBN


text: Activities to assess vulnerabilities including penetration testing, red teaming, tabletop exercises, and phishing and social engineering drills Engagement with law enforcement and U.S. government agencies, directly and through memberships in various cybersecurity intelligence and risk sharing organizations to help us stay informed about evolving threats Utilization of third-party experts to test, validate, and strengthen our plans, practices, and policies Technology team collaboration sessions to share information across different teams, geographic areas, and areas of responsibilities Assessing and managing cybersecurity risks arising out of the use of third-party technology and services, including pre-contract diligence, imposition of contractual obligations, and performance monitoring Learnings from these activities are used to inform our training, guide our incident response preparedness and enhance our plans and processes. We have also participated in discussions with third-party service providers who have experienced cybersecurity incidents to inform our cybersecurity program.

companyName: CONAGRA BRANDS INC.

ticker: CAG


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Vice President, Digital and Information Technology, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Verona Pharma plc

ticker: VRNA


text: Stewart takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks that could affect Stewart's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based upon their potential impact and likelihood. Risk mitigation strategies are developed and implemented based upon the specific nature of each cybersecurity risk. These strategies include the application of cybersecurity policies, procedures, and technologies, and employee training, education, and awareness. Additionally, Stewart's cybersecurity program provides mechanisms for employees to report any unusual or potentially malicious activity.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through our audit committee.

companyName: Absci Corp

ticker: ABSI


text: Our executive management team, including our Chief Executive Officer and Chief Financial Officer, works with our information technology security team to assess and manage our overall risk exposure. The Audit Committee of our Board of Directors oversees those efforts and receives reports from the executive management team periodically, as appropriate.

companyName: FERRELLGAS PARTNERS FINANCE CORP


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer cyberattacks or other security breaches, which could have a material adverse effect on our business, results of operation, and financial condition, and result in a material disruption of our product development programs."

companyName: Oncternal Therapeutics, Inc.


text: We also run regular cybersecurity exercises, such as penetration tests, to test the effectiveness of our controls. We use the results of these exercises to identify, evaluate, and prioritize potential areas of improvement through the InfoSec Roadmap.

companyName: RECURSION PHARMACEUTICALS, INC.

ticker: RXRX


text: Although there can be no assurance, that our cybersecurity program will prevent all incidents. In the event of a cybersecurity incident, we have established procedures for prompt investigation, containment, and remediation to minimize the impact on our operations and stakeholders. We believe that our cybersecurity program is robust and effective, and we will continue to invest in and improve our capabilities to address evolving threats. We are committed to transparency and will provide updates on any material cybersecurity incidents that may impact our company or our stakeholders.

companyName: IGC Pharma, Inc.

ticker: IGC


text: Data and information systems are a key part of how the Company delivers value to its customers, employees and stakeholders, and the Company's cybersecurity program is committed to protecting its customers, employees, partners, infrastructure and systems. The Company's cybersecurity program and approach is overseen by its Board of Directors, in coordination with the Audit Committee, and Senior Leadership, along with its Senior Director of Global Information Technology Operations and Infrastructure who has expertise around global cybersecurity matters. The Board of Directors receives annual reports from Senior Leadership on the Company's cybersecurity risks. In addition, Senior Leadership updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents. The Board of Directors and Senior Leadership review the strategy, tools, metrics and latest trends affecting cybersecurity and utilizes the National Institute of Standards and Technology (NIST) Cybersecurity Framework as the foundation for its cybersecurity strategy and approach. Third parties are engaged to assess the Company's cybersecurity posture and adherence to the NIST Cybersecurity Framework, and the Company evaluates cybersecurity risks as part of its annual risk assessment process. Cybersecurity risk mitigation strategies and initiatives are developed based on these assessments. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment, and then reported to designated members of Senior Leadership.

companyName: FRANKLIN ELECTRIC CO INC

ticker: FELE


text: The vCIO issues quarterly reports and reports to the CFO, as appropriate, to provide updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Our Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and has established oversight mechanisms to ensure effective governance in managing these risks. The Audit Committee is central to the Board's oversight and has been directed to assume primary responsibility for such oversight by the Board. The Audit Committee is comprised of board members with diverse experience including risk management, technology and finance, which, in the judgment of the Board, equips them with the ability to oversee cybersecurity risks effectively. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance to our management and approval of major initiatives.

companyName: FTC Solar, Inc.

ticker: FTCI


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors —Risks Related to Our Technology and Our Platform" in this annual report on Form 10-K.

companyName: Katapult Holdings, Inc.

ticker: KPLT


text: Management Oversight Day-to-day management of cybersecurity threats is conducted by our information technology consultant which is charged with identifying and reporting threats to senior management. The Board of Directors is responsible for oversight of management's efforts to eliminate cybersecurity risks.

companyName: SOLESENCE, INC.

ticker: SLSN


text: • Our CTO and CISO lead our management of cybersecurity risks. Our CTO and CISO have a combined over 50 years of experience in managing large company technology operations and extensive expertise in the management of cybersecurity defense. • The CTO holds an undergraduate degree in computer science and a master's degree in business administration and has served in various roles in information technology for over 27 years, including serving as either the Chief Technology Officer or Chief Information Officer of large companies. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of large companies. The CISO holds a CISSP certification and spent several years in law enforcement addressing computer crimes. • Our technology group management uses numerous processes to become informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Management regularly reviews the Company's cybersecurity risk management program with the Board, Audit Committee and Compliance and Quality Committee.

companyName: agilon health, inc.

