text: We protect our information systems, data, and network through technical and procedural controls and security awareness training. We deploy multiple technical controls to achieve a layered security strategy including systems access controls, firewalls, web application gateways, antivirus software, e-mail filtering, and endpoint protection. Security awareness training is mandatory for all employees and conducted at hire and periodically on topics such as phishing, ransomware, social engineering, public Wi-Fi risks, password security, and mobile device security. Training is supplemented by testing initiatives, including periodic phishing tests, which may result in targeted or remedial training.

companyName: Victory Capital Holdings, Inc.

ticker: VCTR


text: We are committed to continually enhancing our cybersecurity processes and practices to address the dynamic nature of the threats we face and to ensure the security and integrity of our systems and data.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC

secItem: Item 1C


text: For our third-party service providers, our risk assessment process evaluates the probability and potential impact of incidents related to operational errors, technology disruptions, information security breaches, workforce issues, internal and external fraud, financial actions, and legal and regulatory matters. This assessment process is part of our Supplier Risk Management program, which establishes processes for identifying, assessing, and periodically reviewing our exposure to risk through third party vendors.

companyName: NASDAQ, INC.

ticker: NDAQ


text: Our cybersecurity program is designed to assess, identify and manage the material risks from cybersecurity threats, including threats associated with third-party service providers, such as technology providers and cloud-based platforms. Our program is based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") and the guidance of banking and other regulatory agencies. As part of the program, we have adopted a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents and facilitates coordination and communication across multiple parts of our organization.

companyName: California BanCorp


text: Our Cybersecurity Manager is responsible for assessing and managing risks from cybersecurity threats, our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Cybersecurity Manager is responsible for reporting material incidents to our Cybersecurity Committee that includes our Chief Financial Officer, General Counsel and Corporate Secretary, and our Chief Information Officer. Our internal cybersecurity team has over 50 years of combined experience in information security and maintains several cybersecurity certificates including but not limited to CISSP, CISM, SRISC, GSEC, and GCFE. Our Cybersecurity team regularly participates with private energy industry and federal security working groups and organizations.

companyName: EXPAND ENERGY Corp

ticker: EXE


text: Integral to our cybersecurity processes is our Security Incident Response Plan ("SIRP"), designed to facilitate the timely and accurate reporting of any material cybersecurity incident. The incident management process is designed so that incidents are appropriately categorized and escalated to the Security Incident Response Team ("SIRT") for action and materiality determination. Our SIRT is comprised of senior executives including the Chief Financial Officer, Chief Information Officer, Global Vice President Security, Co-Chief Privacy Officers, General Counsel and other members as required depending on the nature of the incident. In addition to managing escalated incidents, the SIRT conducts tabletop exercises to simulate various threat scenarios, and outcomes are used to build experience and to refine the SIRP and response approaches. Korn Ferry has also maintained cyber insurance for more than a decade.

companyName: KORN FERRY

ticker: KFY


text: Board of Directors Oversight in Cybersecurity Governance Cabot's Board of Directors oversees the Company's cybersecurity program primarily through its Audit Committee, which comprises independent directors. Company executives along with external and internal cybersecurity personnel update the Audit Committee at least quarterly on risks related to cybersecurity and the steps taken to monitor and control risk exposure. Additionally, the results of periodic assessments of the Company's cybersecurity programs, described above, are communicated to the Audit Committee upon completion. Relevant matters are also reviewed with the full Board on at least an annual basis.

companyName: CABOT CORP

ticker: CBT


text: As of the date of this Annual Report on Form 10-K/A, we have not experienced any significant cybersecurity attacks and, to date, the risks from cybersecurity threats have not materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Totaligent, Inc.

ticker: TGNT


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.

companyName: Presurance Holdings, Inc.

ticker: PRHI


text: In addition, we and certain of our third-party vendors receive and store certain information associated with our sales operations and other aspects of our business. In connection with our e-commerce business, we rely on encryption and authentication technology licensed from third parties to effect secure transmission of confidential information. Our disclosure controls and procedures address cybersecurity and include elements intended to ensure that there is an analysis of potential disclosure obligations arising from security breaches. We also maintain compliance programs to address the potential applicability of restrictions against trading while in possession of material, nonpublic information generally and in connection with a cybersecurity breach. The breakdown in existing controls and procedures around our cybersecurity environment may prevent us from detecting, reporting or responding to cyber incidents in a timely manner and could have a material adverse effect on our financial position and value of our Company's stock. Despite our implementation of security measures, our IT systems and e-commerce business are vulnerable to damages from computer viruses, natural disasters, unauthorized access, cyber-attack, and other similar disruptions.

companyName: CHARLES & COLVARD LTD


text: We face risks from cybersecurity threats that could have a material adverse effect on our relationship with our partners, suppliers and eventual customers, or on our business, operations or products. We have experienced, and will likely continue to experience, cybersecurity incidents in the normal course of our business; however, to our knowledge, we have not experienced a material cybersecurity incident during fiscal 2024. See "Part I, Item 1A. Risk Factors – Risks Related to Privacy and Security – If we experience a significant cybersecurity breach or disruption in our information systems or any of our partners' information systems, our business could be adversely affected."

companyName: SES AI Corp

ticker: SES


text: In fiscal year 2024, as part of our overall enterprise risk management process, our Board received a report on our program for assessing, monitoring and mitigating cybersecurity risks and has delegated oversight of such program to our Audit Committee. Going forward, the Audit Committee will receive periodic reports on our program for assessing, monitoring and mitigating cybersecurity risks. In addition, as part of its overall responsibility for overseeing the adequacy of the Company's internal control over financial reporting, our Audit Committee receives periodic reports about our financial reporting information system controls and security.

companyName: Cronos Group Inc.

ticker: CRON


text: We analyze the probability and impact of cybersecurity risks using recognized cybersecurity standards and frameworks for our industry and have identified certain material risks from cybersecurity threats. As part of this analysis, we also work to determine whether these material risks would be a threat to our business continuity. To help minimize our risks related to cybersecurity threats and incidents, we maintain physical controls, including a centralized electronic card access control system, uninterruptable power supply units, and environmental controls; and technical controls, including firewalls, signature and behavior-based monitoring, intrusion detection systems, encryption and backups, and mobile application management. We engage third parties in connection with our processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: AMERISAFE INC

ticker: AMSF


text: Our IT cybersecurity team is led by our Head of Information Security, Sean Pike. Mr. Pike has over 25 years of experience leading and scaling cybersecurity practices across regulated industry and critical infrastructure. Most recently, he served as Chief Information Security Officer at Business Wire, where he was responsible for transforming the security and compliance organizations to meet the needs of a globally distributed SaaS newswire. Prior to Business Wire, Mr. Pike held leadership positions at VMware, IDC, and Nielsen Radio. His work at the Company includes aligning cybersecurity, product security, and security compliance initiatives to business goals. Mr. Pike holds a Juris Doctor in law from Syracuse University and a M.S. in telecommunications and network management from Syracuse University.

