text: Cybersecurity remains a top identified enterprise-wide risk for our business and is overseen by our Chief Information Officer who is responsible for identifying and mitigating information security risks. Our current CIO has 20 years of industry experience and over 10 years of experience with the development, training and controls of effective global enterprise cybersecurity programs. The CIO's responsibilities include but are not limited to: (i) reviewing our enterprise risk register and functional risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) analyzing logs of cybersecurity threats and vulnerabilities; (iv) overseeing prevention, detection, mitigation and remediation efforts; and (v) developing, maintaining, and ensuring team familiarity with the above mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our Chief Information Officer in implementing our cybersecurity program and internal reporting, security and mitigation functions.

companyName: GULFPORT ENERGY CORP

ticker: GPOR


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee oversees the risk assessment, risk management and internal controls over cyber security matters, as outlined in its committee charter.

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL

secItem: Item 1C


text: Engagement with Third Parties on Risk Management Cybersecurity is an integral part of the risk management program, which is supported through the use of consultants, auditors and other third-parties who assist with reviewing and validating the effectiveness of cybersecurity controls. Our internal audit function actively participates and engages with those managing the cybersecurity program to validate the effectiveness of implemented safeguards. Our external audit results are reviewed and reported in our annual filing and to the Board Audit Committee. Additionally, the Company and the Bank are regulated entities and undergo regulatory reviews to ensure the Company and the Bank are in compliance will all appropriate standards.

companyName: FLUSHING FINANCIAL CORP

ticker: FFIC


text: Computer viruses, malware, phishing attacks, denial-of-service attacks and other cybersecurity threats present a common and constantly evolving risk in our industry. Accordingly, we have incorporated the assessment and management of material risks from cybersecurity threats into our overall risk management process. Our Engineering Security team, which is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats, works with our Chief Technology Officer and other members of management to prioritize our cybersecurity risk management processes and mitigate cybersecurity threats that are most likely to materially impact our business. Our Chief Technology Officer and members of the Engineering Security team regularly report to the Audit Committee of our Board (the "Audit Committee"), which oversees our efforts to monitor and control cybersecurity risk, as discussed further below.

companyName: YELP INC

ticker: YELP


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee primary responsibility for monitoring the Company's cybersecurity risk management processes, including mitigation of cybersecurity threats.

companyName: Origin Materials, Inc.

ticker: ORGN


text: Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework. The Board-approved Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management program, which includes Technology Risk Management.

companyName: HERITAGE FINANCIAL CORP /WA/

ticker: HFWA


text: Our cybersecurity risk assessment and management processes are implemented and maintained by our VP of Information Security and the Security Committee. For strategic decisions regarding cybersecurity, the VP of Information Security consults with the Chief Technology Officer, the Chief Financial Officer, the Chief Legal Officer, and the VP of Compliance.

companyName: OptimizeRx Corp

ticker: OPRX


text: We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: ADAMS RESOURCES & ENERGY, INC.


text: Our Board of Directors addresses the Ocwen's cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Ocwen's overall risk management processes, including cybersecurity-related risks, and receives regular updates from the Chief Information Security Officer (CISO) concerning Ocwen's significant cybersecurity threats and the processes Ocwen has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.

companyName: ONITY GROUP INC.

ticker: ONIT


text: The Board provides oversight of the ERM process and reviews the significant identified risks. The Board's oversight of cybersecurity risk management is supported by the Audit and Compliance Committee, which regularly interacts with the Company's senior management, including the Director - Information Systems (i.e. the Company's chief information officer). The Company's various Board committees also play a role in risk management, as detailed in their respective charters.

companyName: BADGER METER INC

ticker: BMI


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Safehold Inc.

ticker: SAFE


text: We evaluate each third-party service provider to verify the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures, and to promptly report any suspected breach of security measures that may affect the Company. Our Board of Directors and Audit Committee are responsible for overseeing our cybersecurity risk management and strategy.

companyName: Aldeyra Therapeutics, Inc.