ticker: AGL


text: Our Board of Directors oversees overall cybersecurity risk and strategy, and the Audit Committee of the Board of Directors oversees information security compliance as part of its broader compliance oversight mandate. Together, this ensures that the Board of Directors has a comprehensive view of the Company's cybersecurity risk profile and framework. The Board of Directors and its Audit Committee include directors with knowledge, skills, and cybersecurity and information technology experience.

companyName: Hillenbrand, Inc.

ticker: HI


text: Our cybersecurity risk management program focuses on the following key areas: • Technical Safeguards. We utilize technical safeguards that are designed to protect our assets from cybersecurity threats. These safeguards include firewalls, intrusion prevention and detection systems, Managed Detection and Response, antimalware and access controls solutions, which we evaluate and improve through security assessments and threat intelligence. • Incident Response and Recovery Planning. We have established and maintained incident response and recovery plans that address how we respond to cybersecurity incidents, and we test and evaluate these plans on a regular basis. • Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including software and services vendors, Territory Partners and other external users of our systems and those of third parties that could adversely impact our business in the event of a cybersecurity incident. • Education. We provide regular, mandatory training for all team members regarding general security concepts, cybersecurity, and physical threats. The training is designed to equip team members to identify and properly respond to a variety of cybersecurity threats and risks, as well as to communicate our processes. • Governance. We maintain a management Risk Committee that assists with our ERM function. We also utilize a virtual Chief Information Security Officer ("vCISO") and other members of senior management and our IT team to support our risk management program. Our board of directors receives regular reports regarding our ERM function to support its oversight responsibilities, and we ensure our business units receive appropriate updates that may impact operations. • Collaboration. Our processes are designed to identify, prevent, and mitigate cybersecurity threats and incidents and provide for prompt escalation when appropriate. This approach is cross-functional, drawing on the skills and experiences of our diverse team, and it is designed to allow management to make timely decisions regarding public disclosure and business matters.

companyName: TRUPANION, INC.

ticker: TRUP


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our CFO, Mr. William McCombe. Mr. McCombe has experience in the security of both corporate and technical systems as well as business continuity planning in previous roles at various companies.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: Risk Management & Strategy Innospec has strategically integrated cyber security risk management into its broader risk management framework to promote a company-wide culture of cyber security risk management. This integration ensures that cyber security considerations are an integral part of our decision-making processes at every level. For example, training on cyber security risks was required of all Innospec directors and employees who have access to our information technology resources. Our risk management team works closely with our Information Technology ("IT") leadership to continuously evaluate and address cyber security risks in alignment with our business objectives and operational needs.

companyName: INNOSPEC INC.

ticker: IOSP


text: As we are a company that leverages data, technology and analytics to improve health care, we invest in long-term solutions to address current and foreseeable risks and threats to data security and privacy, while also enabling technological development that enhances the member experience. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats that is aligned with the National Institute of Standards and Technology framework. This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments. Assessment of cybersecurity risk is part of our overall enterprise risk management ("ERM") process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.

companyName: MGP INGREDIENTS INC

ticker: MGPI


text: Our systems and those of third parties with which we do business have experienced and may continue to experience directed attacks intended to lead to interruptions and delays in our service and operations as well as loss, misuse or theft of personal information (of third parties, employees, and our members) and other data, confidential information or intellectual property, and we have experienced unauthorized releases of certain digital content assets and unintended disclosure of personal information due to incidents related to third parties. However, to date these incidents have not had a material impact on our service, systems or business. Any significant disruption to our service or access to our systems could result in a loss of members and adversely affect our business and results of operation. Further, a penetration of our systems or a third-party's systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations. See "Risk Factors - Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized access, disclosure or destruction of data, including member and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."

companyName: NETFLIX INC

ticker: NFLX


text: BHE's Board of Directors has delegated responsibility for oversight of BHE's cybersecurity risk management program to its Executive Committee, consisting of BHE's Chief Executive Officer, who is a management member of the BHE Board of Directors, and the BHE Chief Financial Officer and General Counsel, who are not management members of the BHE Board of Directors.

companyName: BERKSHIRE HATHAWAY ENERGY CO


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. The Company takes very seriously the responsibilities to protect sensitive client information, technology resources, and shareholder value from the risk of cyber threats and incidents. The Company has not identified risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, financial condition or results of operation. Risks relating to cybersecurity and their potential impact are discussed more fully in "Risk Factors" in Part I, Item 1A herein.

companyName: LINKBANCORP, Inc.

ticker: LNKB


text: A third -party security firm provides training to our employees, helping our information technology team to maintain a state-of-the-art cybersecurity system and staying up to date on the latest threats and counter measures available. The third -party security firm places a high priority on employee threat education through automated internal phishing tests. Our information technology team attends continuing education seminars and receives timely alerts to any new viruses or cyber threats as they occur as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.

companyName: BIMINI CAPITAL MANAGEMENT, INC.

ticker: BMNM


text: We employ an in-depth, layered, defensive strategy that embraces a "trust by design" philosophy when designing new products, services, and technology. We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls. We also employ a variety of tools and processes to identify, protect against, detect, respond, recover from, and govern cybersecurity risks and threats. We have tools configured to block, prevent, detect, and monitor for suspicious activity providing real time monitoring and alerts for anomalous and nefarious activity, as well as advanced persistent threats. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain. We actively monitor our email traffic for malicious phishing email campaigns, provide ongoing training for employees to help them detect possible malicious emails and monitor remote connections. We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our Information Security Program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

companyName: ServisFirst Bancshares, Inc.

ticker: SFBS


text: The Program is situated within the Company's information security department, which is comprised of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security. The information security department is led by the chief information security officer, who has primary responsibility for managing the Program. The current chief information security officer has over 20 years of experience in information security, including a lead auditor certification from the International Organization for Standardization, an international standard for information security management systems.