companyName: A10 Networks, Inc.

ticker: ATEN


text: We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats. We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products. These processes are integrated into our overall Enterprise Risk Management ("ERM") program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring, and management of risks.

companyName: CONDUENT Inc

ticker: CNDT


text: In addition, on at least a quarterly basis, the CISO presents an Information Security report to the Risk Committee, which includes the Company's cybersecurity alert level, controls rating, current and emerging cybersecurity risks, threats and trends, mitigation efforts and projects and audit and regulatory updates.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: • monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws; • through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care; • employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls; and • provide training for our employees regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.

companyName: GRI Bio, Inc.

ticker: GRI


text: Our CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other senior personnel across the Company. Our CISO works in coordination with the other members of the Company's Management Operational Risk Committee, which includes our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, Chief Risk Officer and General Counsel. Our CISO has served in that role for over 5 years and in various roles in information technology and information security for over 20 years. Our CISO holds an undergraduate degree in computer information systems and has attained the professional certification of Certified Information Systems Security Professional. The other members of the Management Operational Risk Committee each have relevant qualifications and over 10 years of experience managing risk in the technology and/or financial services industry.

companyName: LendingClub Corp

ticker: LC


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Financial Officer ("CFO") and CCO, is responsible for assessing and managing material risks from cybersecurity threats. The CFO and CCO of the Company oversee the Company's oversight function generally and rely on Information Technology staff of, and consultants to, the Adviser to manage the assessment and management of material risks from cybersecurity threats. The CFO has been responsible for his oversight function as CFO to the Company for three years and has worked in the financial services industry for more than 30 years, during which time the CFO has gained expertise in assessing and managing risk applicable to the Company. The CCO has been responsible for oversight functions for the Company for three years. The current CCO has been serving as CCO since April 2025 and has worked in the financial services industry for more than 35 years, during which time the CCO has gained expertise in assessing and managing risks applicable to the Company.

companyName: PENNANTPARK INVESTMENT CORP

ticker: PNNT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information from cybersecurity threats.

companyName: CADIZ INC

ticker: CDZI


text: Peng has more two decades of experience working in IT and technology companies. Before assuming his current positions as chief product officer and VP of our Company, Mr. Peng served as General Manager of Beijing Xuri Yuanfan Technology Development Co., Ltd., an internet solution company, from July 2006 to June 2016. From September 2002 to June 2006, Mr. Peng served as manager of the technology department at Beijing Shidai Saibo Technology Development Co., Ltd., an IT solution company. Earlier in his career, Mr. Peng started at Beijing Jinhaihang Electronic Technology Co., Ltd., serving as a technical support engineer for the company's education software businesses, from March 2000 to August 2002. Therefore, Mr. Peng has intimate knowledge of IT and cybersecurity issues and our operations.

companyName: Zhuoxun Hongtu Inc.


text: Cybersecurity operations generally fall under the discretion of the IT Director, who has 20 years of experience and is certified as a Secure Infrastructure Specialist, Security Specialist, Network Specialist and IT Operations Specialist. Our IT Director regularly communicates with and provides relevant cyber reporting, analysis, statistics and statuses to the Chief Financial Officer, who also has a background in IT and is a Certified Information Systems Auditor. Our Cyber Incident Response Plan includes direction and formality on what events are immediately reported and to whom.

companyName: Southland Holdings, Inc.

ticker: SLND


text: b. A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our cyber processes, and (3) our cyber threat and incident response;

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Our Audit Committee, in connection with management led by our CIO, works collaboratively across our Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, our Information Security Team monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management when appropriate.

companyName: UNIVERSAL TECHNICAL INSTITUTE INC

ticker: UTI


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, but we cannot provide assurance that we will not be materially affected in the future by such risks or future cybersecurity incidents. For more information on our cybersecurity related risks, see Item 1A. Risk Factors of this Annual Report on Form 10-K.

companyName: MSC INDUSTRIAL DIRECT CO INC

ticker: MSM


text: Cybersecurity Risks Our cybersecurity risk management processes are integrated into our overall approach to risk management. Given our nature and size, we do not have a dedicated enterprise risk function, but our management team regularly considers and evaluates the cybersecurity risks. As part of that risk management process, our management team identifies, assesses and evaluates risks impacting our operations, including those risks related to cybersecurity, and raise them for internal discussion, and where it is determined to be appropriate, issues are also raised to our board of directors for consideration.

companyName: Nauticus Robotics, Inc.

ticker: KITT


text: Our CISO and our Cybersecurity Director are responsible for the day-to-day management of our cybersecurity program and cybersecurity risks. Our CISO, who has approximately 24 years in various information technology and cybersecurity roles, and our Cybersecurity Director, who has approximately 20 years of experience in various cybersecurity roles, are primarily responsible for our overall cybersecurity risk management program and supervise both internal and external resources to identify, protect against, detect, respond to, and recover from cybersecurity risks, threats, and incidents.

companyName: AeroVironment Inc

ticker: AVAV


text: Cybersecurity risk management is included within our overall enterprise risk management program which is overseen by our Global Risk Oversight Committee ("GROC"). The GROC is composed of executive officers and other senior leaders and coordinates with other risk assurance functions, including internal audit and compliance. The GROC receives regular briefings concerning cybersecurity risks and risk management processes.

companyName: KIMBERLY CLARK CORP

ticker: KMB


text: We have implemented a cybersecurity program to safeguard our information systems, which includes policies, procedures and controls designed to protect against cybersecurity threats. Throughout the reporting period, we have made significant changes and enhancements to our cybersecurity program and the adoption of industry best practices.

companyName: STERLING INFRASTRUCTURE, INC.

ticker: STRL


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information security team who, in collaboration with the broader technology organization, manages and maintains our (1) cybersecurity risk assessment processes including our Incident Response Plan, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an Incident Response Plan that includes procedures for recognizing and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.

companyName: Airbnb, Inc.

ticker: ABNB


text: We conduct annual risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: HAWAIIAN HOLDINGS INC


text: Our cybersecurity processes to assess and identify cybersecurity risks include periodic risk assessments, deployment of security monitoring tools for continuous monitoring of our information systems, periodic testing for vulnerabilities in our systems, periodic testing of employees' cybersecurity awareness, and the dispatch of incident-specific cybersecurity alerts, among other procedures.

companyName: FARMER BROTHERS CO

ticker: FARM


text: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. However, due to evolving cybersecurity threats, we may not be able to protect all information systems and, as an acquisitive organization, integrating information systems as we acquire new businesses may expose us to unexpected liabilities or increase our vulnerability. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Our Chief Compliance Officer and IT consultant provide periodic briefings to the audit committee regarding our company's cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like. Our audit committee provides regular updates to the board of directors on such reports.