ticker: ALDX


text: Virtu has established a Global Security team that, together with the Company's Chief Information Security Officer ("CISO"), is responsible for the strategic planning, execution, and enforcement of security initiatives and policies for the Company's business units (the "Security Program"). The CISO reports directly to the Chief Executive Officer, and together with the Global Security team, possesses significant experience in various roles involving managing information security, developing cybersecurity strategy, and implementing effective information and cybersecurity programs. As part of its Security Program, the Company has developed policies and procedures governing cybersecurity (the "Cybersecurity Program").

companyName: Virtu Financial, Inc.

ticker: VIRT


text: We have processes in place to identify, assess and monitor material risks from cybersecurity threats, including the material risks of the Company. These processes are part of our overall enterprise risk management process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, governance, risk and compliance reviews. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.

companyName: GlobalTech Corp

ticker: GLTK


text: For additional information on cybersecurity risks, see the section titled "Risk Factors" included elsewhere in this Annual Report on Form 10-K.

companyName: European Wax Center, Inc.

ticker: EWCZ


text: The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among others. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates also include updates on our continued compliance with regulatory requirements. Our information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.

companyName: CORPAY, INC.

ticker: CPAY


text: Under their leadership, the information security team continuously strengthens our enterprise security posture, mitigating cyber risks while enhancing system resilience to minimize business disruptions. Recognizing that cybersecurity is a shared responsibility, they foster a corporate culture of security awareness and accountability, ensuring that employees beyond the security team remain vigilant against evolving cyber threats.

companyName: ExchangeRight Income Fund


text: One of the key functions of our board of directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through its strategy committee.

companyName: BlackSky Technology Inc.

ticker: BKSY


text: Additionally, controls have been implemented that are designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Certain providers undergo security risk assessments upon onboarding and upon detection of an increase in their risk profile. Our risk assessments utilize various inputs, including information supplied by the providers and third parties. Furthermore, we mandate that our providers meet appropriate security requirements, controls, and responsibilities. We also investigate security incidents impacting our third-party providers as necessary.

companyName: OppFi Inc.

ticker: OPFI


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Legal and Regulatory Compliance Committee (Committee) oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BIO-RAD LABORATORIES, INC.

ticker: BIO


text: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO). The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board. The Audit Committee of the Board monitors our information security programs, including our cybersecurity risk management program, and receives updates quarterly, or more frequently as determined appropriate, from management on our cybersecurity program and systems protection.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our program is informed by industry standards, including the National Institute of Standards and Technology (NIST) Cyber Security Framework (CSF), the American National Standards Institute encryption standards and the Payment Card Industry Data Security Standard, among others. As part of our cybersecurity strategy, we regularly engage independent, outside expertise to assess and benchmark our overall program against these industry standards.

companyName: AUTOZONE INC

ticker: AZO


text: As cyber-attacks become more prevalent, we've taken action to mitigate the threat to our business. As described in more detail below and as part of our risk management program, we have established policies and processes for assessing, identifying, and managing material risks from cybersecurity threats. Cybersecurity is a critical element of this program.

companyName: Eiger BioPharmaceuticals, Inc.


text: The Company's Board of Directors ("Board") provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program. These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.

companyName: HERITAGE FINANCIAL CORP /WA/


text: The Audit Committee, under the oversight of the Board of Directors, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board of Directors and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board of Directors and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Kontoor Brands, Inc.

ticker: KTB


text: Management must work to continuously identify potential cyber threats and vulnerabilities across the organization's systems, networks, and data. Regular assessments analyze the likelihood and potential impact of these threats.

companyName: DecisionPoint Systems, Inc.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The technology committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. The technology committee meets quarterly with members of management, including our CISO, Chief Information Officer ("CIO"), Chief Technology Officer or VP of Cybersecurity Engineering, as applicable, to discuss cybersecurity developments, significant cybersecurity threats and risks and the processes we have implemented to address them. The audit committee also receives presentations related to cybersecurity threats, risk and mitigation on a semi-annual basis unless more frequent discussions are necessary. The board of directors also receives a presentation from our CISO or CIO on our cybersecurity measures and risks at least annually.