companyName: LPL Financial Holdings Inc.

ticker: LPLA


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature (Information Systems and Data). Our Chief Operating Officer and our General Counsel help identify, assess and manage our material risks from cybersecurity threats. Along with our Chief Operating Officer and our General Counsel, a third-party information technology strategy and risk reduction vendor helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools, automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, internal audits, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds and coordinating with law enforcement as appropriate about certain threats.

companyName: Design Therapeutics, Inc.

ticker: DSGN


text: Our Vice President, Information Technology, has served in various roles in information technology and information security for over 20 years, the majority of which has involved leading IT transformation, cybersecurity and compliance programs at public companies. He holds an undergraduate degree in industrial engineering and an MBA and has attained multiple cybersecurity-related certifications including the Certified Information Systems Security Professional.

companyName: Hayward Holdings, Inc.

ticker: HAYW


text: Upon discovery of a cybersecurity incident, the identifying party immediately notifies the Company's CFO. The CFO activates the incident response plan to include the following: Gather preliminary information about the cybersecurity incident. notifies the CEO and the Board of Directors of the cybersecurity threat. CFO allocates resources for disclosure if determined to be a material cybersecurity event. CFO consults with cybersecurity consultants and other involved parties to identify the undesirable effects of the cybersecurity incident. CFO develops a recommendation for determination of materiality. disclosure is required, the material incident disclosure plan is executed by the CFO.

companyName: BLUE BIOFUELS, INC.

ticker: BIOF


text: • Our CIOs lead our internal Enterprise Security Council collectively representing ASGN and its Segments which reports to our Chief Executive Officer and the Board's Strategy and Technology Committee. These leaders bring a wealth of experience in security operations, business process re-engineering, software development, ERP systems, and the management of multinational wide area networks. Complementing this expertise, the Enterprise Security Council includes a dedicated team of Cybersecurity Information Professionals (CISP), consisting of brand-specific system engineers and security administrators. The council's primary mandate is to formulate comprehensive data protection and cybersecurity policies for ASGN, oversee the management of emerging security threats, proactively mitigate security risks, and safeguard our valuable assets. • ECS Federal, LLC ("ECS"), ASGN's Federal Government Segment, plays a vital role in safeguarding ASGN through its essential security control function. Serving as a managed services provider for both clients and internal operations, ECS oversees the SOC which is dedicated to monitoring, detecting, and responding to cybersecurity threats across our organization. Operating 24 hours a day, seven days a week, our SOC diligently filters system logs, leveraging proprietary AI/ML tools to identify global threats. We conduct continuous active hunts and forensic analysis inspections on our network, proactively seeking out malware and intrusions.

companyName: ASGN Inc

ticker: ASGN


text: The Chief Technology Officer of the Manager, in coordination with relevant senior management, which includes the Director of IT Operations and General Counsel of the Manager, work to conceive, implement, and monitor the effectiveness of a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any security incidents in accordance with the Company's business continuity plan. To ensure the effectiveness of these controls, our technology team continually monitors, hardens, and evolves systems' security postures to model and mirror various security frameworks. The Chief Technology Officer of the Manager will promptly notify the General Counsel of the Manager, the General Counsel of the Adviser and senior management, including our President, Senior Vice President of Acquisition & Dispositions and Senior Vice President of Asset Management, of any cybersecurity events, with material cybersecurity events promptly communicated to the Audit Committee and publicly disclosed as deemed necessary.

companyName: VINEBROOK HOMES TRUST, INC.


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; mobile application; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive and process certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: The Company's Disclosure Committee, with the assistance of the DIT, is responsible for overseeing the establishment and effectiveness of controls and other procedures, including controls and procedures related to the public disclosure of material cybersecurity matters. The Company's Disclosure Committee is comprised of, among others, the Company's Chief Executive Officer, President, Chief Financial Officer, General Counsel, and Senior Vice Presidents. The Company's DIT, or a delegate, informs the Disclosure Committee of certain cybersecurity incidents that may potentially be determined to be material pursuant to escalation criteria set forth in the Company's incident response plan and related processes.

companyName: Inuvo, Inc.

ticker: INUV


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. management team, including our IT management team, is responsible for assessing and managing our material risks from cybersecurity threats.

companyName: Stereotaxis, Inc.

ticker: STXS


text: The Company maintains cybersecurity procedures to mitigate risk and to ensure compliance with security, availability, and confidentiality. The cybersecurity process is integrated into the Company's overall risk management system and is solely internally managed. The Company's Chief Financial Officer is responsible for identifying risks that threaten achievement of the control activities made by the Company. The risk assessment occurs as business needs change and covers identification of risks that could act against the company's objectives.

companyName: Raphael Pharmaceutical Inc.

ticker: RAPH


text: STEP has a cybersecurity working group composed of members of the Information Technology (including Information Security), Legal and Compliance departments, including the Head of IT, the Chief Legal Officer of STEP, the Chief Compliance Officer of STEP, and a number of their respective team members. The working group meets regularly to identify and mitigate data protection and cybersecurity risks, implement information security governance mechanisms, discuss developments in information security, and discuss and action any significant cyber incidents relevant to STEP, and its affiliates, including the Company. The working group is expected to escalate matters of significance to STEP's Incident Response Team, ERMC (defined below) and/or the STEP Disclosure Committee, as well as to the Company's disclosure review team, as appropriate.

companyName: Stepstone Private Credit Fund LLC


text: We routinely engage consultants and other third parties to assist in the continued improvement and maintenance of our cybersecurity risk assessment program. These engagements are designed to enhance our cybersecurity posture, and we work closely with these experts to help us identify and address risks and vulnerabilities. Examples of these engagements include third party security assessments, security monitoring, and program review. We closely oversee and monitor third-party cybersecurity service providers.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships, under the Summary of Material Risks section of this Annual Report, and under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: We use independent service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. We periodically conduct vulnerability assessments and perform intrusion and penetration testing to evaluate our cybersecurity response capabilities.