companyName: Jaguar Health, Inc.

ticker: JAGX


text: The Compliance and Quality of Care Committee of our board of directors has primary responsibility for oversight of our cybersecurity risk management program. Our CIO provides quarterly reports on our cybersecurity program to that committee and at least annually to our full board. The reports to the committee and the full board include details and metrics on, among other things, our routine vulnerability assessments, internal and external threat intelligence, quarterly NIST framework assessments, quarterly Company-wide phishing exercises and training, device encryption, routine resilience efforts including quarterly disaster recovery exercises, third-party vendor risk management, annual tabletop incident response exercise, annual business continuity exercise, cyber penetration tests, and 23 NIST cyber hygiene controls. Similarly, our chief compliance officer provides quarterly reports to the Compliance and Quality of Care Committee on patient privacy compliance efforts and related matters. The Compliance and Quality of Care Committee and the full board review, and the committee approves, the annual cybersecurity plan that sets out the primary initiatives and internal audits of the IT security function for the upcoming year. Historically, one or more board members have observed and participated in our tabletop incident response exercises.

companyName: Encompass Health Corp

ticker: EHC


text: Despite our security measures, our internal and third-party information technology systems and networks may be subject to damage, disruption, or unauthorized access due to a variety of factors, including cyber-attacks by computer hackers, computer viruses, ransomware, phishing, denial-of-service attacks, physical or electronic break-ins, employee error or malfeasance, power outages, natural disasters, or other catastrophic events. Any such damage, disruption, or unauthorized access could compromise our internal and third-party networks and the information stored there could be accessed, publicly disclosed, lost, or stolen. Any such access, disclosure, or other loss of information could result in legal claims or proceedings, liability under laws that protect the privacy of personal information, regulatory penalties, disruption to our operations, damage to our reputation, loss of customers, potential harm to our competitive position and additional costs to remediate the issue.

companyName: AYTU BIOPHARMA, INC

ticker: AYTU


text: Our board of directors' audit committee receives annual reports from our CFO, concerning our significant cybersecurity threats and risk and the processes the Company has implemented to address them. Our audit committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.

companyName: Syndax Pharmaceuticals Inc

ticker: SNDX


text: One of our top priorities is protecting Cooper Standard's digital assets, and we increasingly rely on data and digital transactions to operate efficiently and effectively. We take action to prevent potential impacts related to system outages, data breaches, cyber-attacks and other threats to avoid disruption to our daily operations. Cooper Standard prioritizes increasing efficiency and efficacy as we design and refresh prescriptive incident response procedures to minimize impacts of potential cyber-attacks or outages. From time to time, the Company engages in table-top exercises, which involve cross-functional business leaders. Our information technology ("IT") professionals focus on improving existing controls as outlined by ISO/IEC 27001:2022 (an internationally recognized information security framework), which is the foundation of our cybersecurity program. In recent years, we have made advancements in this space by conducting a risk assessment carried out by an independent third-party and continued engagement with cyber advisory services as described further below.

companyName: Cooper-Standard Holdings Inc.

ticker: CPS


text: A key element of the Company's strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company's information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company's servers and computers. The Company's cybersecurity preparedness program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: We continuously monitor and update our information technology networks and infrastructure in an effort to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We maintain and periodically test backup systems and disaster recovery. We also have processes in place that are designed to prevent disruptions resulting from our implementation of new software, including software updates, and new systems.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: Company's Cybersecurity System includes administrative, technical, and physical safeguards and is designed to provide an appropriate level of protection to maintain the confidentiality, integrity and availability of the Company's and its customers' information.

companyName: SECURITY NATIONAL FINANCIAL CORP

ticker: SNFCA


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from management at least annually. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary. The Audit Committee oversees cybersecurity risk management activities, supported by Company management, the Board of Directors, and external consultants.

companyName: DIH HOLDING US, INC.


text: We are a special purpose acquisition company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable acquisition transaction candidates. Therefore, we do not consider that we face significant cybersecurity risk and have not adopted any cybersecurity risk management program or formal processes for assessing cybersecurity risk. Our board of directors is generally responsible for the oversight of risks from cybersecurity threats, if there is any.

companyName: Four Leaf Acquisition Corp

ticker: FORL


text: Cybersecurity risks are managed by and through our information security program, which consists of the activities of teams managed by our CIO (first line of defense) and CISO (second line of defense). In the normal course of business, executive management is informed about the prevention, detection, mitigation and remediation of cybersecurity risks through these established reporting lines and through its oversight of the information security program.

companyName: Artisan Partners Asset Management Inc.

ticker: APAM


text: d. Conduct regular phishing email simulations for all employees; and e. Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.

companyName: SEKISUI HOUSE U.S., INC.


text: Third Party Involvement and Risk Assessment: We actively and routinely engage assessors, consultants, auditors and other relevant third parties with appropriate expertise in their respective fields for the purposes of effectively maintaining and improving the quality and effectiveness of our processes. We believe this allows us to employ best practices and reduce the risks associated with evolving cybersecurity and data protection threats. We have also implemented industry-recommended practices to oversee and identify threats associated with the use of our third-party service providers.

companyName: WillScot Holdings Corp

ticker: WSC


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems the Advisor uses to provide services to us pursuant to the Advisory Agreement, Franklin Templeton's cybersecurity team utilizes a regularly updated cybersecurity incident response plan that was developed based on, and is periodically benchmarked to, applicable third-party cybersecurity standards and frameworks. Pursuant to that plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is led by the CISO or his delegee. In addition, the Audit Committee approved a Company policy that supplements the Franklin Templeton incident response plan with respect to cybersecurity incidents that have or are expected to impact the Company, including by impacting the Advisor's ability to provide services to the Company pursuant to the Advisory Agreement. Pursuant to this policy the Advisor and Franklin Templeton are required to notify and brief Company senior management and the Audit Committee with respect to certain matters related to applicable cybersecurity incidents. The policy also designates responsibility to specified members of our senior management for Company disclosure determinations related to the incident.

companyName: Franklin BSP Realty Trust, Inc.

ticker: FBRT


text: Enterprise Risk Management We maintain an enterprise risk management ("ERM") program designed to systematically identify and manage risk including risk from cybersecurity threats. The risk committee of the board of directors oversees our ERM program and it is reviewed annually by both the risk and audit committees of the board of directors. The risk committee also monitors and reports to the board regarding issues arising with respect to the risk governance structure and performance of the risk management function. The board, as a whole and through its committees, regularly engages with the Chief Risk Officer, management and outside advisors to identify, assess and manage risks of the company and to ensure the risk management function has the appropriate resources and authority to fulfill its responsibilities. An executive risk committee, comprised of senior leaders of our lines of business and corporate functions, provides executive level accountability for the ERM program.

