text: The Technology Committee, pursuant to its charter, is responsible for the oversight of the Company's management of risks regarding technology, data security, cybersecurity, disaster recovery and business continuity. To perform this function, the Technology Committee, in addition to annually receiving and reviewing the results of the Global Information Security Program assessment, receives quarterly reports from the Company's CISO, who presents a threat matrix, an overall analysis of our cyber health, as well as any recent threat activity. The Technology Committee then, in turn, regularly reports out to the full board of directors and the Audit Committee as necessary during succeeding meetings to keep them informed. In addition, members of senior management, including the Chief Technology Officer ("CTO"), the CISO, and the Chief Legal Officer ("CLO") correspond directly with, or present to, the full board of directors, the Audit Committee, and/or the Technology Committee, regarding issues or risks relating to cybersecurity matters as the case may be. We believe the members of our senior management responsible for assessing and managing material risks from cybersecurity threats and interfacing with the board of directors and board of director committees on such matters collectively possess the appropriate expertise and experience from both a technical and governance perspective to ensure that they are able to carry out these responsibilities effectively. In particular, our CISO has spent over 30 years in various information security roles, including serving as the CISO of WEX since March 2014. Additionally, he holds professional degrees in the areas of Computer and Information Systems Security and multiple ISACA and ISC2 certifications (CISM, CISA, CRISC, CISA and CISSP). Our CTO has spent over 25 years in various engineering and technology roles, including serving as Chief Technology Officer for two other companies prior to joining WEX. In his past roles he was responsible for implementing product and technology initiatives and gained extensive experience in payments technology, technology infrastructure, technical engineering, AI, and machine learning. Additionally, he holds a professional degree in Computer Science. Our CLO has been with WEX since 2021, serving as Chief of Staff to the CEO and as Vice President, Corporate Legal Services prior to that, before becoming the Corporate Secretary and head of the Legal department in 2024. In these roles, she has gained extensive experience coordinating with the Board on addressing numerous emerging risk areas and ensuring our governance processes are equipped to manage and mitigate such risks.

companyName: WEX Inc.

ticker: WEX


text: The CISO is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with senior leadership, which includes our Chief Executive Officer, Chief Financial Officer, Chief Information Officer and Chief Legal & Compliance Officer. The CISO has decades of experience in the cybersecurity and information security fields, including experience with both private and public companies and the military, as well as experience in the transportation and rail industry. In addition, the CISO has ISO 27001 Certification and completed W2CCA Cyber Combat Academy.

companyName: GREENBRIER COMPANIES INC

ticker: GBX

secItem: Item 1C


text: We have previously engaged and currently engage third parties to assess the effectiveness of our cybersecurity and technology management strategy and continue to seek to implement new, and improve existing, processes regularly to adjust for changes in technology, internal or external threats, business strategy, and regulatory requirements. We, and our third parties, have deployed managed detection and response services to monitor our technology infrastructure and information systems for possible threats. Our technology management strategy also includes ongoing security training and education for employees regarding threats, including their role and responsibility in detecting and responding to such threats.

companyName: Checkpoint Therapeutics, Inc.


text: We may use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms (including legal counsel) and threat intelligence service providers.

companyName: Equillium, Inc.

ticker: EQ


text: Material Impact of Cybersecurity Risks We have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors— Risks to our Business— We are dependent on information technology and our systems and infrastructure face certain risks, including from cybersecurity breaches and data leakage."

companyName: SANUWAVE Health, Inc.

ticker: SNWV


text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CISO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CISO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and overseen by our information technology function, that are designed to help protect our information assets and operations from internal and external cyber threats, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular exercises and tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. We engage certain external parties, including consultants, computer security firms and risk management experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.

companyName: Generation Bio Co.

ticker: GBIO


text: Material Impact of Cybersecurity Risks In the last three fiscal years ended December 31, 2024, we have not experienced a material information security breach incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, future incidents could have a material impact on our business strategy, results of operations or financial condition. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Risks related to our Business and Structure — We are subject to cybersecurity risks and incidents that may adversely affect our operations, the operations of RCM or the companies in which we invest. A failure in our, or RCM's, cybersecurity systems could impair our ability to conduct business and damage our business relationships, compromise or corrupt our confidential information and ultimately negatively impact business, financial condition and operating results."

companyName: RAND CAPITAL CORP

ticker: RAND


text: The Company and each of its consolidated subsidiaries/affiliates are responsible for developing a cybersecurity program appropriate for their respective businesses. The design of these cybersecurity programs is informed by the ISO 27001 standards and the Center for Internet Security Critical Security Controls framework ("CISCSC"). This does not imply that these programs meet all specifications of ISO 27001 and CISCSC, but rather that we use them as a guide to help us identify, assess and manage cybersecurity risks relevant to our business. The cybersecurity programs developed by the Company and its consolidated subsidiaries/affiliates include, among other things, (i) advanced threat protection and detection systems; (ii) vulnerability scanning and testing of network defenses; (iii) user authentication, role-based access and privileged access management; (iv) data encryption, loss prevention, backup and recovery mechanisms; (v) employee testing and training; (vi) technical and business team-focused incident response tabletop exercises; (vii) disaster recovery testing and (viii) security assessments of third-party service providers. White Mountains engages both its internal auditors and third-party information security experts to assist management in assessing the effectiveness of these cybersecurity programs.

companyName: WHITE MOUNTAINS INSURANCE GROUP LTD

ticker: WTM


text: Board Oversight of Cybersecurity Risks The Board of Directors receives a report from the Sponsor detailing the Sponsor's annual due diligence on GLDM's service providers, including a summary of any potential operational or cybersecurity risks and any incidents which could impact GLDM. The Board of Directors also periodically receives reports from World Gold Council and GLDM's service providers regarding their cybersecurity programs.

companyName: World Gold Trust

ticker: GLDM


text: We use a multi-layered defensive cybersecurity strategy based on best practices to identify risks, protect technology assets, detect anomalies, respond to, and recover from cybersecurity incidents. Our processes to identify, assess, and manage material risks from cybersecurity threats includes the following: • Identify - We identify risks from cybersecurity threats by first developing and maintaining an understanding of assets and systems essential to our operation and reputation, as well as assets and systems that could provide value to threat actors. Any attempt by a threat actor is considered a potential risk if a threat actor can use it to reduce the value of an asset, reduce our ability to utilize or otherwise access the value of an asset, or surreptitiously gain or increase their access to an asset or system which would result in decreased information security or a disruption in our operations. • Assess - We assess risks from cybersecurity threats by evaluating exposure of our assets to identified cyber risks, as well as potential impacts to our operations or reputation from our inability to access or utilize an asset or system, or a threat actor's ability to gain access to an asset or system. We further evaluate the potential materiality of these risks based on the potential impact to our operations or reputation. • Manage - We mitigate risks from cybersecurity threats by applying multiple layers of defense to maximize our continued ability to access or utilize an asset or system and minimize threat actors' ability to gain or increase their access to an asset or system. We prioritize defensive mechanisms, including administrative, physical, and technical controls, according to their relative cost and reduction in risk.

companyName: Knight-Swift Transportation Holdings Inc.