companyName: Kodiak Sciences Inc.

ticker: KOD


text: Material Impact of Cybersecurity Risks During the reporting period, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or that are reasonably likely to materially affect us, including our business strategy, operational results and financial conditions. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.

companyName: HPS Corporate Lending Fund


text: We have processes in place to assess, identify, manage, and address material cybersecurity threats and incidents. These include, among other things: annual and ongoing security awareness training for employees mechanisms to detect and monitor unusual network activity and containment and incident response tools. We regularly assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities. We monitor issues that are internally discovered or externally reported that may affect our systems, and have processes to assess those issues for potential cybersecurity impact or risk.

companyName: ZYNEX INC

ticker: ZYXIQ


text: We monitor material risks from cybersecurity threats relating to potential compromises of sensitive information at our third-party business partners where relevant and reevaluate these risks periodically. We also perform third-party cybersecurity audits at least annually and conduct third-party security reviews and testing of our network, processes and systems periodically.

companyName: Lantheus Holdings, Inc.

ticker: LNTH


text: APA's Executive Vice President, Administration, is primarily responsible for identifying, assessing, and managing the material risks associated with cybersecurity threats and the incidents identified from time to time thereunder. He manages the Company's Information Security Team, which comprises cybersecurity professionals responsible for the day-to-day operation of the Company's cybersecurity program and managing the Company's threat intelligence, vulnerability management, forensics, and security architecture systems. APA's Executive Vice President, Administration, has 35 years of experience managing data and technology in the energy industry, including serving as the Company's CIO from 2015-2020. He receives regular updates from external cybersecurity specialists on emerging trends, threats, and technologies in the cybersecurity industry. The Executive Vice President, Administration, reports directly to APA's Chief Executive Officer and presents all relevant information to the Cybersecurity Committee.

companyName: APA Corp

ticker: APA


text: Employee Training: The Company provides associates with cybersecurity training and awareness programs. These initiatives are intended to help employees recognize and respond appropriately to potential threats like phishing attempts or social engineering. This includes conducting tabletop exercises, fostering preparedness and effective response within the Company.

companyName: REPUBLIC BANCORP INC /KY/

ticker: RBCAA


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: These assessments may leverage, among other processes, industry tools and metrics designed to assist in the assessment of risks from such cybersecurity threats.

companyName: Nuvectis Pharma, Inc.

ticker: NVCT


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, please see our Risk Factors in Item 1A.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: In the event of a cybersecurity concern or event, our incident response approach would have our Chief Financial Officer report to our Audit Committee and full Board of Directors, as well as legal counsel.

companyName: SUI Group Holdings Ltd.

ticker: SUIG


text: The oversight, monitoring, and testing of the program occurs under our Sarbanes-Oxley entity-level control reviews and the program is integrated into our Enterprise Risk Management processes. The Cyber Event Disclosure Committee convenes, at least monthly, to review recent developments in cybersecurity and in the cybersecurity risk landscape. The Cyber Event Disclosure Committee is comprised of representatives with relevant expertise for assessing and managing the applicable risks. Our Board of Directors is presented with updates on an annual, or as needed, basis regarding our cybersecurity preparedness. Additionally, our Board of Directors is provided with a comprehensive cyber training from our Chief Information Security Officer at least annually. Our Board of Directors annually reviews our cybersecurity program and the Audit Committee of our Board of Directors is specifically responsible for oversight of cybersecurity risk, which it regularly reviews with Company leadership.

companyName: REVVITY, INC.

ticker: RVTY


text: Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors, senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: We recognize the critical importance of developing, implementing, and maintaining cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data. We have a comprehensive cybersecurity policy hosted on our intranet for all employees, established to govern, guide and mitigate in the event of a cyber-attack. As a result, cybersecurity and data protection are key components of our long-term strategy.

companyName: TRIO-TECH INTERNATIONAL

ticker: TRT


text: Our commitment to cybersecurity is integral to our overall risk management strategy and reflects our dedication to protecting the confidentiality, integrity, and availability of our IT systems and data assets. We remain vigilant in addressing cybersecurity threats and adapting to emerging challenges to minimize the likelihood and impact of cyber threats and to safeguard our business operations and stakeholders' interests.

companyName: GSE SYSTEMS INC


text: The underlying processes and controls of our cyber risk management program incorporate recognized best practices and standards for cybersecurity and IT, including the National Institute of Standards and Technology, or NIST, Cybersecurity Framework, or CSF, and processes and controls supporting data protection requirements under applicable law. We have an annual assessment performed by a third-party specialist of the Company's cyber risk management program against the NIST CSF. The annual risk assessment identifies, quantifies and categorizes material cyber risks. In addition, we, in conjunction with the third-party cyber risk management specialists developed a risk mitigation plan to address such cyber risks, and, where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: Protara Therapeutics, Inc.

ticker: TARA


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. The cybersecurity risk management and mitigation measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management policy, and disaster recovery/business continuity plans; incident detection and response tools; internal and/or external audits to assess our exposure to cybersecurity threats, environment, compliance with risk mitigation procedures, and effectiveness of relevant controls; documented risk assessments; implementation of security standards/certifications; credit and background checks on our and/or third parties' personnel; encryption of data; network security controls; threat modeling; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; vendor risk management program; employee security training; penetration testing; red/blue team exercises; cyber insurance; dedicated cybersecurity staff/officer.