companyName: FISERV INC

ticker: FISV


text: As noted previously, the CISO is a member of the Council, which meets monthly to provide operational direction to the IT Security Team considering the evolving risk landscape. The IT Security Team and the Council, through ongoing communication, help monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The CISO or CIO, in consultation with the Council and other members of senior management, reports such threats and incidents to the Audit and Finance Committee, as appropriate. These reports may be included in, or in addition to, the regular annual reports to the Audit and Finance Committee.

companyName: EASTMAN KODAK CO

ticker: KODK


text: Management is responsible for assessing, identifying, and managing risks from cybersecurity threats. Our Board is responsible for risk oversight and monitors an enterprise risk management process prepared by management to assist in fulfilling its oversight responsibilities. The Board has delegated responsibility for overseeing the monitoring and assessment of risks related to cybersecurity to the Audit Committee.

companyName: OIL STATES INTERNATIONAL, INC

ticker: OIS


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A "Risk Factors—Risks Related to our Business—If we or our partners or other third parties with whom we collaborate fail to protect confidential information and/or sustain a data security incident, we could suffer increased costs, material financial penalties, exposure to significant liability, adverse regulatory consequences, and reputational harm, which would materially adversely affect our business, results of operations, and financial condition."

companyName: Oscar Health, Inc.

ticker: OSCR


text: The Bank's Enterprise Risk and Technology & Operations Committees receive regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular, and prompt reporting to the Enterprise Risk and Technology & Operations Committees of the Board on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted the Bank, as well as risk assessment, management, and monitoring updates, as applicable and as needed.

companyName: Federal Home Loan Bank of San Francisco


text: Risk Management Plan Once risk assessments are complete, a risk management plan is prepared to ensure controls are developed or enhanced to mitigate risks to acceptable levels. The Risk Management Plan is presented to, and approved by, the Audit Committee of the Board of Directors annually and progress on remediation activities is shared quarterly.

companyName: FS Bancorp, Inc.

ticker: FSBW


text: The Vice President of Information Technology has over 25 years of IT experience including Fortune 100 public companies. The Vice President of Information Technology meets regularly with senior management to inform and advise them of the status on all cybersecurity initiatives as well as all cybersecurity incidents, if any.

companyName: Greenlane Holdings, Inc.

ticker: GNLN


text: We maintain cybersecurity insurance coverage to mitigate potential financial impacts from cyber incidents, such as data breaches and system disruptions. However, such insurance may not cover all types of damages, and we cannot guarantee that our coverage will be sufficient to fully protect us from the financial consequences of a cyberattack.

companyName: Provident Bancorp, Inc. /MD/


text: Our cybersecurity programs are under the direction of our CFO with assistance from the management team. Any significant Cyber incidents that they become aware of are reported to the board of directors. The Board of Directors does not have a designated cybersecurity committee, but the Audit Committee receives periodic updates on cybersecurity matters. The Company has not experienced any material cybersecurity incidents to date and there were no material cybersecurity incidents discovered in 2024. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.

companyName: THUNDER MOUNTAIN GOLD INC

ticker: THMG


text: Risk Management, Strategy, and Governance Our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes are led by a dedicated, outsourced Chief Information Officer, in collaboration with outside cybersecurity partners, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Qualified third-party service providers are tasked with developing, implementing, and executing that strategy. These third parties play a key role in our cybersecurity risk assessment and management processes, as we rely on their cybersecurity experience and expertise to assess, identify, and manage emerging trends and risks from cybersecurity threats on an ongoing basis.

companyName: Laird Superfood, Inc.

ticker: LSF


text: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, PCI DSS for handling financial data, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, SOC 1 TYPE II and SOC 2 TYPE II, among others. We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties. We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.

companyName: ExlService Holdings, Inc.

ticker: EXLS


text: • CIDO—The CIDO has had the overall responsibility for PSEG's cybersecurity since September 2022, including the assessment and management of material risks to PSEG from cybersecurity threats. The CIDO has served in that position since August 2020 and is a direct report to the CEO. The CIDO has over 25 years of energy experience inclusive of leading technology compliance with cybersecurity regulations for nuclear, transmission, gas and corporate assets. Our CIDO's experience includes leading the secure technology design, development, and deployment strategy for grid modernization efforts, including digital customer engagement platforms, advanced metering, enterprise asset management and distribution automation functionality.

companyName: PUBLIC SERVICE ENTERPRISE GROUP INC

ticker: PEG


text: In the ordinary course of our business, we use, store and process a bare minimum of data. To effectively prevent, detect, and respond to cybersecurity threats, we maintain a cyber risk management program, which is comprised of data segregation, penetration testing, and training. The cyber risk management program falls under the responsibility of a third party IT consultant, who has cross-functional expertise in IT management, cybersecurity, and engineering with more than 30 years of experience (the "IT Consultant"), who reports directly to our Chief Financial Officer. Under the guidance of the IT Consultant, we have minimized our data footprint to keep our cyber risk low.

companyName: Avalon GloboCare Corp.

ticker: ALBT


text: Our Artificial Intelligence Council, which includes the CISO, oversees adherence to AI ethical principles and regulatory requirements in the development and utilization of AI systems, including generative AI tools. AI governance is integrated within the broader governance framework discussed above.

companyName: EXACT SCIENCES CORP

ticker: EXAS


text: The Company's cybersecurity policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats and responding to cybersecurity incidents are based on recognized frameworks established by industry standards. The Company has established and maintains incident response and recovery plans to address potential cybersecurity incidents. It has implemented a range of technical, physical, and administrative security controls to mitigate cybersecurity threats, including measures specifically focused on network security, data protection, and safeguarding information that, if compromised, could adversely affect the public interest or the Company.

companyName: ScanTech AI Systems Inc.

ticker: STAI


text: The Advisory Committee of the Board of Managers of the general partner of our General Partner has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full Board of Managers for consideration. Reports are periodically provided to the Advisory Committee during our board meetings by the individuals who oversee risk management in cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Members of the Board of Managers also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: DORCHESTER MINERALS, L.P.

ticker: DMLP


text: We utilize various tools and security technology to help us deter, detect, identify, and respond to potential cybersecurity threats. Annually, we undergo external evaluations by third-party consulting services, including the performance of penetration testing and vulnerability scanning. With respect to third-party service providers, we generally require our vendors to maintain security controls to protect our confidential information and data, and we perform risk assessments of IT vendors, including their ability to protect data from unauthorized access. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate the incident to our Chief Technology Officer ("CTO"). As described in Part 1, Item 1A (Risk Factors), our operations rely on the secure processing, storage, and transmission of confidential and other information in our IT systems and networks. Computer viruses and other events beyond our control, including cybersecurity attacks and other cyber incidents such as denial of service, system failure, security breach, intentional or inadvertent acts by employees or vendors with access to our systems or data, or disruption by malware, could expose our IT systems and those of our vendors to system interruptions, impacting the availability, reliability, speed, accuracy, and other proper functioning of these systems or result in the release of proprietary information or sensitive or confidential data, any of which could materially and adversely affect our business. Because the sophistication of cybersecurity threats is increasing and new techniques for attack are being developed rapidly, including attacks enabled by AI, we cannot be certain that the controls and preventative actions that we have implemented to reduce the risk of cybersecurity incidents and to protect our systems will be effective in preventing a cybersecurity incident from materializing. While we have experienced minor cybersecurity incidents, we are not aware of any material cybersecurity incidents that occurred during the year ended December 31, 2023. Our Audit Committee, with delegated authority from our Board of Directors, has primary oversight of cybersecurity risks.