companyName: VARONIS SYSTEMS INC

ticker: VRNS


text: Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data incidents, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: To test our cybersecurity program, we perform periodic vulnerability testing, engage an independent third party to perform periodic internal and external penetration testing, and engage other third parties to conduct periodic assessments of our cybersecurity capabilities. We continuously expand training and awareness practices to mitigate risk from human error, including mandatory computer-based training and internal communications for employees. Our employees undergo cybersecurity awareness training and regular phishing awareness campaigns that are based upon and designed to emulate real-world contemporary threats. We provide prompt feedback (and, if necessary, additional training or remedial action) based on the results of such exercises.

companyName: Torrid Holdings Inc.

ticker: CURV


text: Rather than designate one specific board committee to cybersecurity risk management, our entire Board of Directors is responsible for overseeing our risk management. Our Chief Risk Officer is responsible for overseeing our risk management generally, working closely with our internal audit department. Our Chief Risk Officer regularly reports directly to the Board of Directors with respect to all areas of risk management.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The Board has designated the Audit Committee to be responsible for oversight of cybersecurity risk. The Audit Committee receives regular reports from the CRC and the CIO that may discuss topics such as prior assessments, cybersecurity trends, prior cybersecurity events, and planned enhancements. In addition, the Audit Committee also receives regular periodic reports regarding information technology general controls in connection with its oversight of internal control over financial reporting. The Chair of the Audit Committee regularly briefs the Board on these matters.

companyName: RELIANCE, INC.

ticker: RS


text: Third-party IT Vendor Risk Management Our IT security staff also maintains a third-party IT vendor risk management process. The staff identifies the third parties with whom we contract or otherwise have a relationship involving our network or digital assets that represent an elevated risk based on a detailed rating process. The IT vendor risk management process involves input from various departments, including the affected internal business constituencies, legal, and compliance.

companyName: Encompass Health Corp

ticker: EHC


text: Our CIO brings more than 20 years of information and operational leadership experience in the life sciences and technology industries to his role at Veracyte. He holds a B.B.A. and an M.B.A from the University of San Diego. Our VP, Global IT Operation oversees IT operations for all sites globally, and has more than 20 years' of experience. He holds a M.S. in Business Technology Management, and a B.S. in Computer Applications and Networks from Coleman University. Our Director of Cybersecurity has over 25 years' of experience in enhancing digital security and driving technological innovation. He holds a B.Sc. (Honors) in Computer Information Systems from the National University along with several industry related Cybersecurity certifications.

companyName: VERACYTE, INC.

ticker: VCYT


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. We have experienced, and may continue to experience, cyber incidents in the normal course of our business. Although prior cybersecurity incidents have not had a material adverse effect on our business, financial condition, results of operations, or cash flows, there can be no assurance that we will not suffer a material loss in the future. For a description of the risks from cybersecurity threats that may materially affect the Company, see our risk factors under Item 1A. Risk Factors, including Significant disruptions of information technology systems, breaches of data security and other incidents could materially adversely affect our business, results of operations and financial condition.

companyName: KULR Technology Group, Inc.

ticker: KULR


text: We also conduct periodic penetration testing of our systems. This testing is performed by a qualified third-party testing company and is in alignment with our CIS controls. Penetration testing is meant to provide us with information on the security of a particular system or application. These findings then can be used by us to inform remediation work on a go-forward basis. Cybersecurity Insurance.

companyName: Zumiez Inc

ticker: ZUMZ


text: The Company's overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting. A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.

companyName: IonQ, Inc.

ticker: IONQ


text: Key features of our cybersecurity risk management program include, but are not limited to, the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and, information; • an information security program, led by our Senior Director, Information Security, principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors based on their criticality and risk profile.

companyName: Vroom, Inc.

ticker: VRM


text: Cybersecurity risk management is part of the Bank's Enterprise Risk Management program which includes specific controls for the mitigation, monitoring and reporting associated with those risks. The program is supported by a robust set of policies and procedures, skilled staff, layered technical defenses, employee training, and oversight of third parties. The Technology Committee of the Board of Directors ("Board") also annually reviews and approves the Bank's Information Security Policy.

companyName: Federal Home Loan Bank of New York


text: We have implemented cybersecurity risk assessment procedures to ensure effectiveness in cybersecurity management, strategy and governance and reporting cybersecurity risks. We have also integrated cybersecurity risk management into our overall enterprise risk management system.