companyName: NEUROCRINE BIOSCIENCES INC

ticker: NBIX


text: The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business, financial condition, and results of operations may suffer in the event of information technology system failures, cyberattacks, data security incidents, or deficiencies in our cybersecurity."

companyName: Lyra Therapeutics, Inc.

ticker: LYRA


text: To mitigate cybersecurity risks linked to our engagement with third-party service providers, we perform security screening and review for prospective vendors that require access to our information systems. Based on the subsidiary and the vendor, this process may include reviewing the vendor's data protection policies, assessing their ability to meet our security requirements, and ensuring that they have adequate safeguards in place to prevent and respond to breaches. For our ongoing relationships with regular vendors, we may conduct annual risk assessments to re-evaluate their security posture, identify any changes or emerging risks, and ensure that they continue to meet our standards. Additionally, to further protect our operations and enhance our cybersecurity risk management process, we maintain cybersecurity risk insurance obtained from industry leading underwriters.

companyName: ARGAN INC

ticker: AGX


text: Our IT Security Steering Committee, which is led by our Chief Financial Officer, is composed of various members of our organization, including our Chief Human Resources Officer, VP of Software Engineering, and Senior Director of TechOps and Security. The IT Security Steering Committee is involved in oversight of cybersecurity risk. The IT Steering Committee exercises this function through our IT Security Team, which includes our Senior Director of TechOps and Security and our VP of Software Engineering who collectively have over 40 years of experience. The IT Security Team is responsible for the administration of our cyber program and works with various vendors and external providers to test and monitor for vulnerabilities and threats. We also engage our employees in our cybersecurity efforts through a process for employees to complete annual security and awareness training.

companyName: Markforged Holding Corp


text: Our cybersecurity program is aligned to the five functions of the NIST Cybersecurity Framework – identify, detect, protect, respond, and recover. To protect our information and cyber assets, we implement practices for training and screening of personnel, access management, network defense, asset configuration management, vulnerability assessment (including penetration testing), third-party security, and privacy and information protection.

companyName: CONSTELLATION ENERGY GENERATION LLC


text: The Board is informed of cybersecurity risks by our Chief Executive Officer ("CEO") and General Counsel ("GC"), who are kept updated on an ongoing basis of cybersecurity risks through our Chief Technology Officer ("CTO") and Head of Information Security (the "InfoSec Director"). Our InfoSec Director also prepares a quarterly update for each Board meeting that updates the Board of any information security and cybersecurity risks and threats to our systems. The InfoSec Director also met with the Board directly for training focused exclusively on our cybersecurity and information security program and risks starting in 2024 and expects to continue to provide such training in the future.

companyName: PROSPER MARKETPLACE, INC


text: Our board of directors and management closely coordinate to execute on our cybersecurity strategy. Our board of directors oversees cybersecurity risk management as part of its oversight of our risk management framework, while the Audit Committee has primary responsibility for management of the risks facing our Company and oversight of the measures initiated by management to monitor and control such risks and reports to the board of directors. Our management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, and compliance. Our Division Vice President for Information Security (DVP, Information Security) reports to our Chief Information Officer (CIO) and has primary responsibility for the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security Management System. The CIO and DVP, Information Security meet regularly with the Audit Committee to review the company's management of information security risks, and the Audit Committee evaluates the adequacy of the Company's IT security program, compliance and controls with our CIO. Additionally, our Enterprise Risk Management Committee, which is composed of certain of our senior management, legal and operations teammates, provides senior management with sponsorship and guidance to ensure that overall risk management objectives are achieved and regularly reports to the board of directors on matters within its purview.

companyName: TaskUs, Inc.

ticker: TASK


text: Privacy and Cybersecurity Merchants Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of their customers. These laws require banks to periodically disclose their privacy policies and practices relating to sharing such information and permitting customers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact a bank's ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, banks are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.

companyName: Merchants Bancorp

ticker: MBIN


text: We maintain a cybersecurity program, including policies and procedures designed to protect our systems, operations, and the data utilized and entrusted to us, including by us, from anticipated threats or hazards. We utilize a variety of protective measures as a part of our cybersecurity program. These measures include, where appropriate, access controls, patch management, identity verification and endpoint management software, employee cybersecurity awareness training programs, tools to report anomalous activity, and monitoring of data usage, hardware and software.

companyName: MARKETWISE, INC.

ticker: MKTW


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and the Company will continue to assess and update our cybersecurity measures in response to emerging threats.

companyName: Toughbuilt Industries, Inc


text: Risks from Cybersecurity Threats As of December 31, 2024 and as of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or nancial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact.

companyName: HERBALIFE LTD.

ticker: HLF


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business and implemented structured controls to mitigate them. Our business applications and hosting services are designed to minimize the impact of cybersecurity incidents, enhance cybersecurity resilience, we have implemented a structured Information Security Management System (ISMS) certified in accordance with ISO 27001, providing a comprehensive approach to managing cybersecurity risks and aligning with industry best practices. Our risk mitigation efforts include a combination of administrative, technical, and operational controls, such as real-time monitoring and detection activities, anti-malware and endpoint protection solutions, annual employee cybersecurity training, regular security audits, third-party penetration testing, and a clear communication and reporting structure to facilitate timely responses to security incidents.

companyName: Ondas Inc.