ticker: KNX


text: CBIZ faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations or cash flows. CBIZ has experienced, and will continue to experience, cyber incidents in the normal course of its business. However, prior cybersecurity incidents have not had a material adverse effect on CBIZ's business, financial condition, results of operations or cash flows. See "Risk Factors – Risk Factors Related to Our Business and Industry – Cyber-attacks or other security breaches involving our computer systems or the systems of one or more of our vendors could materially and adversely affect our business."

companyName: CBIZ, Inc.

ticker: CBZ


text: The Company's information is primarily maintained by PSCM, which has implemented robust information security controls, frequent testing, periodic assessments and advanced monitoring of information security threats to protect the Company's sensitive information. In addition, PSCM has formed an Information Security Committee (the "InfoSec Committee"), which consists of the Chief Technology Officer, the Chief Compliance Officer, the President and a Compliance Officer. The InfoSec Committee is responsible for developing and overseeing the implementation of controls, policies and procedures, evaluating and addressing ongoing information security-related risks and periodically reviewing the effectiveness of the information security policies and procedures that protect the Company's information. In preparing and approving PSCM's information security policies and procedures, the InfoSec Committee has relied upon guidelines published by the National Institute of Standards and Technology and the International Organization for Standardization, guidance issued by the SEC and National Futures Association and industry practice. The InfoSec Committee provides periodic reports to the Board which include updates on cyber risks and threats, system upgrades, assessments of the information security program and the emerging threat landscape.

companyName: Pershing Square SPARC Holdings, Ltd./DE


text: Periodically, our systems are subject to targeted attacks which are intended to interrupt our operations or may lead to the loss, misuse or theft of personal information relating to our employees, suppliers and customers or lead to the loss of Company data, confidential information or our intellectual property.

companyName: INNOSPEC INC.

ticker: IOSP


text: • Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats. • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO. The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis. Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members. The Internal Audit team oversees internal controls implemented by us under our information security program. • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer). • The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management. Management, including those serving on our Information Security Governance Committee, is responsible for hiring appropriate cybersecurity personnel, helping to integrate cybersecurity considerations into our overall risk management strategy, providing appropriate resources for cybersecurity risk management, and communicating key priorities to relevant personnel. Our cybersecurity incident response plan includes processes designed to escalate certain cybersecurity incidents that caused a significant impact to us to members of the Information Security Governance Committee, and certain members of executive management depending on the circumstances. In addition, our incident response plan includes reporting to the Audit Committee for certain cybersecurity incidents, including those that have potentially had a material impact to us.

companyName: Jazz Pharmaceuticals plc

ticker: JAZZ


text: Cybersecurity reviews are embedded into the Company's Third-Party Risk Management program. Generally under this program, third parties that process personal data or high-risk business data on behalf of the Company complete privacy and cybersecurity assessments on a risk basis, which may require such third parties to sign data processing agreements, comply with particular security controls or complete an additional security and privacy assessment.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: Identifying the appropriate team and any appropriate sub-teams to address specific information and/or cyber security incidents, or categories of information and/or cyber security incidents.

companyName: JUNIATA VALLEY FINANCIAL CORP

ticker: JUVF


text: Role of Management Management has implemented risk management structures, policies, and procedures and is responsible for NTIC's day-to-day cybersecurity risk management. NTIC's Information Technology Director, who possesses a strong foundation in cybersecurity through prior managerial experience and specialized training, oversees the daily assessment and management of cybersecurity risks. NTIC employs best practices, including real-time monitoring, anti-virus protection, and ongoing patch management across all systems. System maintenance is performed in accordance with industry standards and aligned with recognized best practices. Because cybersecurity threats continue to evolve, NTIC's implemented measures are designed to be flexible and adaptable to respond to changes in the security landscape. The following security measures give some insight as to what has been implemented: Multifactor authentication Phishing simulations User permissions auditing and tightening Proactive blocking of high-risk email Active monitoring of user sign-in On-premises endpoint reduction Endpoint detection and response Licensing, network, and hardware compliance management

companyName: NORTHERN TECHNOLOGIES INTERNATIONAL CORP

ticker: NTIC


text: Our Board of Directors keeps apprised of and oversees technology risk and cybersecurity of the Company. The Board receives updates from the Company's Information Security Officer ("ISO") on a quarterly basis and receives cybersecurity training on at least an annual basis. While the entire Board receives reporting and receives training, the Board has delegated certain specific responsibility for overseeing cybersecurity threats, among other things, to its Risk Committee. Our ISO and Chief Risk Officer provide the Risk Committee and the Company's internal Enterprise Risk Management Committee periodic and as needed reports on our cybersecurity risks and cybersecurity incidents, if any.

companyName: First Internet Bancorp

ticker: INBK


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on industry practices and accepted frameworks (e.g. the NIST framework).

companyName: Global Net Lease, Inc.

ticker: GNL


text: Unauthorized access to or theft of sensitive customer information, resulting in legal and regulatory implications; and Damage to our brand and reputation, which could affect customer trust and investor confidence.

companyName: URBAN ONE, INC.

ticker: UONE


text: In addition, the audit committee regularly engages with our Senior Director of Cybersecurity and other relevant stakeholders to stay informed about the evolving threat landscape. The frequency of these additional meetings and reports vary to align with the dynamic nature of cybersecurity threats and the need for timely decision-making. This ensures the highest levels of management are kept abreast of the potential cybersecurity risks, and significant cybersecurity matters, and that strategic risk management decisions are escalated to the Board, ensuring they have comprehensive oversight and can provide guidance on critical cybersecurity issues. In addition to meeting with the audit committee, the Senior Director of Cybersecurity and Cybersecurity Core Team conducts regular cybersecurity updates given to different groups of employees and management to promote awareness and accountability. These updates include risk assessments, tabletop exercises, incident response plans, and ongoing security initiatives. Further, recognizing employees' critical role in cybersecurity, Snap One invests in training and awareness programs that empower employees to recognize and mitigate potential cyber risks, fostering a culture of cybersecurity throughout the organization.

companyName: Snap One Holdings Corp.


text: Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Board's Technology and Cybersecurity Committee (the "Technology and Cybersecurity Committee"). The Technology and Cybersecurity Committee oversees management's design, implementation and enforcement of our information technology systems and cybersecurity risk management program. Our Technology and Cybersecurity Committee meets and reports to the full Board at least quarterly.

companyName: SolarWinds Corp


text: Cybersecurity is an ongoing priority, and we remain focused on our obligation to assess, identify and manage risks from cybersecurity threats and cybersecurity incidents. We have developed and implemented a cybersecurity risk management program that employs a multitude of measures and processes that aid in these efforts. This program is designed to protect our information systems, detect cybersecurity threats and ensure our compliance with applicable privacy and cybersecurity laws.

companyName: Compass, Inc.

ticker: COMP


text: To date, we are not aware of any risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Fluence. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information on potential cybersecurity risks, please see Part I, Item 1A "Risk Factors" for the risk factor entitled "Our business depends on our ability to implement improvements to and properly maintain and protect the continuous operation and data integrity of our information technology infrastructure, data, and other business systems and the inability to do so may have a material adverse effect on our reputation and harm our business prospects, financial conditions, and operating results."

companyName: Fluence Energy, Inc.

ticker: FLNC


text: We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition.

companyName: Paysign, Inc.