companyName: CHINA PHARMA HOLDINGS, INC.

ticker: CPHI


text: We have established a comprehensive incident response and recovery plan that guides our response in the event of a cybersecurity incident.

companyName: BTCS Inc.

ticker: BTCS


text: The Company employs a multifaceted approach through in house capabilities and in partnership with external cybersecurity experts to safeguard its assets, including technical and organizational measures. These include the deployment of technology focused on identifying and remediating threats, ongoing employee training exercises, regular incident response capability reviews and exercises, cybersecurity insurance coverage, and business continuity mechanisms.

companyName: RED ROBIN GOURMET BURGERS INC

ticker: RRGB


text: Governance and Oversight of Cybersecurity Risk The Adviser has instituted a cybersecurity program, overseen by the Adviser's Chief Compliance Officer ("CCO"), which is designed to assess, identify, and manage material cyber risks applicable to us. The cyber risk management program involves risk assessments, identification of sensitive information assets ("Critical Information"), implementation of security measures, and ongoing monitoring of systems and networks, including networks on which we rely on. The Adviser actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats, including material risks faced by us.

companyName: Willow Tree Capital Corp


text: A VD's Board of Directors maintains oversight of cybersecurity planning, response and reporting as follows. The Lead Director, Scott Baskin, who also serves as Chair of the Risk Committee and member of the Audit Committee, is Cybersecurity Liaison to AVD's management team. The Chair of the CPRSC reports on cybersecurity preparedness, issues and incidents to the Cybersecurity Liaison regularly. Through this reporting structure, the cybersecurity team has direct interaction with the highest level of the Board and with both the Risk and Audit Committees. Cyber risk has been a subject of regular review and discussion at the Risk Committee for several years. With the advent of the CPRSC, the delineation of governance and responsibility has become that much more focused.

companyName: AMERICAN VANGUARD CORP

ticker: AVD


text: The Audit Committee receives quarterly updates from the ciso or other members of the ciso's team with responsibility for oversight of our key cybersecurity program components. These updates include, as appropriate, ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, cybersecurity incidents and our response to them, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness.

companyName: STARBUCKS CORP

ticker: SBUX


text: Because we are aware of the risks associated with third parties, we have implemented a third-party security risk management program to oversee and manage these risks. We conduct security assessments of third-party providers contracted by Global IT before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards. The program includes tools and services, which continuously monitor third parties for potential security concerns, data leaks and cyber posture, as well as periodic renewals of due diligence commensurate with their risk. This approach is designed to mitigate risks related to data breaches or other security incidents originating from these third parties.

companyName: HUNTSMAN INTERNATIONAL LLC


text: Our information security function, which is led by our IT department, helps to identify, assess and manage the Company's cybersecurity threats and risks. Our IT team identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example, manual and automated tools, analyzing reports of threats and threat actors, conducting internal and external scans of our environment, periodic penetration tests conducted by third parties, utilization of a 24x7 security operations center (SOC) that provides monitoring and alert services, evaluating threats reported to us, and coordinating cross-functionally, with Company management and externally (e.g., with law enforcement) concerning threats.

companyName: ACELYRIN, Inc.


text: Information Security Governance and Oversight Our risk management process and information security risk mitigation framework enables our Board and management to establish a mutual understanding of the effectiveness of our information security risk management practices and capabilities, including the division of responsibilities for reviewing our information security risk exposure and risk tolerance, tracking emerging information risks and ensuring proper escalation of certain key risks for periodic review by the Board and its committees.

companyName: WHIRLPOOL CORP /DE/

ticker: WHR


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer. Our Chief Financial Officer has been responsible for our IT functions for 20 years and has managed the IT function of companies generally for the last 35 years. The management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, the management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, periodically.

companyName: Bio Green Med Solution, Inc.

ticker: BGMS


text: The CFO oversees the operation of our cybersecurity program and has 10 years of executive experience overseeing risk management and internal controls. The CFO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the CFO's oversight of the Company's information technology function and supervision of the Company's IT administrator.

companyName: CITIUS ONCOLOGY, INC.