companyName: ARCBEST CORP /DE/

ticker: ARCB


text: Risks relating to cybersecurity are overseen by the Audit Committee. Certain members of our management, including the Executive Vice President and Chief Financial Officer (the "CFO"), the Chief Accounting Officer and Corporate Controller (the "CAO") and the Vice President of Internal Audit, report to the Audit Committee regarding cybersecurity risks. IT management presents an annual update of cybersecurity related activities to the Audit Committee. Interim updates are provided to the Audit Committee by the CFO on an as needed basis should an incident warrant immediate notification or escalation.

companyName: HELIX ENERGY SOLUTIONS GROUP INC

ticker: HLX


text: Our CTO and CISO oversee our cybersecurity preparedness. Our CTO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining Strategy in 2018. Our CISO, who joined Strategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CTO.

companyName: Strategy Inc

ticker: MSTR


text: To respond to the threat of security breaches and cyberattacks, we have developed a cybersecurity program, the implementation of which is led by our Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). Our cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by us, or in our care. The Audit and Risk Committee of our Board of Directors has oversight of cybersecurity per its charter and as disclosed in our proxy statement. In addition, cybersecurity is reviewed as part of our overall enterprise risk management program, led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit & Risk Committee of our Board of Directors. Our Director of Enterprise Risk Management regularly meets with our CISO and CIO to assess our cybersecurity risks, cybersecurity program mitigants and status of control improvement projects.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Our cybersecurity incident response policy is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Chief Financial Officer and legal department. Our Chief Financial Officer works with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response policy includes reporting to the Audit Committee for certain cybersecurity incidents.

companyName: VYNE Therapeutics Inc.

ticker: VYNE


text: Operational Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company's Enterprise Risk Management Governance Framework ("the Framework"), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.

companyName: CITIZENS FINANCIAL GROUP INC/RI

ticker: CFG


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Ms. Sethi serves as the Company's Global CIO and reports to Kurt McMaken, the Company's CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.

companyName: BRINKS CO

ticker: BCO


text: The Disclosure Committee assesses and determines materiality based on the information provided by the Incident Response Team and makes recommendations to the Chief Financial Officer regarding disclosure.

companyName: Revance Therapeutics, Inc.


text: The Company uses an Agility Preparedness Plan ("Agility Plan"), along with incident response policies, to enable management to respond timely to cybersecurity incidents, coordinate such responses within the Company and with our Board of Directors, notify law enforcement, regulatory bodies, and other government agencies, and notify customers and employees. The Agility Plan provides a documented framework for identifying and responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the Crisis Management Team ("CMT"). The CMT facilitates coordination across key stakeholders of the Company. The Company's CIO and key members of management are members of the CMT. The Company provides the CIO and the information security team the latest tools and techniques to protect the confidentiality, integrity and availability of the Company's data for the benefit of our customers, employees and shareholders. We regularly engage third-party consultants to assess the effectiveness of our strategy, tools and techniques, and overall information security program. Independent oversight and assurance activities specifically include internal audits, vulnerability assessments and penetration testing. The Company's cybersecurity professionals are well-trained on how to protect customer and employee information through ongoing education and awareness initiatives. The CIO and other members of the information technology team receive ongoing training related to developing threats, proactive solutions and industry best practices in order to effectively protect the Company and its stakeholders.

companyName: FIRST CAPITAL INC

ticker: FCAP


text: The Company's comprehensive cybersecurity and information security framework includes risk assessment and mitigation through a threat intelligence-driven approach, application controls, and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF") for measuring overall readiness to respond to cyber threats, and Sarbanes-Oxley for assessment of internal controls.

companyName: Cohen & Co Inc.

ticker: COHN


text: Our cybersecurity risk management process forms a critical component of our overall risk management and business strategy. As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. Additionally, we utilize data encryption and access control, single sign-on and multi-factor authentication, and malware protection within our control environment. We also maintain a variety of incident response plans that are utilized when incidents are detected. These plans are designed to be flexible so that they may be adapted to an array of potential scenarios and provide for the creation of cross-functional cybersecurity incident response teams in the event of a cybersecurity incident. We regularly review our incident response plans and conduct multiple incident response exercises each year, including sessions with management, to test and assess our preparedness to respond to a cybersecurity incident. Additionally, we require employees with access to our information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.

companyName: FIRST ADVANTAGE CORP

ticker: FA


text: Our management team, including our Chief Executive Officer, Chief Operating Officer and Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and retaining external information technology providers. The members of our management team do not have specialized cybersecurity backgrounds but have general experience managing financial, insurance, legal and operational risks. Our management team utilizes a third-party outsourced information technology service provider to monitor security events and actively respond to potential security incidents. If a security incident is identified, management in conjunction with the outsourced information technology service provider will take the appropriate actions to mitigate and remediate the security incident in a timely manner. Either during the incident, or post remediation, management will determine the materiality of the incident and if deemed material, will inform the Audit Committee and disclose the incident pursuant to SEC rules and regulations.

companyName: Highlands REIT, Inc.


text: Blackstone maintains a formal cybersecurity risk management process and cybersecurity risk register, designed to identify, track and treat cybersecurity risks at the firm, and integrates these processes into the firm's overall risk management practices described above. Blackstone's CSO periodically discusses and reviews cybersecurity risks and related mitigants with its enterprise risk committee and incorporates relevant cybersecurity risk updates and metrics in the semi-annual enterprise-wide risk management report.

companyName: BLACKSTONE MORTGAGE TRUST, INC.

ticker: BXMT


text: Our CIO, with oversight by the ISPEC, is responsible for managing the Company's digital infrastructure, systems, and services and ensuring the confidentiality, integrity, and availability of information stored and processed using those systems. Our CIO has more than 30 years of IT and cybersecurity experience and oversees a team of dedicated cybersecurity personnel with various experience and certifications in information security and cybersecurity.

companyName: RADIUS RECYCLING, INC.