ticker: PAYS


text: The Company's cybersecurity measures are primarily focused on ensuring the security and protection of its information technology systems and data. The Company's information security program is managed by a dedicated Chief Information Security Officer (CISO), whose group is responsible for leading enterprise-wide cybersecurity risk management, strategy, policy, standards, architecture, and processes. The CISO has worked in the cybersecurity and national security fields for more than 30 years. He has a Master of Science in Telecommunications and Computers. He has served as a board member of the Health Information Sharing and Analysis Center for 10 years. Oversight of the information security program has been integrated into the Company's overall enterprise risk management program.

companyName: Merck & Co., Inc.

ticker: MRK


text: The comprehensive set of cybersecurity policies and standards maintained by the cybersecurity team includes a security incident response framework. The framework is a set of coordinated procedures and tasks that the InterDigital incident response team executes to ensure timely and accurate reporting and resolution of computer security incidents. The framework details who, how and when appropriate persons or committees, including the CIO, cybersecurity steering committee, and Audit Committee are kept informed on the status of potential cybersecurity incidents. The CIO also presents a summary of recent incidents at each regular Audit Committee meeting.

companyName: InterDigital, Inc.

ticker: IDCC


text: We have not been a victim of a cyber attack or other cybersecurity incident that has had a material impact on us, our business strategy, results of operations or financial condition; however, we have from time to time experienced non-significant cybersecurity events, including attempted denial of service attacks, malware infections, phishing, subversion of internal security controls and other information technology events that are typical for an electronic financial services company of our size. An actual, threatened or perceived cyber attack or breach of our security could materially affect us, including our business strategy, results of operations and financial condition in many ways, including through the loss of clients or client confidence, expenditure of significant costs to repair system, network or infrastructure damages as well as to protect against future cyber attacks, security breaches or harm and potential litigation or other claims or actions, including from regulatory agencies. These risks extend to the third parties we rely on to provide certain services, including technology services, to us. Please see Part I, Item 1A. —"Risk Factors—Risks Relating to the Operation and Performance of Our Business—We rely on third parties to perform certain key functions, and their failure to perform those functions could result in the interruption of our operations and systems and could result in significant costs and reputational damage to us." For additional information regarding risks related to cybersecurity threats, see also Part I, Item 1A. – "Risk Factors — Risks Relating to Cybersecurity and Intellectual Property Actual or perceived security vulnerabilities in our systems, networks and infrastructure, breaches of security controls, unauthorized access to confidential or personal information or cyber attacks could harm our business, reputation and results of operations" and "— Systems failures, interruptions, delays in service, catastrophic events and resulting interruptions in the availability of our platforms or solutions could materially harm our business and reputation."

companyName: Tradeweb Markets Inc.

ticker: TW


text: Information Security Management System We maintain a comprehensive Information Security Management System (ISMS) that is designed to ensure the confidentiality, integrity, and availability of customer data, corporate data (such as intellectual property or source code), employee data, and our systems. Our ISMS is founded on the following industry-leading and regulatory standards: • ISO 9001:2015 – Quality Management Systems • ISO/IEC 27001:2013 – Information Security Management • SOC2 Type II – System and Organization Controls • SEI Capability Maturity Model Integration (v1.3) • IT Infrastructure Library (ITIL) version 3 • ICH Q9 – Quality Risk Management We have achieved ISO 27001 certification for our ISMS, which is managed by our CISO. As a data processor, we are the custodian of customer information that can be both confidential and sensitive. We are also certified to ISO 27018 for privacy controls.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: During the year ended March 31, 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we may not be aware of all vulnerabilities or might not accurately assess the risks of incidents, and such preventative measures cannot provide absolute security and may not be sufficient in all circumstances or mitigate all potential risks.

companyName: UNIVERSAL SAFETY PRODUCTS, INC.

ticker: UUU


text: The CISO is responsible for identifying and reporting any cybersecurity incidents to the Disclosure Committee. The Disclosure Committee is composed of senior executives from across Horace Mann and has oversight over SEC disclosure controls. After notification, the Disclosure Committee or designated subgroup would review known information and develop an action plan, which would include Board outreach, expert retention, insurance notification, communication plans, and a materiality assessment.

companyName: HORACE MANN EDUCATORS CORP /DE/

ticker: HMN


text: Risks from Cybersecurity Threats Like other companies in our industry, we face several cybersecurity risks in connection with our business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial condition, to date, we have, from time to time, experienced threats to and security incidents related to our data and systems, including denial of service and phishing attacks.

companyName: AppTech Payments Corp.

ticker: APCX


text: O ur Senior Director of Information Technology, who reports to our Vice President, Corporate Affairs and Human Resources, is primarily r esponsible for assessing and managing our material risks from cybersecurity threats. Our Senior Director of Information Technology has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Their experience includes 25 years of experience in information technology, and 8 years specifically involved in cybersecurity matters, as well as experience in security program development and review, implementation of security tools and software, security risk identification and remediation, incident identification and remediation, as well as managing enterprise risk. In addition, we rely on third party cyber security consultants and legal counsel to supplement our expertise.

companyName: scPharmaceuticals Inc.


text: In parallel with our Code of Integrity, we have created and posted publicly, and incorporate into vendor contracting, our Third-Party Code of Conduct for our contractors, subcontractors, and other vendors and suppliers, which holds R1's third parties to the same applicable data and privacy standards as R1. We request Attestations of Compliance and execute HIPAA-compliant Business Associate Agreements in these contexts as appropriate.

companyName: R1 RCM Inc. /DE


text: Our management team, including the CISO, Data Privacy Officer (DPO), CCO (Chief Customer Officer) and Chief Product Officer (CPO), is responsible for the assessment and mitigation of cybersecurity threats and overseeing both our internal security personnel and external cybersecurity consultants. Our management team's cumulative experience includes decades working in cybersecurity and information security, including in the government and public and private companies, and overseeing risk management generally. Among other things, our CISO is a graduate of the Technion's Information Security Program as a Technion Certified CISO and brings vast experience as former Security Specialist in the U.S. Department of State, Senior Lead Information Security Architect at one of the Israeli leading banks, and Head of Cyber Architecture, Engineering and Research Group at one of the leading Israeli Aerospace and Defense companies. The team reporting to our CISO further includes experienced specialists in the area of Cyber Forensics and Counterterrorism and Network Security Engineers holding B.S. Computer Science Degrees and other relevant certifications.

companyName: KALTURA INC

ticker: KLTR


text: The individuals involved in our cybersecurity risk management program are informed about developments in cybersecurity risks and related matters through a variety of channels inside the Company, including but not limited to, briefings from internal teams and alerts and reports produced by various measures we may deploy, as well as information obtained from external sources in the government and private sector, including external third party consultants retained by Axos.

companyName: Axos Financial, Inc.

ticker: AX


text: In addition to the enterprise risk management process, we utilize an additional cybersecurity risk management process that assesses the risks and protections of several key assets within the organization. As a result of these assessments and as the threat landscape becomes increasingly sophisticated, we continue to evolve our defensive strategy by deploying new technology, continuing education of our user community, and advancing our protections against ongoing cybersecurity risks and threats. We leverage threat intelligence and external industry practices for continuous improvement and refinement of our cybersecurity program.

companyName: ITC Holdings Corp.