ticker: CTOR


text: PGE manages third party cybersecurity risk by conducting due diligence to identify risks from third parties; requiring review and approval before onboarding a third party. Any third party that fails to meet our security requirements is subjected to additional risk screenings. PGE may decide not to move forward with a vendor that does not meet security requirements. PGE also has procured cybersecurity insurance.

companyName: PORTLAND GENERAL ELECTRIC CO /OR/

ticker: POR


text: We face a number of cybersecurity risks in connection with our business and recognize the growing threat within the general marketplace and our industry. In the ordinary course of our business, we use, store, and process data, including data of our employees, partners, collaborators, and vendors. Cybersecurity threats and incidents include attempts to gain unauthorized access to our systems and networks, or our partners, collaborators, vendors, or other third parties with whom we do business, to disrupt operations, corrupt data or steal confidential or personal information and other cybersecurity breaches. We consider cybersecurity risk a serious threat to our business. To help the Company identify, assess, and mitigate risks to this data and our systems, we have implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks and incorporates elements of the same.

companyName: PLUG POWER INC

ticker: PLUG


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and in February 2024, delegated to the risk committee of the board of directors ("Risk Committee") oversight of cybersecurity risks and incidents and any other risks and incidents relevant to the Company's computerized information system controls and security. Prior to February 2024, the board of directors had delegated this oversight to the audit committee of the board of directors. The Risk Committee oversees management's implementation of our cybersecurity risk management program.

companyName: BEYOND MEAT, INC.

ticker: BYND


text: Criteria used to determine the materiality of an incident includes, but is not limited to, evaluating the scope, nature, type, systems, data, operational impact, and pervasiveness of the incident.

companyName: Kaival Brands Innovations Group, Inc.

ticker: KAVL


text: Posture Management includes the vulnerability management, log operations, and architecture and engineering teams. Our vulnerability management team conducts regular scans of our enterprise to look for potential weaknesses and configuration-related issues. Based on the results of these scans, this team routinely patches or works with system and platform owners to resolve identified vulnerabilities. Our log operations team works closely as a bridge between the system owners and our Security Operations Center by logging and monitoring activities on our systems and applications. Our architecture and engineering team manages security appliances and provides security architecture advice and consulting to our information technology and delivery teams throughout the enterprise. When it comes to posture management, our goal is not just to reactively resolve potential vulnerabilities discovered through the vulnerability management process; we also look for ways to prevent vulnerabilities through minimizing system ports, protocols, and services to only that which is necessary.

companyName: NELNET INC

ticker: NNI


text: On at least an annual basis, the Head of Compliance, the General Counsel, the GRC Committee, and the IT Department, in consultation with our MSP, provide an update to the Board regarding critical cybersecurity risks and ongoing cybersecurity initiatives and strategies. We have implemented a process for significant cybersecurity matters and strategic risk management decisions related to cyber risks to be escalated to the GRC Committee and/or the Board, as appropriate.

companyName: Centessa Pharmaceuticals plc

ticker: CNTA


text: The goal of the Company's cybersecurity risk management strategy is to mitigate cybersecurity risks. Cybersecurity risks include the potential misappropriation of assets or confidential information, corruption of data, disruptions to operations, or regulatory developments that could materially impact the Company's privacy and cybersecurity risk exposure, and any threat that could have a material impact to the Company's business, reputation, results of operations and financial condition To this end, management has implemented processes which seek to identify, assess, and manage material cybersecurity risks, and which include (i) monitoring of cybersecurity threats in the current environment, (ii) training employees on a regular basis in cybersecurity prevention, including social engineering and phishing techniques used by hackers, (iii) requiring multifactor authentication to access the Company's networks, (iv) updating applications on an on-going basis to patch or remediate security vulnerabilities, and (v) the encryption of confidential data and critical servers. The Company has in-place security information and event management tools for the purpose of detecting, analyzing, and responding to security threats in an effort to prevent or reduce potential harm to business operations. These tools include: (i) antivirus applications to detect threats, (ii) end point detection and response applications to record and store on-line user behavior for the purpose of detecting, investigating, and blocking suspicious activities, and (iii) third party monitoring applications. The Company has also adopted a network segmentation strategy intended to divide networks into smaller parts to improve security and efficiency, and the Company also maintains redundant back-up copies of its networks that are stored in multiple locations, including cloud-based backups that are performed daily. Further, on an annual basis, the Company hires a consultant to perform penetration tests against the Company's security infrastructure with the goal of identifying security vulnerabilities and making recommendations for security improvements. The Company also has business continuity and incident response programs in place to respond to and mitigate cybersecurity attacks. The Company conducts periodic exercises in an effort to improve its cybersecurity business continuity and incident response plans and updates the plans if new threats are identified or ongoing reviews of the plans suggest an update is needed.