text: In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities: • closely monitor emerging data protection laws and implement any necessary changes to our processes; • conduct annual security training for all our employees; • conduct annual cybersecurity management and incident training designed for certain employees such as those who handle sensitive data; • conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • hold regular meetings of an internal multidisciplinary working group to discuss our cybersecurity incident preparedness; • run tabletop exercises to simulate a cybersecurity incident and use findings from such exercises in an effort to improve our processes and technologies; • maintain and regularly review and test a framework designed to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • carry information security risk insurance designed to mitigate potential losses arising from cybersecurity incidents.

companyName: LEGALZOOM.COM, INC.

ticker: LZ


text: Our Chief Information Security Officer ("CISO") is responsible for managing our information security team and implementing the Information Security Program. As discussed in further detail under "Risk Management and Strategy" above, the primary responsibilities of the information security team include IT governance, risk and compliance; identity and access management; security architecture and engineering; security operations; resiliency, safety and security; vendor risk management, and security awareness education. The team includes information security professionals with varying degrees of education and experience, and many team members are subject to professional education and certification requirements. In particular, our CISO has substantial relevant experience in the areas of physical security, information security, and cybersecurity risk management.

companyName: NICOLET BANKSHARES INC

ticker: NIC


text: ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function. Technology Risk Management, together with the broader Risk Compliance group, is responsible for and manages BNY Mellon's risk management framework and establishes guidance for ISD and management designed to help identify, assess and manage cybersecurity risk.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR


text: The Information Security Program includes Information Security strategy, an incident response plan for incident management; access rights management; threat and vulnerability management; security training; risk and maturity assessments; security systems controls and standards; data use, reproduction, storage and destruction standards, intrusion prevention management, patch management, physical and environmental protections, encryption standards, malicious code prevention, intelligence sharing, and Information Security Monitoring, including architecture considerations, activity monitoring and condition monitoring. On an annual basis, Information Security-related risk assessments and a maturity analysis are performed and reported to the Board of Directors or the Board Audit Committee. Risks from cybersecurity threats associated with use of third-party service providers are addressed as part of the vendor management program, in initial and ongoing assessment of service providers. Information Security training is conducted for both employees and the Board of Directors annually. Training includes sharing educational communications to increase employee awareness of cybersecurity risks.

companyName: ACNB CORP

ticker: ACNB


text: In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Governance.

companyName: Azitra, Inc.

ticker: AZTR


text: We have adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity incident that provides a standardized framework for responding to cybersecurity incidents. The IRP is expected to be integrated into our overall risk management system and applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services require access to secure Company information, and to all devices and network services that are owned or managed by the Company.

companyName: Techpoint, Inc.


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Ameresco, Inc.

ticker: AMRC


text: We provide mandatory cybersecurity training to employees and contractors on an annual basis. Employees also have access to supplemental online cybersecurity training. We test our employees' response to simulated phishing scenarios on a regular basis.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: As of the date of this Annual Report, we are not aware of any cybersecurity threats, including those resulting from prior cybersecurity incidents from our predecessor’s operations, that have had, or are reasonably likely to have, a material adverse effect on our business strategy, results of operations, or financial condition. We acknowledge the inherent and ongoing risks posed by cybersecurity threats, which, if realized and significant, could materially affect our operations, business strategy, results of operations, or financial condition.

companyName: Flowco Holdings Inc.

ticker: FLOC


text: Company has not adopted any formal cybersecurity risk management program or formal processes for assessing, identifying, and managing material risks from cybersecurity threats. At the management level, our Chief Executive Officer and Chief Financial Officer are responsible for addressing cybersecurity incidents, while our full board of directors (the "Board of Directors" or "Board") has oversight responsibility for the Company's overall risk management, including cybersecurity risk, and has not delegated oversight authority for cybersecurity risks to any committee. In the event a cybersecurity incident occurs, the Company's Chief Executive Officer and the Chief Financial Officer are expected to inform our Board of Directors of the details of such incident as well as the measures taken in response to such incident. In fiscal year 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.

companyName: Permex Petroleum Corp

ticker: OILCF


text: At the management level, our CIO, CISO, and Deputy CISO, each of whom has extensive cybersecurity knowledge and skills gained from over 27 years, 28 years, and 19 years of relevant work experience, respectively, head the Internal Cybersecurity Team that is responsible for implementing and maintaining cybersecurity and data protection practices across our business, with our CIO reporting directly to our Chief Executive Officer. In 2023, our CIO was appointed to serve as a member of the U.S. Cybersecurity Advisory Committee (CSAC) of the Cybersecurity and Infrastructure Security Agency (CISA), which provides recommendations to CISA on a range of cybersecurity issues, including corporate cyber responsibility, technology product safety, and efforts to raise the baseline of cybersecurity practices for a variety of entities to enhance the United States' cyber defense. Our CISO and Deputy CISO receive reports on cybersecurity threats from a number of experienced information security professionals for various parts of our business on an ongoing basis and, in conjunction with other management personnel, regularly consult on risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.

companyName: UNION PACIFIC CORP

ticker: UNP


text: As part of our overall risk management system, we monitor and test our safeguards and train relevant personnel on these safeguards. These efforts are led by our Information Security function. All personnel are expected to engage in security awareness training. We engage third parties to perform security assessments to test our safeguards and, when appropriate, implement modifications to or add new safeguards based on the results of such assessments.

companyName: Sana Biotechnology, Inc.

ticker: SANA


text: Third-parties on Risk Management we recognizing the complexity and evolving nature of cybersecurity threats we engage with a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular meetings, threat assessments, and consultation on security enhancements.

companyName: Clubhouse Media Group, Inc.


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology Common Industry Format Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third -party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third -party service provider or that otherwise impacts third -party technology and systems we use.


text: Our Audit Committee is also responsible for the oversight of risks from cybersecurity threats. Our CIO, Chief Financial Officer, and Security Incident Response Team provide regular updates to the Audit Committee of the Company Board on cybersecurity risks. Through these updates, the Audit Committee receives information on the status of key cybersecurity activities such as email phishing, event logging and data encryption, among others. Information regarding relevant cybersecurity training is provided as well.

companyName: Utz Brands, Inc.

ticker: UTZ


text: As a regular part of our ordinary business operations, we collect and store data, including information necessary for our operations, information from our customers, employees, and our business partners. We recognize these networks and systems may be subject to increasing and continually evolving cybersecurity risks. Our Board is responsible for overseeing risk management and Cybersecurity is an integral part of the Company's overall risk management program. Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.

companyName: Boxlight Corp

ticker: BOXL


text: For information of ours which resides on our CROs' computer systems, we rely on the CROs' own cybersecurity processes and systems.

companyName: AIxCrypto Holdings, Inc.

ticker: AIXC


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, the risk of intellectual property theft, fraud, harm to employees or third parties with which we conduct business and violation of data privacy or security laws.

companyName: DYADIC INTERNATIONAL INC

ticker: DYAI


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs, with active participation in the CWG. The CWG is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CWG also develops periodic reports on the Company's cybersecurity program and developments. The CWG members include the Chief Operating Officer, Chief Financial Officer, and Vice President of Technology.