text: The Audit Committee of our Board, or Audit Committee, is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. Members of the Audit Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Potential material cybersecurity threat risks are also considered during Board meeting discussions of important matters like risk management, business continuity planning, and other relevant matters.

companyName: ACHIEVE LIFE SCIENCES, INC.

ticker: ACHV


text: Assessing and Responding to Cyber Threats and Cyber Incidents Our IRP sets forth the company's process for assessing cyber threats. The IRP serves as the incident response plan for Higher-Risk Security Incidents affecting Wish Information Systems and Wish Data, and it applies to all Wish personnel, including employees, contractors, consultants, and any other individuals acting for or on behalf of the Company of its subsidiaries or affiliated entities anywhere in the world. Lower-Risk Security Incidents are managed by the IT/Engineering Teams under their internal processes. The IRP assesses and responds to cyber threats by the following, to the extent applicable, (1) review from the initial assessment team, (2) escalation to a core incident response team, (3) involvement of the extended incident response team, (4) initial containment and preservation, (5) investigation, (6) breach notification, (7) remediation and resumption, and (8) post-mortem assessment.

companyName: ContextLogic Inc.


text: The Company's Board of Directors oversees management's cybersecurity strategy. Management provides a full briefing on various cybersecurity risk matters including risk assessments, mitigation strategies, areas of emerging risk and other areas of importance at least annually if material. In the event of a cybersecurity incident determined to be significant, management will notify the Board.

companyName: TANDY LEATHER FACTORY INC

ticker: TLF


text: In addition, based on our investigation of the incident, we became aware that ransomware actors may have exfiltrated personal information from our systems. We provided notifications to individuals and to regulators in accordance with applicable laws, and we may be required to provide additional notifications in the future.

companyName: MKS INC

ticker: MKSI


text: Security Assessments – Various company environments are regularly audited by a third-party AICPA- and PCAOB-registered certified public accounting firm and has consistently obtained PCI DSS, SSAE18 SOC1, SOC2, CSAE34-16 SOC1 and SOC2 certifications and HIPAA compliance. The Company currently holds 20 such certifications.

companyName: CINCINNATI BELL INC


text: Cybersecurity threats are identified, assessed, and monitored by our Security Operations Center, which is staffed with cybersecurity professionals who report to the Company's Chief Information Security Officer (CISO), and includes resources provided by external vendors to cover continuous monitoring. When a cybersecurity threat or incident meets certain categorized thresholds, as determined by our Cybersecurity Incident Response Plan, we follow an escalation review process which can result in our CISO forwarding the threat or incident to our cybersecurity crisis response team consisting of our CEO, CFO, CHRO, CIO, and General Counsel (the "Crisis Response Team"). Our CISO and the Crisis Response Team, pursuant to guidance from our CISO, assess and manage our response to cybersecurity threats and incidents. Our CISO follows a risk-based escalation process to notify our General Counsel of certain cybersecurity threats and incidents, and our General Counsel analyzes our obligation to report any incident publicly. If the General Counsel determines disclosure is warranted, she reports this conclusion to the CISO, the Crisis Response Team, and the Company's Public Disclosure Committee for consideration and disclosure.

companyName: LEGGETT & PLATT INC

ticker: LEG


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response standard.

companyName: SLM Corp

ticker: SLM


text: Role of the Board of Directors and the Cybersecurity Committee As part of the Board of Directors' role in overseeing the Company's enterprise risk management program, which includes our cybersecurity risk management program, the Board is responsible for exercising oversight of management's identification and management of, and planning for, material cybersecurity risks that may reasonably be expected to impact the Company. While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Cybersecurity Committee of the Board, or the Cybersecurity Committee. The Cybersecurity Committee is responsible for overseeing our information technology systems and cybersecurity risks, including plans and programs relating to cyber and data security and legal and regulatory risks associated with our products and business operations. The Cybersecurity Committee is informed of the Company's cybersecurity risk management and receives an overview of its cybersecurity program from management at least quarterly, which covers topics including, among others, recent cybersecurity risk landscape and trends, data security posture, results from third-party assessments, training and vulnerability testing, our cybersecurity and compliance program, critical cybersecurity risks, as well as the steps management has taken to respond to such risks, emerging cybersecurity regulations, technologies and best practices. Material cybersecurity risks are also discussed during separate Board meetings as part of the Board's risk oversight generally.

companyName: N-able, Inc.

ticker: NABL


text: Our cybersecurity program addresses potential risks and implements processes to support our cybersecurity program and respond to potential cyber incidents. Our cybersecurity program is managed by our senior management with support from third-party providers that provide relevant expertise, certifications and skills in cybersecurity. Quarterly risk assessments are performed and incorporated as part of our overall risk management process, which is overseen by our Board of Directors. Our third-party providers provide regular data protection and cybersecurity reports to our senior management who then reports to the Audit Committee and the Board of Directors on a regular basis. These reports include updates on cybersecurity initiatives, cybersecurity metrics and threat landscape.

companyName: HIGHWATER ETHANOL LLC


text: We utilize expert cybersecurity independent consultants, including a contracted Chief Information Security Officer ("CISO") and additional third-party managed service providers, who work with and report to our Vice President of Accounting and Administration ("VPAA") to identify potential risks from cybersecurity threats and proactively mitigate their potential impact. The CISO and related team have extensive experience in assessing, detecting, responding and mitigating cybersecurity risk, including holding several different relevant certifications as well as experience working with, and assessing cybersecurity risk of, IT managed service providers.

companyName: VICI PROPERTIES INC.

ticker: VICI


text: DPL Inc. and AES Ohio We face cybersecurity risks in connection with our business. Although such risks have not materially affected us to date, we have, from time to time, experienced threats to and breaches of our data and systems. For more information about the cybersecurity risks we face, see the risk factor entitled Cyber attacks and data security breaches could harm our business in Item 1A—Risk Factors of this Annual Report on Form 10-K.

companyName: DAYTON POWER & LIGHT CO


text: As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers under the supervision of our board of directors and its committees. Our executive officers are senior investment professionals provided to us through our Manager pursuant to our management agreement with our Manager. Our business is highly dependent on the communications and information systems of our Manager, its affiliates and third-party service providers. Our Manager is an affiliate of ORIX USA, a diversified financial company and subsidiary of ORIX and participates in and is subject to ORIX USA's cybersecurity program. Accordingly, we rely and Manager relies on ORIX USA and its cybersecurity risk management program to identify, assess and manage material risks to our business from cybersecurity threats.

companyName: Lument Finance Trust, Inc.

ticker: LFT


text: We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is owned by the Chief Information Security Officer ("CISO") and is supported by both management and our board of directors.

companyName: RingCentral, Inc.

ticker: RNG


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation. Our incident response plan requires that suspected cybersecurity incidents are promptly reported to our Controller and Chief Human Resource Officer and includes an escalation path to our Chief Executive Officer, executive leadership team, and Board of Directors.

companyName: Spero Therapeutics, Inc.

ticker: SPRO


text: The Company engages third-party assessors, consultants, and auditors to assist in assessing, identifying, and managing risk from cybersecurity threats. Third parties assist the Company by (i) providing regular penetration testing and vulnerability assessments; (ii) assessing and maintaining our formal incident response policies, including the use of tabletop testing; and (iii) providing multiple sources of threat intelligence information that are fed directly into our technical security platforms and our awareness campaigns, including ongoing network monitoring. The Company also has a comprehensive third-party information security audit program in place.