ticker: ONDS


text: Our cybersecurity management team consists of the following: • Chief Financial Officer – previously held roles associated with cybersecurity monitoring and reporting at bp plc, including being accountable for a global smart active monitoring implementation program focused on the North American Downstream business, as well as oversight for IT when serving as the CFO for the NA Fuels business for bp plc and while CFO at Renewable Energy Group. • Head of IT and Cyber – has over 20 years of IT leadership in cybersecurity, including risk management, incident response, and cybersecurity strategy across defense, education, and corporate sectors. He has managed IT and cyber operations for over 100,000 users, overseeing enterprise ERP, HRIS, internet services, email systems, and Security Operations Centers. He holds certifications including CISSP, CCNP, and ITIL. • Head of Business Operations – a seasoned operations and technology leader with extensive experience in scaling IT and cybersecurity functions for high-growth companies. He served as Chief Operating Officer of a Series A startup where he oversaw all operations and IT. • Head of Legal – has extensive experience helping companies manage cybersecurity, privacy, and data protection related risks across the technology, e-commerce, and healthcare sectors. He has served as the global Data Protection Officer at four companies, including at Shopify Inc. where he helped respond to cybersecurity incidents, and managed all related legal and regulatory impact. He also previously managed the cybersecurity function at a Series B startup where he served as General Counsel and Corporate Secretary.

companyName: Oklo Inc.

ticker: OKLO


text: Risks from Cybersecurity Incidents To our knowledge, Oceaneering has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations or financial standing.

companyName: OCEANEERING INTERNATIONAL INC

ticker: OII


text: The Company maintains a vendor risk management program designed to identify and manage risks associated with third-party service providers, with management retaining responsibility for oversight of cybersecurity threats. The Company also maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide disclosure objectives.

companyName: OPENLANE, Inc.

ticker: OPLN


text: The Information Technology Department conducts on-going meetings and reviews with the IT Managed Service Provider to ensure the latest threats and vulnerabilities are addressed. This includes patch management. Quarterly external penetration and vulnerability testing is conducted by a third-party IT audit firm. Business continuity/ disaster recovery testing and incident response plan testing is conducted annually by the Board appointed Disaster Recovery Committee. In addition, the company participates in annual disaster recover exercises with its core IT system provider. The Board appointed Technology Committee provides oversight of policies and receives updates including cybersecurity, systems, IT assets and control policies. The COO is a member of the Technology Committee and the Disaster Recovery Commit and information from committee meetings and testing is reported to the Board.

companyName: Central Plains Bancshares, Inc.

ticker: CPBI


text: Third parties also play a role in our cybersecurity program initiatives. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.

companyName: PATRICK INDUSTRIES INC

ticker: PATK


text: Our service providers, and third-party hardware or software applications on our networks, may pose cybersecurity risks. As a result, we assess these parties for cybersecurity risks using information supplied by our counterparty and/or third parties. Internal or external audits are conducted based upon the level of risk presented. Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways.

companyName: MARZETTI CO

ticker: MZTI


text: We partner with a third-party security consultant to review our incident response process and ensure our programs align with industry standards.

companyName: Airspan Networks Holdings Inc.


text: We periodically engage consultants in connection with our risk assessment processes to help us design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards. We manage third party service providers using a risk-based approach intended to determine if the relevant third parties have the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of their security measures that may affect our business.

companyName: Marqeta, Inc.

ticker: MQ


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:

companyName: TRANSACT TECHNOLOGIES INC

ticker: TACT


text: Our management, Chief Information Security Officer ("CISO"), information security team, and legal team are responsible for identifying and assessing cybersecurity risks on an ongoing basis, establishing processes designed to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are managed under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks. Our CISO and dedicated information security personnel maintain certain cybersecurity-related certifications and are experienced information systems security professionals and information security managers with many years of experience. In particular, our CISO maintains the following certifications: Certified Information Systems Auditor from the Information System Audit and Control Association and Certified Information Systems Security Professional from ISC2. Our management, CISO, and information security team provide updates on at least a quarterly basis to our audit and risk committee on the Company's cybersecurity programs and material cybersecurity risks and mitigation strategies, and provide cybersecurity reports on at least a quarterly basis that cover, among other topics, third-party assessments of the Company's cybersecurity programs, updates to the Company's cybersecurity programs and mitigation strategies, and other cybersecurity developments. In addition to such regular updates, and as part of our incident response processes, our CISO also provides updates on certain cybersecurity threats and incidents to the audit and risk committee and, as necessary, to the full board of directors, based on the assessment of risk by our management, CISO, information security team, and legal team.

companyName: Remitly Global, Inc.

ticker: RELY


text: The Company has an enterprise-wide cybersecurity program that is informed by the U.S. Department of Commerce National Institute of Standards and Technology Cybersecurity Framework. Our cybersecurity program encompasses the following key capabilities: 24x7 security monitoring, next-generation network security, advanced email and endpoint security, a dedicated enterprise cybersecurity team, third-party managed security services, third-party security assessment services, incident response retainer services, and external risk monitoring services. The Company also maintains cybersecurity risk insurance coverage to defray the costs of potential information security breaches.

companyName: Fortune Brands Innovations, Inc.

ticker: FBIN


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment, including monitoring and evaluating our threat environment and our risk profile; • a security governance council principally responsible for management's oversight of our IT security; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • a third-party risk management process for service providers, suppliers and vendors covering compliance and technical controls; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a cybersecurity incident response plan with established procedures for assessing and responding to cybersecurity incidents, and that includes having an experienced incident response firm on retainer.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We conduct robust cybersecurity processes aligned with the National Institute of Standards Technology ("NIST") and the Cybersecurity Maturity Model Certification ("CMMC") protocols. Our comprehensive approach includes: • An enterprise firewall; • Implementation of Multi-Factor Authentication (MFA); • Adherence to the Zero Trust model; • Utilization of Managed Detection and Response (MDR); • Endpoint Detection and Response (EDR) technologies; • 24x7 Security Operations Center (SOC); and • Employment of Security Information and Event Management (SIEM) systems to continuously monitor our network and respond to threats in real time.