companyName: Nuvve Holding Corp.

ticker: NVVE


text: On an annual basis we obtain an independent assessment and evaluation of the operation of our cybersecurity and privacy programs, as well as the supporting control frameworks. The findings of these independent assessments facilitate our risk-based decision-making, prioritization of cybersecurity countermeasures, and risk mitigation strategies. Our risk mitigation strategies encompass an array of technical and operational measures, complemented by annual cybersecurity and privacy training for all employees.

companyName: Hippo Holdings Inc.

ticker: HIPO


text: Program Overview The Investment Adviser has instituted a cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to the Company. The cyber risk management program involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. The Investment Adviser, through its service providers, actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by the Company.

companyName: Steele Creek Capital Corp


text: The Company's Board of Directors has oversight of information security matters at the Company, including reviewing the Company's cybersecurity practices. At least annually, the Vice President of IT presents the Company's information security policies and programs to the Board. Our Audit Committee is tasked with overseeing risks from cybersecurity threats. Members of the Audit Committee receive updates on cybersecurity matters on a quarterly basis from one or more representatives from the Company's Cyber Security Council ("CSC"), which is composed of our business unit general managers, other members of senior management, our Vice President of IT and our IT Security Manager. These updates include a discussion of existing and new cybersecurity risks (if any), updates on how management is addressing and/or mitigating those risks, and the status of information security initiatives. Other Board members also engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs outside of the scheduled meetings.

companyName: ONTO INNOVATION INC.

ticker: ONTO


text: Reporting to Board of Directors Our Sr. Director of IT, in his capacity, regularly informs the other Risk Management Team members of all aspects related to cybersecurity risks and incidents. This ensures that various levels of management are kept abreast of the cybersecurity posture and potential risks to the company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee, ensuring that the Audit Committee has comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Energy Recovery, Inc.

ticker: ERII


text: The cybersecurity capabilities of third-party vendors providing services to NEE or accessing NEE's systems or data, including those related to XPLR, are evaluated as part of the new vendor establishment process. NEE retains the right to audit vendors for cybersecurity of products and services. Where applicable in NEE's or XPLR's contracts with third-party vendors accessing their systems or data, standard data security terms and conditions are utilized and minimum amounts of insurance coverage based on the risk of exposure are required.

companyName: XPLR Infrastructure, LP

ticker: XIFR


text: Management, in coordination with our information technology department, is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Management is responsible for approving budgets, approving cybersecurity processes, and reviewing cybersecurity assessments and other cybersecurity-related matters.

companyName: ALEXANDRIA REAL ESTATE EQUITIES, INC.

ticker: ARE


text: The Company's Director, Data Privacy & Security leads the IT security team and is responsible for coordinating and implementing our information security program. The Director, Data Privacy and Security also reports on cybersecurity matters to senior management and informs on such matters to the Audit & Cyber Committee of the Board. IT security team members have cybersecurity experience or certifications. We view cybersecurity as a shared responsibility, and we perform simulations and tabletop exercises with members of the Cybersecurity Council and other team members involved in incident response. We involve external resources and advisors as needed. Team members have on-demand online access to cybersecurity training through our online U-Haul University.

companyName: U-Haul Holding Co /NV/

ticker: UHAL


text: The Technology Risk Committee reviews and approves the company's management-level cybersecurity risk policies and standards. The Technology Risk Committee also reviews and monitors metrics relating to cybersecurity risk. The Technology Risk Committee escalates matters to the Enterprise Risk Committee as appropriate.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe. Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks and, while we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected us. For further discussion of risks from cybersecurity threats, see the section captioned "A failure in or breach of our operational or security systems, or those of our third-party service providers, including as a result of cyber-attacks, could disrupt business, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase costs and cause losses" in Item 1A of this Annual Report.

companyName: Community West Bancshares

ticker: CWBC


text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we collaborate with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from applicable service providers prior to entering any engagement for services focused on information technology or processing sensitive information. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: In light of the pervasive and increasing threat from cyberattacks, the Company's Board of Directors and the Audit Committee, with input from management, assess the Company's cybersecurity threats and the measures implemented by the Company to mitigate and prevent cyberattacks. The Audit Committee consults with management regarding ongoing cybersecurity initiatives, and requests management to report to the Audit Committee or the full Board regularly on their assessment of the Company's cybersecurity program and risks.

companyName: CDT Equity Inc.

ticker: CDT


text: Our cybersecurity program includes controls designed to identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance. These controls include the following activities: monitor emerging data protection laws and implement changes to our processes designed to comply; conduct regular cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;

companyName: ALPHA PRO TECH LTD

ticker: APT


text: Our IT leadership updates the Cybersecurity Steering Committee on cybersecurity risks and incidents, ensuring that management is kept aware of USAC's cybersecurity postures and risks. The Cybersecurity Steering Committee is overseen by, and management periodically provides an update to, the Audit Committee of our Board of Directors regarding our cybersecurity posture and risks, ensuring that the Audit Committee has knowledge and oversight of significant cybersecurity matters and can provide guidance on critical cybersecurity issues.

companyName: USA Compression Partners, LP

ticker: USAC


text: The Adviser also reviews the Fund service providers' compliance and risk management policies and procedures related to cybersecurity matters, monitors such service providers' use of information systems which have the potential to subject the Fund to information technology vulnerabilities and receives regular reports from the Fund's service providers regarding cybersecurity threats and incidents. The CCO provides quarterly reports to the Board of Trustees regarding significant risks to the Fund, including, among others, those relating to cybersecurity. In addition, the CCO informs the Board of Trustees regarding material cybersecurity risks as they arise.