companyName: Alcoa Corp

ticker: AA


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we have been able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of the third-party networks and systems we use, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. See "Item 1A–Risk Factors–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our reputation and business relationships could be damaged, which could adversely affect our financial condition and operating results."

companyName: Public Storage

ticker: PSA


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned, or otherwise identified as potentially corrupt.

companyName: Criteo S.A.

ticker: CRTO


text: Board of Directors The board of directors oversees our processes for assessing and managing risk. Our audit committee is responsible for reviewing and discussing our practices with respect to risk assessment and risk management, including risks related to information technology and cybersecurity. The board of directors and audit committee periodically review the measures implemented by us to identify and mitigate risks from cybersecurity threats. As part of such reviews, the board of directors and audit committee receive reports and presentations from those responsible for overseeing our cybersecurity risk management, including the Managing Director, Head of Information Technology ("Head of IT") and our Legal team, which may address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers, industry participants, service providers and other third parties. The Head of IT also periodically presents to the board of directors and audit committee, including to describe our information security infrastructure and improvements made, and to report on any significant developments. From time to time, external legal advisers provide education to the board of directors and/or audit committee in respect of information security related developments and to provide training in respect of directors' responsibilities. We have a framework under which certain cybersecurity incidents are escalated and, where appropriate, reported to the board of directors or audit committee in a timely manner.

companyName: StepStone Group Inc.

ticker: STEP


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program utilizes the CIS Critical Security Controls framework, as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.

companyName: DYNATRONICS CORP

ticker: DYNTQ


text: Our Director of IT meets with the IT Steering Committee monthly to review our information technology systems and discuss key cybersecurity risks. In addition, quarterly the Director of IT reviews our entire risk management program, which includes cybersecurity risks, with the IT Executive Steering Committee and the Board of Directors.

companyName: Babcock & Wilcox Enterprises, Inc.

ticker: BW


text: Our Vice President of Information Technology leads our cybersecurity strategy, programs, and risk management processes. With over 30 years of experience in IT, including 15+ years in cybersecurity, the Vice President provides strategic oversight and ensures alignment with industry best practices. This role is supported by a team of cybersecurity professionals with formal training and specialized expertise, as well as partnerships with managed security service providers focused on proactive threat detection, incident response, and risk mitigation.

companyName: Comstock Holding Companies, Inc.

ticker: CHCI


text: We engage in the periodic assessment and testing of policies, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include audits, assessments and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures. We revise our policies or practices as appropriate based on the results of such assessments or testing.

companyName: MARIN SOFTWARE INC


text: carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.

companyName: TMC the metals Co Inc.

ticker: TMC


text: In addition, product teams and business unit leaders are involved in cybersecurity risk management during product development with support from our enterprise-wide security team supervised by the CISO.

companyName: GoDaddy Inc.

ticker: GDDY


text: Employee Error or Misuse As cyber-attacks and phishing scams are becoming more advanced, employees may fail to recognize the signs of a cyber-attack or rely solely on the Company's IT defenses.

companyName: LUXFER HOLDINGS PLC

ticker: LXFR


text: The Information Security team utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party managed services and/or solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Management Oversight — We have implemented a cross functional ISMS governance committee that drives awareness and alignment across broad governance and stakeholder groups for effective cybersecurity risk management. The CSO and acting Data Privacy Officer ("DPO") co-chair the ISMS Governance Committee. The ISMS Governance Committee acts in alignment with the Data Protection Governance Committee, another cross-functional governance committee, which provides strategic direction and oversight over the company's program related to data protection. These governance committees have responsibility for oversight, resource allocation, capabilities and planning. Members of the ISMS committee review newly identified cybersecurity risks, evaluate the appropriate treatments, monitor the on-going status of risk remediation. The CSO and acting DPO regularly report to the audit committee on these matters.

companyName: Chrome Holding Co.

ticker: MEHCQ


text: Our management periodically evaluates information provided by its consultants on evolving cybersecurity risks and, based on its assessment of the processes the Company has put in place, does not believe there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations, or financial condition. Further, we did not have any cybersecurity incidents in fiscal year 2025.

companyName: Rezolute, Inc.

ticker: RZLT


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and managed through a multi-faceted approach including third-party assessments, internal IT Audit, IT security, governance, risk and compliance reviews. To defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security (including our consumer products) and implement appropriate changes.

companyName: FAIR ISAAC CORP

ticker: FICO


text: The Committee receives quarterly reports from management on our cybersecurity risks, and also receives, at least annually, a detailed briefing from management on our cyber risk management program's status including all strategic initiatives. In addition, management updates the Committee, as necessary, regarding potentially significant cybersecurity incidents consistent with written escalation protocols, as well as incidents with lesser impact potential. The Committee members also receive presentations on cybersecurity topics from our Chief Compliance Officer, Chief Information Officer, internal security staff or external experts as part of the Board's continuing education on topics that impact public companies. The full Board and the Governing Body receive regular updates regarding the Committee's activities.

companyName: Endeavor Group Holdings, Inc.


text: Cybersecurity threats haven't significantly impacted our operations, and we don't anticipate such risks materially affecting our business, strategy, financial condition, or results of operations. However, given the escalating sophistication of cyber threats, our preventive measures may not always suffice. Despite well-designed controls, we acknowledge the inability to foresee all security breaches, including those stemming from third-party misuse of AI technologies, and the potential challenges in implementing timely preventive measures. Please refer to Item 1A: Risk Factors for further insights into cyber attack-related risks.

companyName: AgEagle Aerial Systems Inc.

ticker: UAVS


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: Company's Board, together with management, is engaged in our cybersecurity monitoring managed by our third-party provider and it is constantly changing. Any issues are appropriately addressed timely.

companyName: Nexentis Technologies Inc.

ticker: NXTS


text: Information Technology and Cybersecurity Our business relies on the secure electronic transmission, storage and hosting of sensitive information, including personal information, financial information, intellectual property, and other sensitive information related to our customers and workforce. Given the importance of cybersecurity to our business, we maintain a comprehensive information technology and cybersecurity program to increase both the effectiveness of our systems and our preparedness for cybersecurity risks, including security monitoring for internal and external threats to bolster the confidentiality, integrity and availability of our information assets. We regularly perform evaluations of our cybersecurity program, including periodic internal and external audits, penetration tests and incident response simulations, and our information technology infrastructure and cybersecurity management system are subject to external program assessments on a regular basis. In 2017, we adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to bolster our cybersecurity management system and reduce cybersecurity risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART


text: Management and Strategy have recently implemented additional security measures as part of an evolving cybersecurity posture and will continue to devote resources to address security vulnerabilities in an effort to prevent cyberattacks and mitigate the damage that could result from such an attack.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: The Audit Committee of our board of directors provides direct oversight over cybersecurity risk, and provides updates to the board of directors regarding such oversight. The Audit Committee receives updates quarterly from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Our information services department, led by our IT Director, manages and continually enhances our information systems with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. We work to install new and upgrade existing information technology systems. We recognize the importance of preventative controls in mitigating the risk from cybersecurity threats and have implemented measures such as anti-virus security, two-factor authentication, web filtering, browser isolation tools, and mobility safeguards to enable enhanced security on personal devices. In addition, we provide mandatory cybersecurity training to our employees around phishing, malware, and other cybersecurity risks to ensure that we are protected, to the greatest extent possible, against cybersecurity risks and security breaches.