companyName: ODYSSEY MARINE EXPLORATION INC

ticker: OMEX


text: The Company maintains an Enterprise Risk Committee ("ERC"), comprising the Company executives who lead day-to-day risk management, and whose efforts are supplemented by specific risk-related committees or teams. The ERC is a cross- functional committee that focuses on identifying and managing operational risk throughout the organization, including cybersecurity threats. The ERC has integrated cybersecurity into key elements of the Company's ERM framework, including our BCDR planning program and service provider management policy, and personnel from our information security, risk management, compliance and legal groups are a part of the assessment and response team for cybersecurity incidents and the evaluation of third-party cybersecurity risk.

companyName: VIRTUS INVESTMENT PARTNERS, INC.

ticker: VRTS


text: Technological safeguards that are designed to protect the Company's information systems from cybersecurity threats, including the prevention and detection of systems, access controls, and firewalls, which the Company assesses the vulnerability and cybersecurity threat and makes necessary improvements. of third parties as part of the Company's risk-based approach in identifying and overseeing cybersecurity risks.

companyName: AURA SYSTEMS INC

ticker: AUSI


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, incident detection and response policy, route risk assessments, data encryption, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, penetration testing, and cybersecurity insurance.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: Management has overall responsibility for risk oversight. The Company's SVP\IT Manager is accountable for managing enterprise information security and delivering the information security program. These responsibilities include cybersecurity risk assessment, defense operations, cyber incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third party risk management and business resilience as it relates to the cybersecurity program.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: As a component of and integrated into our overall risk management strategy and system, we maintain a cybersecurity risk management program designed to assess, identify, manage and protect our information systems and data from unauthorized access, use, disclosure, disruption, modification or destruction. Our program is based on applicable industry frameworks and standards, including those provided by the National Institute of Standards and Technology, and is comprised of core functions to identify, protect, detect, respond to and recover from cybersecurity threats and events. We constantly monitor cybersecurity threats and test the performance and effectiveness of our cybersecurity program, with the assistance of third-party experts, on an annual and ongoing basis. We recognize the risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems, and the Company has processes in place to oversee and manage these risks. We conduct thorough security assessments of these third-party engagements and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This monitoring includes both annual and ongoing assessments. As described in "Item 1A. Risk Factors" in this Form 10-K, we are subject to risks from cybersecurity threats that could have a material adverse impact on our business and financial results. As of the date of this report, no risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our business, results of operations, financial condition and cash flows.

companyName: INSTEEL INDUSTRIES INC

ticker: IIIN


text: Overall Risk Management Information technology is important to our business operations and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. This program is integrated into the Company's overall enterprise risk management process.

companyName: Stran & Company, Inc.

ticker: SWAG


text: The ISP sets forth the controls and activities designed to protect our systems and data, such as establishing network perimeter security, managing system access, monitoring user activity, and maintaining physical security. Other components of the Program related to assessing, identifying, and managing risks from cybersecurity threats include annual cybersecurity training for all employees, regular review and update of our business critical and financial systems, and the use of a variety of tools and methods to manage access to, and maintain the integrity of, our information systems. Our employees are critical in helping mitigate our cybersecurity risk and we continue to raise awareness and engagement through our formal training, frequent phishing campaigns and communication from our information security team with reinforcement from senior leaders across the Company. We also perform annual external penetration tests to identify certain potential vulnerabilities, and maintain a business continuity plan, which is tested annually.

companyName: PJT Partners Inc.

ticker: PJT


text: An Incident Response Plan that dictates how the Manager prepares, identifies, contains, remediates, and recovers from various vulnerabilities, threats, and events, including cybersecurity events impacting the Fund.

companyName: Ridgewood Energy W Fund LLC


text: We maintain a controlled patch management process, ensuring OT systems receive regular updates while considering their unique conduct continuous vulnerability scanning to internal and external networks.

companyName: Health In Tech, Inc.

ticker: HIT


text: We are actively engaged with the Aviation Information Sharing and Analysis Center (ISAC) which gathers, analyzes and shares information to combat cyber-related threats and weaknesses. We use this information to ensure we are aware of possible threats that could occur within our industry.

companyName: Joby Aviation, Inc.

ticker: JOBY


text: We engage in the periodic assessment of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.

companyName: Passage BIO, Inc.

ticker: PASG


text: Our processes for assessing, identifying, and managing risks from cybersecurity threats, including operational risks, financial reporting risks, reputational risks, personal data theft, fraud, and other potential risks, are integrated into our overall enterprise risk management process, and share common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Calidi Biotherapeutics, Inc.

ticker: CLDI


text: Management's Role in Assessing and Managing Cybersecurity Threats: Management's role in assessing and managing our material risks from cybersecurity threats is documented in the Company's IT and Cybersecurity Risk Management Strategy Plan (our Cybersecurity Plan), and our processes for identifying, assessing, prioritizing, and remediating vulnerabilities are documented via our Cybersecurity Plan (and the documents referenced therein) and our IRP. Our management cybersecurity team consists of all of the direct reports to our CEO, including our CIO, as well as dedicated cybersecurity personnel – including without limitation, our CISO, multiple cybersecurity engineers and other business level stakeholders. Although there is overlap between the CROC and our management cybersecurity team, the CROC is intended to function as a proactive group to assess and treat risks prior to an incident occurring and the cybersecurity management team is tasked with responding to threats or incidents. In connection with and pursuant to our enterprise risk management plan, our cybersecurity team, the CROC and our ERC work collaboratively across the Company to implement programs and processes designed to protect our information system from cybersecurity threats, assess and manage risks arising from any such threats, and to promptly respond to cybersecurity incidents.