companyName: Silver Point Specialty Lending Fund


text: Risk Management and Strategy Angel Oak Capital, an affiliate of our Manager, has engaged a third-party managed information technology service provider (the "IT Service Provider"), to serve as Angel Oak Capital's dedicated information technology manager. We have no employees and are externally managed by our Manager, an affiliate of Angel Oak Capital, and as such rely on our Manager for the implementation and execution of our risk management program, and, as it pertains to the assessment, identification, and management of material risks from cybersecurity threats, our Manager relies on the IT Servicer Provider. As an affiliate of Angel Oak Capital, our Manager is subject to and participates in the cybersecurity policies and procedures of Angel Oak Capital. The IT Service Provider provides Angel Oak Capital a system and organization controls report on itself consistent with SOC 2 as part of annual reviews of the IT Service Provider. Members of the IT Service Provider have relevant qualifications such as extensive work experience implementing data security measures, developing cybersecurity policies and procedures and assessing, managing and reporting cybersecurity risk.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: Our cybersecurity risk management program monitors our systems and networks for threats, breaches, intrusions and other weaknesses; assesses the security of our company-wide software, applications and systems; conducts security audits and threat assessments; responds to cybersecurity incidents; and facilitates training for our employees. Within our cybersecurity team, subject matter experts regularly obtain cybersecurity certifications. Our program includes procedures to identify cybersecurity risks and threats of our third-party service providers. These procedures measure the maturity of third-party provider cybersecurity programs against industry best practices. The collection of this information is used to assess the use of third-party software or partnerships. We also review the cybersecurity scores of our business customers and suppliers, and we rely on consultants and other third-party advisors to conduct security assessments and independent audits of the security and resilience of our systems and networks. Our cybersecurity risk management program includes response plans that are aligned with our crisis response plans and outline the procedures and protocols to follow when a cybersecurity incident has or may have occurred, including to allow assessments related to disclosure and notice requirements to be timely made to regulators and affected parties. We have also performed and plan to continue to conduct cybersecurity incident simulation exercises involving members of senior management as part of our cybersecurity risk management program. The Board is provided with an update following a simulation exercise. Our response plans include protocols to notify our Chief Technology Officer ("CTO"), our Chief Legal Officer, other members of senior management as appropriate, and, under certain circumstances, the Audit Committee of our Board, or our full Board as appropriate.

companyName: Bunge Global SA

ticker: BG


text: Our Chief Information Security Officer oversees our cybersecurity program, policies and processes, including those described in "Risk Management and Strategy" above, and works with the information security team and other stakeholders on the prevention, detection, mitigation, response and remediation of cybersecurity incidents, as applicable. As our information security team monitors the security and effectiveness of our policies and processes, they also work to keep the Chief Information Security Officer and other members of leadership informed of critical incidents, process updates, or other material details, in accordance with our internal reporting structure. Our Chief Information Security Officer in turn provides periodic briefings to our Board of Directors regarding our company's cybersecurity risks and activities, which would include recent material cybersecurity incidents and related responses, if any, changes to the risk landscape, and updates or changes to the cybersecurity program. Our Chief Information Security Officer has over 15 years of direct, technical cybersecurity experience in the commercial and government sectors, and holds an undergraduate degree in infrastructure assurance and a graduate degree in information security engineering, as well as certifications in information security. The information security team includes employees with broad ranging experience in cybersecurity threat assessments and detection, incident response, and mitigation and management of various types of threats, including from insiders and nation-state actors.

companyName: Palantir Technologies Inc.

ticker: PLTR


text: We engage consultants, or other third parties in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as monitoring and testing our safeguards. We require each third-party service provider to certify that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.

companyName: CHICAGO RIVET & MACHINE CO

ticker: CVR


text: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our management team works closely with our third-party IT service provider to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

companyName: Algorhythm Holdings, Inc.

ticker: RIME


text: As stated above, the CIO is a member of the ISGC, chairs the ISTC, and reports to the Chief Strategy and Innovation Officer. The CIO has over 40 years of business experience in information technology and cybersecurity. We outsource the position of Chief Information Security Officer "(CISO") to a third-party vendor that specializes in partnering with organizations to enhance cybersecurity management.

companyName: MIDDLEFIELD BANC CORP

ticker: MBCN


text: Voya Financial's information security team is responsible for identifying, assessing, and managing cyber risk, with support from Voya Financial's operational risk management team. Information security control tasks are performed under the direction and guidance of Voya Financial's CISO, who is designated under Voya Financial's risk management principles and policies to oversee the evaluation and mitigation of information security risks. Information security management is integrated into Voya Financial's overall risk management framework, which provides for a coordinated approach to addressing cybersecurity risk.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: TVA's governance, oversight, execution, and support activities include quarterly Enterprise Risk and Assurance updates to the Audit Committee, an annual alignment with TVA's broader risk management framework and business planning initiatives, and tactical and intentional initiatives focused on reducing risk, increasing maturity, and helping ensure regulatory compliance and adherence. TVA engages in various audits in order to provide assurance of TVA's effective management of cybersecurity risk and risk as a whole and is also subject to required external audits to ensure compliance with certain regulatory standards that are designed to protect against cybersecurity incidents.

companyName: Tennessee Valley Authority

ticker: TVE


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program.

companyName: Atea Pharmaceuticals, Inc.

ticker: AVIR


text: We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity. Third-parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional contractual controls.

companyName: REPLIGEN CORP

ticker: RGEN


text: The Audit Committee of the Board of Directors is responsible for overseeing cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Management briefs the Audit Committee on the effectiveness of our cyber risk management program. In addition, cybersecurity risks are reviewed by the Board of Directors, at least annually.

companyName: LIQTECH INTERNATIONAL INC

ticker: LIQT


text: We engaged consultants, or other third parties in connection with our risk assessment processes. These service providers assist us to design and implement our cybersecurity policies and procedures. We have not encountered cybersecurity challenges that have materially impaired our operations or financial standing.

companyName: IDEANOMICS, INC.

ticker: IDEXQ


text: controls for information systems and information on NeurAxis' networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on NeurAxis' networks, including customer information, personal information, PHI/PII, intellectual property and proprietary information.

companyName: Neuraxis, INC

ticker: NRXS


text: The Company's Chief Security Officer ("CSO") and the S&C Team, work collaboratively across the Company to implement a program designed to protect our customer's data and the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response and recovery plans. Through the ongoing communications from these teams, the Chief Security Officer monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and reports such incidents to Senior Leadership and the Audit Chair when appropriate.

companyName: Upland Software, Inc.

ticker: UPLD


text: Enhancing our third-party vendor risk management, we have introduced two distinct capabilities to further safeguard our operations and sensitive data:

companyName: TRANSCAT INC

ticker: TRNS


text: Risk Management and Strategy CACI is committed to maintaining a robust cybersecurity management and oversight program to mitigate cybersecurity risks to our systems and to protect both our and our customer's confidential and sensitive information. We employ technologies and have implemented programs and processes to continually assess, identify, and manage cybersecurity risks as we aim to incorporate industry best practices throughout our cybersecurity program.

companyName: CACI INTERNATIONAL INC /DE/

ticker: CACI


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from management, including leaders from our information security and legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: Oil-Dri Corp of America

ticker: ODC


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature such as data about our research and clinical trials (the Information Systems and Data).

companyName: SCYNEXIS INC

ticker: SCYX


text: Board Oversight and Cybersecurity Governance Our cybersecurity strategy is firmly anchored in a governance structure that emphasizes board oversight. The Board of Directors work to ensure our cybersecurity posture and cybersecurity risks are adequately evaluated and managed in alignment with our business objectives. To this end, the Board receives regular updates on our critical cybersecurity initiatives, risk management practices, and incident response measures. This oversight ensures that cybersecurity remains a top priority at the executive level and that strategic decisions reflect our commitment to safeguarding our digital assets.

companyName: Urgent.ly Inc.

ticker: ULY