companyName: BOISE CASCADE Co

ticker: BCC


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the designated IT personnel and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. Designated IT personnel are also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.

companyName: Smart Sand, Inc.

ticker: SND


text: We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past, and we could in the future experience similar attacks. For additional information regarding the ransomware attack we announced on May 31, 2022, see the section captioned "Overview - Ransomware Attack" under Part II, Item 7 "Management's Discussion and Analysis of Financial Condition and Results of Operations " below. Other than this ransomware attack, as of the date of this report and for the years presented, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operations or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Operational Risks - Any inadequacy, interruption, integration failure, breach or cybersecurity incident with respect to our information technology could harm our ability to effectively operate our business and have a material adverse effect on our business, results of operations, financial condition and cash flows" under Part I, Item 1A "Risk Factors" above.

companyName: Hanesbrands Inc.


text: We test for and resolve weaknesses and vulnerabilities within our systems and applications by using network and infrastructure vulnerability testing and adversary emulation, also known as red teaming, and hire a third party to do the same at least once a year. We also undergo a third party maturity assessment of our information security program every two years and a third party enterprise penetration test annually. We leverage external resources to help define information security and technology standards for our environment.

companyName: PRINCIPAL FINANCIAL GROUP INC

ticker: PFG


text: Our Board of Directors and management consider information security and cybersecurity as high priorities in our strategic and operational plans. We understand the critical nature of the confidentiality, integrity, and availability of customer and bank sensitive information. Any loss of confidentiality, integrity, or availability introduces operational, compliance, strategic, transactional, reputational, legal, and capital risks which we actively seek to avoid. It is understood that any one of these risks, if realized, will have a negative impact upon Quaint Oak Bancorp and Quaint Oak Bank. Our approach to information and cybersecurity is proactive and strives to avoid incidents where possible through the use of technical, administrative, and physical controls.

companyName: QUAINT OAK BANCORP, INC.

ticker: QNTO


text: We conduct risk assessments, penetration tests, and other security assessments to identify cybersecurity threats regularly, and in the event of a material change in our business practices that may affect information systems potentially vulnerable to such cybersecurity threats. These assessments include the identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. Risks are then assigned to the appropriate owners for tracking and mitigation.

companyName: Autodesk, Inc.

ticker: ADSK


text: Response Plans and Procedures. We maintain cybersecurity incident response procedures that identify the activities and escalation processes to be implemented upon detection of a cybersecurity incident, and we routinely practice these activities and processes. We also have business and technology continuity plans and a crisis management plan, which we test on a regular basis.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: We have implemented and maintain a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and includes the following key elements: • We perform risk assessments designed to help identify material cybersecurity risks to our critical systems and services, and where appropriate, we engage external experts and consultants to assist us in performing certain of these risk assessments; • Our cybersecurity team is composed of security and infrastructure engineers and compliance personnel. This team is principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our responses to cybersecurity incidents; • We use external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • We conduct cybersecurity awareness trainings for employees who have access to our IT systems; • We maintain a cybersecurity incident response plan and a security operations function so we can respond to cybersecurity incidents; and • We have implemented a third-party risk management process for key third-party service providers. This includes, among other things, conducting security assessments of key third-party service providers, including prospective third-party service providers, prior to entering into or renewing business transactions with them or providing them access to our data or information systems and imposing contractual restrictions on such providers as appropriate based on their risk profile.

companyName: Maplebear Inc.

ticker: CART


text: The CISO is accountable for managing the Information Security department and the information systems and cyber security program. The responsibilities of Information Security include overseeing the design, implementation, ongoing enhancement, monitoring, and testing of the Company's information systems and cyber security program to ensure the confidentiality, availability, and integrity of information assets in accordance with applicable laws, regulations, and regulatory guidance. Information Security establishes appropriate standards for information system security and access, and develops and implements relevant policies, procedures, and controls to ensure such standards are maintained. The Information Security department has overall responsibility for security awareness and training programs, business continuity analysis and planning, and initial assessment and periodic monitoring of key third-party technology service providers, as well as data classification and risk assessments related to information and cyber security. Information Security also provides guidance on and participates in incident response planning and protocols.

companyName: LAKELAND BANCORP INC


text: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual security requirements. The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management, including information technology and cybersecurity. The Audit Committee routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends, and regulatory developments from the CIO.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: We are highly focused on cybersecurity awareness and perform annual certification of our employees, execute ongoing phishing campaigns, intervene with phish-prone individuals, publish monthly cybersecurity newsletters, and participate in Cybersecurity Awareness Month, in October each year.

companyName: Ribbon Communications Inc.

ticker: RBBN


text: Our current CISO is a veteran security professional with over 30 years of information technology and information security experience. Prior to joining 1st Franklin, she worked at one of the largest banks in Canada and the U.S., where she was initially the Head of Application Security and later the Head of Cyber Innovation and Emerging Technologies. Prior to that, she also worked for two multinational banks in New York City in information security and information technology roles. The CISO is supported by a team of highly technical and experienced security professionals who are responsible for implementing and maintaining the security program for 1st Franklin, including security engineers, a cybersecurity analyst and a VP of Information Security.

companyName: 1st FRANKLIN FINANCIAL CORP


text: We rely on third parties, including cloud vendors, for various business functions. Our third-party services providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting diligence when onboarding vendors. Vendors are assessed for risk based on the nature of their service, and access to our data and systems and, based on that assessment, we may conduct additional diligence including security questionnaires and other technical evaluations.

companyName: Finch Therapeutics Group, Inc.

ticker: FNCH


text: As part of our cybersecurity defense strategy, we employ tools and systems safeguards intended to help secure our networks, applications, data and infrastructure, and to manage cybersecurity vulnerabilities. These safeguards include network and perimeter defense, infrastructure security, cloud security, endpoint protection, data protection, identity management and network segmentation. We work to evaluate and improve on these tools and safeguards through periodic cybersecurity assessments and the integration of cybersecurity threat intelligence.


text: The Company's cybersecurity framework includes an assessment of the Company's hardware, software, and data platforms across its lines of business; the risks associated with the Company's business; areas inside and outside of the Company that expose it to cybersecurity threats. As part of this framework, the Company employs policies, systems and safeguards to manage cybersecurity risks. The Company's CISO is responsible for identifying systems and security measures that reflect the appropriate safeguards designed to protect the Company's infrastructure and information and has implemented the majority of current cybersecurity controls in place with an emphasis on the confidentiality, integrity and availability (CIA) triad and a defense in depth methodology. The CISO uses a variety of threat intelligence resources, including law enforcement and industry groups such as the Financial Services Information Sharing and Analysis Center (FS-ISAC), to help stay informed about current and emerging risks to the Company.

companyName: COMMUNITY FINANCIAL SYSTEM, INC.

ticker: CBU


text: We are committed to strengthening our cybersecurity posture as our operations expand. Planned initiatives include enhancing continuous monitoring capabilities, expanding multi-factor authentication to additional systems, improving vendor oversight, and formalizing Board-level oversight of cybersecurity through dedicated committees. These steps are intended to align our practices more closely with recognized industry standards and support long-term resilience.