companyName: BBX Capital, Inc.

ticker: BBXIA


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, threat intelligence service providers, professional services firms, including legal counsel, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, and penetration testing firms.

companyName: MALIBU BOATS, INC.

ticker: MBUU


text: The Company proactively reviews threats landscape, impacts to the company, and address any gaps where necessary. Also, we maintain security operations metrics and incident response plan and conduct tabletop exercises. The Company engages outside consultants to review both its Cybersecurity posture, and maturity, and perform for a cyber assessments of the Company's manufacturing/operational technology environments. The Company has a process in place to oversee and identify material risks from cybersecurity threats associated with its use of any third-party service provider, namely its Third-Party Risk Management Assessment Process. We utilize the NIST framework when assessing third parties. The framework covers 23 categories. When applicable, we may request if the third party vendor is SOC1/2, GDPR, certified. Additionally, the Company maintains a cybersecurity insurance policy to help mitigate the impacts of potential cybersecurity incidents.

companyName: Emergent BioSolutions Inc.

ticker: EBS


text: The Board receives, at each regularly scheduled meeting, a risk report which includes an updated cybersecurity risk exposure assessment, a summary of existing cybersecurity controls and risk mitigations, and further planned controls and risk mitigation activities.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: To date, we have not experienced any material cybersecurity incidents that have had a significant impact on our financial condition, results of operations, or reputation. However, we recognize that the threat landscape continues to evolve, and we remain vigilant in adapting our security posture to mitigate emerging risks.

companyName: Ocean Power Technologies, Inc.

ticker: OPTT


text: In addition, we engage cybersecurity consultants, unaffiliated with our MSP, to advise management, assess our technology tools and review our cybersecurity practices. Our consultants utilize the National Institute of Standards and Technology (NIST) Cybersecurity Framework to assess our cybersecurity risk and governance practices. The NIST Cybersecurity Framework enables organizations, regardless of size, to apply principles and best practices of risk management to improve security and resilience.

companyName: ClearSign Technologies Corp

ticker: CLIR


text: the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls;

companyName: Atlanticus Holdings Corp

ticker: ATLCP


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee, where it deems appropriate, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.

companyName: scPharmaceuticals Inc.


text: Risk assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;

companyName: Arteris, Inc.

ticker: AIP


text: Board of Directors and Audit Committee are responsible for overseeing our cyber security risk management and strategy. Our Vice President of Finance provides periodic briefings to the Audit Committee including our cybersecurity risks and activities, any potential cybersecurity incidents and related responses, cybersecurity systems testing and, activities of third parties.

companyName: PURE BIOSCIENCE, INC.

ticker: PURE


text: All Ulta Beauty associates have a role as stewards of Company data, and we educate them on how to keep data safe. As part of the Company's annual security awareness training and regular training around phishing, we train associates on how to keep devices and data safe in public places; how to avoid security threats and phishing scams; how to maintain a secure workplace; and everyday practices that help maintain the security of corporate digital devices, data and systems.

companyName: Ulta Beauty, Inc.

ticker: ULTA


text: Our Nominating, Compliance, and Corporate Governance Committee is responsible for overseeing the Company's information security risk management, including cybersecurity, data privacy, and other information technology risks, controls and procedures, and the Company's plans to mitigate cybersecurity risks and to respond to data breaches. The Company's Senior Director of Information Security, who has more than a decade of experience in IT and cybersecurity-related roles, assists in assessing the Company's cybersecurity risks and has the relevant expertise necessary for such assessment. Pursuant to the Company's internal policies, executive management team members, which may include the General Counsel, Chief Financial Officer, and Chief Information Officer, are briefed on cybersecurity trends, potential risks, ways to improve the Company's risk posture, as well as changes to the legal and regulatory landscape relative to cybersecurity and data privacy. Consistent with our internal policies, our executive team is responsible for apprising the Nominating, Compliance, and Corporate Governance Committee of cybersecurity incidents consistent with our incident response plan.