companyName: Vertiv Holdings Co

ticker: VRT


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is always present. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks. While we have experienced cybersecurity incidents in the past, risks from cybersecurity threats have not materially affected our company to date. For further discussion of risks from cybersecurity threats, see the section captioned "We are subject to certain risks in connection with our use of technology" in Item 1A. Risk Factors.

companyName: CITIZENS FINANCIAL SERVICES INC

ticker: CZFS


text: We recognize the critical importance of maintaining the trust and confidence of our customers, employees, and other stakeholders. To help mitigate the cybersecurity risks that we face, we maintain processes for identifying, assessing, and managing such risks.

companyName: CISCO SYSTEMS, INC.

ticker: CSCO


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 22 years of experience in information security and that includes key roles managing cybersecurity risk in both government and the private sector. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.

companyName: Carlyle Secured Lending, Inc.

ticker: CGBD


text: Our management team, including our Chief Technology Officer and CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has a primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our current Chief Technology Officer has over 25 years of experience in the field of technology, including cybersecurity. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CISO has over 25 years of experience in various roles in cybersecurity and information technology.

companyName: ZIFF DAVIS, INC.

ticker: ZD


text: Our Corporate Controller reports to our CEO/CFO on matters of cybersecurity, and together they carry responsibility for our overall cybersecurity risk management program. Our CEO/CFO provides prompt reports to the Board regarding cybersecurity risks and incidents as they are revealed, as well as periodic reports, as appropriate, regarding the Company's cybersecurity program.

companyName: Tianci International, Inc.

ticker: CIIT


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with IT and management. Personnel at all levels receive regular mandatory training on our cybersecurity policies and practices, no less than once per quarter. Key safeguards include, but are not limited to, access controls, authentication, third-party security obligations, and other technical and organizational measures. In addition, the Company maintains policies and procedures for backups, business continuity, and disaster recovery, and regularly tests its policies and procedures to ensure they allow for timely recovery and restoration of backups and the availability of critical resources..

companyName: D-Wave Quantum Inc.

ticker: QBTS


text: We face significant and persistent cybersecurity risks due to the widespread use of our websites and mobile applications; the attractiveness of our websites and mobile applications to threat actors, including state-sponsored actors; the fact that we operate globally and must defend against cybersecurity attacks in thirteen countries; the substantial level of harm that could occur to our business, our customers, or our merchants if were we to suffer a material cybersecurity incident; and our use of third-party products and services. Protecting our systems, networks, data and confidential information is a priority at Groupon. We are committed to maintaining robust governance and oversight of these risks and implementing mechanisms, controls, technologies and processes designed to help us identify, assess and manage these risks.

companyName: Groupon, Inc.

ticker: GRPN


text: use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security cybersecurity awareness training of our employees, incident response personnel, and senior management; and cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.

companyName: Webstar Technology Group Inc.

ticker: WBSR


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report on Form 10-K, though the Partnership and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Partnership, either financially or operationally. Cybersecurity incident response is a component of both the Partnership's cybersecurity program and the Partnership's business continuity plans, which are designed to limit service interruptions and provide for continued business operation in the event of disaster, whether physical, environmental or cyber in nature. However, we recognize that cybersecurity threats are continually evolving, and there remains a risk that a cybersecurity incident could potentially negatively impact the Partnership. Despite the implementation of our cybersecurity processes, we cannot guarantee that a significant cybersecurity attack will not occur. A successful attack on our information system or operational technology system could have significant consequences to the business, including the interruption of key services that our customers depend on. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. For additional information on cybersecurity risks, see Part I, Item 1A "Risk Factors – General Risk Factors –Cybersecurity breaches and other disruptions of our information systems could compromise our information and operations and expose us to liability, which would cause our business and reputation to suffer."

companyName: USA Compression Partners, LP

ticker: USAC


text: Our board of directors is responsible for cybersecurity risk management and oversight of our cybersecurity program. The nominating and corporate governance committee of the board of directors assists in the oversight of management's implementation of our information technology policies and monitoring of the risks associated with our information systems, including reviewing and discussing with management our program to identify, assess, manage and monitor cybersecurity risks. The nominating and corporate governance committee regularly reviews technology strategies, physical and cybersecurity threat assessments, emerging issues and related initiatives. In addition, the audit committee of the board of directors coordinates the board of directors' oversight of our disclosure controls and procedures and ensures that we have in place appropriate internal controls, risk assessment policies and procedures, incident response plans and reporting mechanisms. The nominating and corporate governance committee coordinates with the board of directors and audit committee, as appropriate, on matters related to cybersecurity risk.

companyName: ALNYLAM PHARMACEUTICALS, INC.

ticker: ALNY


text: Our Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the Company based on the assessments of our IT Director. Our IT Director brings a wealth of IT and Information Security expertise from various roles in the technology industry.

companyName: Aeva Technologies, Inc.

ticker: AEVA


text: The Board of Directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. The Board has oversight responsibilities to ensure effective governance in managing these risks because it recognizes the significance of these threats to our operational integrity, shareholder and customer confidence and reputation.

companyName: GREENE COUNTY BANCORP INC

ticker: GCBC


text: Related to Cybersecurity Risks Our Board of Directors (the "Board") has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee of the Board has primary responsibility for oversight of cybersecurity risk, pursuant to the Audit Committee charter, and periodically updates our board of directors on such matters.

companyName: Bicara Therapeutics Inc.

ticker: BCAX


text: In the event of a cybersecurity incident, the Company's process calls for the IT contractor, our Chief Executive Officer and our Chief Financial Officer, to work to assess and respond to the incident and provide briefings to the Audit Committee of the Board of Directors.

companyName: Royale Energy, Inc.

ticker: ROYL