companyName: NightFood Holdings, Inc.

ticker: NGTF


text: In 2024 we stored certain PHI on behalf of customers on secure AWS managed servers in the contiguous United States, encrypted at rest and in transit.

companyName: OptimizeRx Corp

ticker: OPRX


text: Our year-round cybersecurity awareness program mandates training for all system users, covering essential topics such as safeguarding sensitive information, identifying phishing attempts, securing mobile devices, and understanding the risks associated with artificial intelligence ("AI") platforms. Our cybersecurity awareness training is mandatory for all employees and is conducted at least annually, with targeted phishing simulation campaigns conducted throughout the year. Third-party suppliers are subject to a formal onboarding process that includes completion of a cybersecurity questionnaire, review of SOC 2 or ISO certifications where available, and risk scoring. New engagements with third parties are contingent upon affirmative evaluations or adherence to risk mitigation/acceptance protocols. Contracts with third parties include provisions for breach notification, investigation, root cause analysis, and remediation.

companyName: Covista Inc.

ticker: CVSA


text: The Company has established a comprehensive incident response and recovery plan that addresses the response to a cybersecurity incident and plans to test and evaluate that plan on a regular basis.

companyName: Orchid Island Capital, Inc.

ticker: ORC


text: Our board of directors, as a whole, has responsibility for risk oversight, although the committees of our board of directors oversee and review risk areas that are particularly relevant to their respective functions. Among its focus areas, our audit committee reviews matters relating to cybersecurity and data privacy and regularly reports to our board of directors regarding such matters. One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023. Our audit committee receives quarterly cybersecurity-related updates from our Chief Information Security Officer, which we refer to as our CISO, including in the form of written reports and presentations. Our CISO and audit committee also provide cybersecurity-related updates to the full board of directors three times per year, including regarding recent developments, evolving standards, metrics about cyber threat response preparedness, program maturity milestones, material cybersecurity risks and risk mitigation status, and the current and emerging threat landscape. We also have implemented controls and procedures that provide for the communication of material cybersecurity incidents to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, as well as to our audit committee and/or to our full board of directors on a timely basis.

companyName: UPWORK, INC

ticker: UPWK


text: For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of our Registration Statement on Form S-1 filed with the Securities and Exchange Commission on October 20, 2023 titled " Our systems and information technology infrastructure may be subject to security breaches and other cybersecurity incidents. "

companyName: INNO HOLDINGS INC.

ticker: INHD


text: Our Board of Directors articulates the Company's attitude towards risk. Associated risk metrics are monitored quarterly by Management and reported to the Audit Committee of the Board and the Board of Directors. Management measures and reports inherent risk, mitigating controls, residual risk and emerging risk for various key risk categories, inclusive of cybersecurity and information security risks.

companyName: RIVERVIEW BANCORP INC

ticker: RVSB


text: Within the Trust and Security organizations, we implement a structured approach to proactively manage cybersecurity risks. Our Security Governance, Risk and Compliance team monitors, assesses, and coordinates proactive identification and remediation efforts for cybersecurity risks impacting Atlassian. This team partners cross-functionally with others in the Security organization and individuals from our legal, internal audit, engineering, and product development teams. Our Security team includes individuals with experience across a broad range of cybersecurity areas, including, but not limited to: product security; cloud security; infrastructure security; security monitoring and incident response; identity and access management; vulnerability management; and governance, risk, and compliance.

companyName: Atlassian Corp

ticker: TEAM


text: FHLBank is subject to cybersecurity incident and threat risk. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by FHLBank, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. Please refer to Item 1A – "Risk Factors" for a description of cybersecurity incident and threat risk. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition.

companyName: Federal Home Loan Bank of Topeka


text: Our ISO and Management Committees are continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our Information Security Team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our ISO oversees the implementation of and the processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the ISIRT Plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.

companyName: River Financial Corp

ticker: RVRF


text: The Corporation's cybersecurity risk management program is integrated into our enterprise risk management program and is designed to expeditiously identify, analyze and protect against security threats to its computer systems, software, networks, storage devices and other technology assets. Our management team, with oversight from our Board of Directors, proactively manages the Corporation's cybersecurity risks to avoid or minimize the impacts of attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt service, sabotage systems or cause other damage. Specifically, the Corporation has appointed a CISO to maintain a comprehensive information security program. Our strategy includes a continuous improvement mindset along with a defense in depth approach to cybersecurity. We utilize industry standards that include the NIST Cybersecurity Framework and the Financial Services Sector Cybersecurity Profile. Our layered security architecture consists of innovative technology to detect, prevent, and mitigate cybersecurity threats. Ongoing proactive analysis of cyber threat intelligence ensures that we are taking the appropriate counter measures to defend against the latest threats. We use monitoring and preventive controls to detect and respond swiftly to data breaches and cyber threats involving our systems. We regularly evaluate our systems and controls and implement upgrades as necessary. We also attempt to reduce our exposure to our vendors' data privacy and cyber incidents by performing initial vendor due diligence that is updated periodically for critical vendors, negotiating service level standards with vendors, negotiating for indemnification from vendors for confidentiality and data breaches, and limiting third-party access to the least privileged level necessary to perform outsourced functions. The additional cost to us of data and cybersecurity monitoring and protection systems and controls includes the cost of hardware and software, third-party technology providers, consulting and forensic testing firms, insurance premium costs, legal fees and the cost of personnel who focus a substantial portion of their responsibilities on data security and cybersecurity.

companyName: FULTON FINANCIAL CORP

ticker: FULT


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data.

companyName: ALLIANCE RESOURCE PARTNERS LP

ticker: ARLP


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's Chief Compliance Officer ("CCO"), is responsible for assessing and managing material risks from cybersecurity threats. Members of Company management possess relevant expertise in various disciplines that are key to effectively managing such risks. Management of the Company is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company, including through the receipt of notifications from service providers and reliance on communications with risk management, legal, information technology, and/or compliance personnel of the Adviser.

companyName: PIMCO Capital Solutions BDC Corp.


text: Containment, Eradication, Recovery, and Reporting The incident response team executes our incident response plan to respond to the cybersecurity incident and coordinate resources and communication protocols.

companyName: American Homes 4 Rent

ticker: AMH


text: Net Lease Office Properties 2023 10-K – 19 As part of our Board's oversight of risk management, our Board of Trustees will review our cyber-risks and the actions being taken to mitigate such risks with our Advisor. These actions include implementing industry-recognized practices for protecting systems, third-party monitoring of certain systems and cybersecurity training for the Advisor's employees. Board oversight of risk is also performed as needed between meetings through our Audit Committee and communications between our Advisor and our Board of Trustees. Our Board of Trustees will receive periodic education around cybersecurity risks and best practices.

companyName: Net Lease Office Properties

ticker: NLOP


text: Our Board of Directors has overall oversight responsibility for our risk management, and delegates information security and related risk management oversight to the Audit Committee. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends, as well as how management is addressing or mitigating those risks. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Officer (CIO).

companyName: BrightSpring Health Services, Inc.

ticker: BTSG


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats We primarily assess, identify and manage material risks from cybersecurity threats through our enterprise information security program, which is maintained by our Chief Information Security Officer ("CISO") and overseen by our Executive Vice President and Chief Information Officer ("CIO").