companyName: MASIMO CORP

ticker: MASI


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.

companyName: Ellington Financial Inc.

ticker: EFC


text: In addition, we participate in the Department of Homeland Security's Cyber Resilience Review ("CRR"), a voluntary, nontechnical assessment to evaluate an organization's operational resilience and cybersecurity practices. The CRR assesses enterprise programs and practices across a range of 10 domains, including risk management, incident management and service continuity.

companyName: SOUTHWESTERN ENERGY CO


text: We have established processes for assessing, identifying, and managing material risks from cybersecurity threats. We are committed to periodically reviewing these processes internally as well as discussing these threats and our processes with members of our Board as part of our overall cybersecurity risk management system.

companyName: DIGI INTERNATIONAL INC

ticker: DGII


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. The policies and standards were created using elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.

companyName: Johnson Controls International plc

ticker: JCI


text: Oversee Third-party Risk. The Company has a third-party management risk program to help monitor and reduce risks associated with the Company's vendors, which includes processes such as completing due diligence on third party service providers before engaging with them for their services; assessing the third party's cybersecurity posture by reviewing audit reports of the third party, completing cyber questionnaires, and reviewing applicable certification; including cybersecurity contractual language in contracts to limit risk; and monitoring and reassessing third party's to ensure ongoing compliance with their cybersecurity obligations.

companyName: Knife River Corp

ticker: KNF


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: All employees receive cybersecurity training with job-specific topic considerations. Our IT team engages third-party vendors to assist with providing timely cybersecurity threat alerts in addition to monitoring cybersecurity threats and our defenses against cyberattacks. This monitoring includes the proactive identification of vulnerabilities in our systems with threat intelligence. The employees within our broader IT team who specialize in cybersecurity operations are responsible for coordinating and overseeing the activities of these third-party vendors.

companyName: Semler Scientific, Inc.


text: Education and Awareness The Company launched a security awareness campaign, Be Cyber Smart, that helps employees make sure valuable data remains private, keep physical and digital workspaces secure with good security hygiene, spot potential phishing and malware threats, and avoid risky behaviors. The Be Cyber Smart campaign provides employees with tools and tips for proactive protection measures such as password management, the importance of software updates and computer restarts, security measures when working remote, recognizing and avoiding phishing and maintaining data privacy. In addition, annual compliance, security awareness and acceptable use training, as well as regular phish testing, is delivered to all employees.

companyName: Quad/Graphics, Inc.

ticker: QUAD


text: We have established an enterprise-wide cybersecurity program that provides overall governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program is based upon leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework, International Organization for Standardization, and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, and to enhance our ability to focus resources appropriately.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: As one of the critical elements of Apollo's overall ERM approach, Apollo's cybersecurity program is focused on the following key areas: • Governance. As discussed further under the heading "Cybersecurity Governance," Apollo's Board of Directors has an oversight role, as a whole and also at the committee level, in overseeing management of Apollo's risks, including its cybersecurity risks. Apollo's Chief Information Security Officer ("CISO") and the Chief Information Security Officer of Athene Holding Ltd. ("AHL's CISO"), a subsidiary of Apollo, with support from the broader Apollo Technology team, are responsible for information security strategy, policies and practices, and also receive support, as appropriate, from our executive officers and other representatives of the Adviser and its affiliates. • Collaborative Approach. Apollo utilizes a cross-functional approach involving stakeholders across multiple departments, including Apollo Compliance, Legal, Technology, Operations, Risk and others, aimed at identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of potentially material cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management, in consultation with our management and our Board of Trustees, as applicable, in a timely manner. • Technical Safeguards. Apollo deploys technical safeguards that are designed to protect its information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved on an ongoing basis using vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. Apollo has established and maintains incident response and recovery plans that address its response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management. Apollo maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems, as well as the systems of third parties that could adversely impact its business and the business of its externally managed entities such as our company, in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. Apollo provides regular, mandatory training for personnel regarding cybersecurity threats to equip its personnel with effective tools to help mitigate cybersecurity threats, and to communicate its evolving information security policies, standards, processes and practices.