companyName: MKS INC

ticker: MKSI


text: Our Board of Directors ("Board") and Audit Committee have oversight responsibility for cybersecurity risks and incidents, including compliance with disclosure requirements, collaboration with law enforcement, and related effects on financial and other risks. Findings and recommendations are reported, as deemed appropriate, to the Board. Senior management including our Chief Information Security Officer (CISO) engages in regular discussions with the Board regarding cybersecurity risks, trends, and any material incidents that may arise. Furthermore, the Board receives briefings on cybersecurity matters from the CISO on our cybersecurity and information security.

companyName: VSE CORP

ticker: VSEC


text: We have an Incident Response Policy and related processes that outline steps to be taken in the event of a cybersecurity incident across Helios, our partners and third-party hosted systems. All incidents are reported to the Global Head of Information Technology who then reviews significant incidents with a cross-functional working group, inclusive of the Company CFO and General Counsel, to assess the materiality or potential materiality. An Incident Response Team that will determine response actions to be taken and coordinate all necessary communications is formed when an incident is deemed material or potentially material.

companyName: HELIOS TECHNOLOGIES, INC.

ticker: HLIO


text: Our CSO leads our overall cybersecurity function and supervises our cybersecurity team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents. She provides regular updates directly to the Audit Committee, typically on a quarterly basis. She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions. She holds a BS from Arizona State University and has been with us since 2019.

companyName: Rackspace Technology, Inc.

ticker: RXT


text: Confidential Data Policy (the "CDP"). The CDP governs the handling, storage, transmission, destruction, and protection of confidential data. Pursuant to the CDP, confidential data must be securely stored, removed from common areas, properly marked as confidential data, protected with strong encryption if being transmitted, and destroyed by means that make recovery impossible. Employees who are given access to confidential data are required to immediately notify their supervisor if they suspect any misuse or unauthorized disclosure of confidential information.

companyName: AMERICAN SHARED HOSPITAL SERVICES

ticker: AMS


text: Our team of experienced cybersecurity professionals has primary responsibility for our overall cybersecurity risk management program, including assessing and managing material risks from cybersecurity threats. Our CISO, Mark Schertler, supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Schertler has over 40 years of experience in the field of cybersecurity. Mr. Schertler leads a team of experienced cybersecurity professionals who have extensive experience in the field of cybersecurity, including experience in cybersecurity consulting, cloud security, principal security architect, application security and as a chief technology officer.

companyName: Intapp, Inc.

ticker: INTA


text: We regularly engage external consultants to assess and independently verify our cybersecurity risk management, striving for continuous optimization of our cybersecurity policies, cybersecurity risk management processes, and technical measures. These engagements assist us in ensuring our cybersecurity management practices and technical measures comply with applicable laws, regulations, industry standards and the Company's policies. The Company has maintained ISO/IEC 27001:2013 certification since 2018 for certain online business.

companyName: Yum China Holdings, Inc.

ticker: YUMC


text: Our CCO has over 20 years of experience in various roles in information technology and information security. He holds a degree in Legal Studies and holds several relevant certifications, including Certified HIPAA Professional ("CHP").

companyName: Quipt Home Medical Corp.

ticker: QIPT


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Lyft, Inc.

ticker: LYFT


text: As of December 31, 2023, we have implemented thorough cybersecurity and data protection policies and procedures. Risks from cybersecurity threats are often assessed as a part of our broader risk management activities and as a fundamental component of our internal control system. Our employees and contractors are required to complete annual cybersecurity awareness trainings, including specific topics related to browser safety, data protection, and email fraud. We have competent employees and consultants with a firm understanding of cybersecurity related to our industry. We invest in advanced technologies for continuous cybersecurity monitoring across our information technology environment which are designed to prevent, detect, and minimize cybersecurity attacks, as well as notify management of such attacks in a timely manner.

companyName: International Stem Cell CORP

ticker: ISCO


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is designed and assessed to align with practices recommended by the National Institute of Standards and Technology (NIST) and the FDA, to help us identify, assess and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: Owlet, Inc.

ticker: OWLT


text: We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and as described further below, have integrated these processes into our overall risk management systems and processes. Our board of directors performs meaningful oversight of these cybersecurity risk management processes, and our management team is responsible for the day-to-day management of the material risks we face. Management roles in cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: The Company has integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration is designed to include cybersecurity considerations as part of our decision-making processes at every level. Our IT department seeks to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs and coordinates with our overall risk management framework.

companyName: Vitesse Energy, Inc.

ticker: VTS


text: Our cybersecurity practices are designed to provide reasonable information security given the nature of our organization and our third-party relationships. We rely on the representations third-party relationships introduce additional cybersecurity risks. To address these third-party risks, we have established strict criteria for supplier selection and conduct security risk assessments to mitigate potential impacts on our business.

companyName: Golden Growers Cooperative

ticker: GGROU


text: We perform comprehensive vendor risk assessments to verify third-party security measures effectively meet our organization's security policies and ensure vendor compliance with all relevant regulatory requirements and review on an annual basis. Our Governance, Risk, and Compliance (GRC) applications enable continuous, automated testing and real-time monitoring of infrastructure and user compliance.

companyName: Health In Tech, Inc.

ticker: HIT


text: We conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, physical controls, and safeguards in place to manage such risks.

companyName: Collective Audience, Inc.


text: The Company engages with third parties to perform security assessments of its technology environment, including penetration testing and maturity assessments, in addition to providing services to support threat analysis and incident detection and response.

companyName: Johnson Controls International plc

ticker: JCI


text: Management and Board of Directors' Role The Audit Committee meets regularly with management to manage and assess risk exposures and potential damages related to information security, cybersecurity, and data protection and the steps management has taken to identify, monitor, and control such exposures, as well as associated mitigation and remediation action, and actions to continue our operations. Information distributed to and discussed with the Audit Committee includes data on cybersecurity incidents and risks, company-wide enterprise risks, training programs, risk assessments, internal controls, security software, incident response plans, and forward-looking information security and business continuity strategies. The Audit Committee reports directly to the Board of Directors on a quarterly basis.

companyName: FTI CONSULTING, INC

ticker: FCN


text: The Company's board of directors is responsible for the Company's cyber risk oversight. The Company has established a risk committee (the "Risk Committee") comprised of members of senior management whose responsibilities include identifying, assessing, and managing enterprise-level and material risks to the Company, including strategic, financial, credit, market, liquidity, security, property, information technology ("IT"), cyber, legal, regulatory, and reputational risks. As described in greater detail below, the Risk Committee also assesses and makes the final determination as to whether a cybersecurity incident is material.

companyName: Orion Properties Inc.

ticker: ONL


text: Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our General Counsel works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.

companyName: Vericel Corp

ticker: VCEL


text: Our management team, including our Chief Compliance Officer and Director of Engineering, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and external cybersecurity consultants. Our Chief Compliance Officer and Director of Engineering have over 8 and 12 years of experience, respectively, in various software development, cybersecurity, product management, and other technology-related roles. Our Chief Compliance Officer and Director of Engineering have each served in a number of significant leadership roles at our company since 2017 and 2013, respectively, including oversight of security, safety, and integrity initiatives.

companyName: Expensify, Inc.

ticker: EXFY