companyName: Apollo Debt Solutions BDC


text: The Company faces a number of cybersecurity risks in connection with its business. Based on the information the Company has as of the date of this Form 10-K, the Company does not believe that any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial position. However, cybersecurity threats are constantly evolving, and many of the security measures that the Company has implemented must also evolve over time. While CoreCard seeks to utilize industry standard measures and tools to monitor and address these evolving threats, the Company may not be able to anticipate, prevent or mitigate its cybersecurity risks, the occurrence of which could result in significant legal and financial exposure, theft, damage to the Company's reputation, interruption of the Company's business operations, the loss of confidence in the Company's security measures, and harm to the Company's business.

companyName: CoreCard Corp

ticker: CCRD


text: Our Vice President, IT, who reports to the Chief Technology Officer, a member of the executive team, has over 20 years of experience managing information technology and cybersecurity matters. The Vice President, IT and the Chief Technology Officer, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: Our Board of Directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity events, and compliance with regulatory requirements and industry standards.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: The VP of IT and the NVP of Finance work in coordination with the Cybersecurity Response Committee, which also includes our Chief Financial Officer and representatives from legal, internal audit and SEC reporting functions. In the event of a cyber incident, the Cybersecurity Response Committee utilizes a formal incident response plan based on the NIST Framework to assess and manage cybersecurity threats. The incident response plan encompasses the containment, eradication, recovery, and resolution processes for the incident, while also detailing the individuals and groups that need to be notified.

companyName: Dream Finders Homes, Inc.

ticker: DFH


text: We have not established specific processes for assessing, identifying, and managing material risks from cybersecurity threats or engaged third parties to assess such risks.

companyName: SolarWindow Technologies, Inc.

ticker: WNDW


text: The assessment process spans over five domains of interest: (1) cyber risk management and oversight, (2) threat intelligence and collaboration, (3) cybersecurity controls, (4) external dependencies, and (5) cyber incident management and resilience. All domains are currently assessed at an evolving maturity level which is in line with our organizations inherent risk assessment score.

companyName: COMMUNITY TRUST BANCORP INC /KY/

ticker: CTBI


text: Management's Cyber Expertise Our cybersecurity program is led by our CIO who is also our Chief Information Security Officer. Our CIO has been with us since 2014 and has over 30 years of information technology and compliance experience. Our CIO has a Bachelor of Science in Management Information Systems and holds the Certified Information Systems Audit security certification as well. Our security members are comprised of various industry technology skilled resources in cybersecurity, business continuity and system recovery, event management, system administration, network engineering, and regulatory compliance with a collective 100 plus years of experience. Security operations partners are also leveraged for 24x7x365 managed detection and response support plus provide expert cybersecurity resources as an extension of our team.

companyName: NGL Energy Partners LP

ticker: NGL


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they are a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it is a shared responsibility, woven into the fabric of our corporate culture.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: We leverage multiple managed security service providers to monitor key system and network activity on a 24 hour basis to detect and alert the information technology team of cyber threats and potential cybersecurity events of concern. In addition to monitoring for security events, cyber threat intelligence sources are analyzed in order to understand potential cyber threats and techniques that may be used in cyberattacks against us and to monitor for such threats. Examples of cyber threat intelligence sources include the Financial Services Information Sharing and Analysis Center, trade organizations, the Cybersecurity and Infrastructure Security Agency, security service providers, vendor alerts, and open-source intelligence sources. The Bank utilizes two cybersecurity tools to detect and prevent successful phishing campaigns. All employees receive semi-annual training covering social engineering, phishing and current scam events, followed by periodic testing.

companyName: FVCBankcorp, Inc.

ticker: FVCB


text: We annually assess our cybersecurity programs against third-party requirements, including HIPAA and the Sarbanes-Oxley Act (SOX). We test multiple aspects of cybersecurity regularly, including annual pen testing over our proprietary information systems and our technical recovery and incident response procedures annually.

companyName: JOINT Corp

ticker: JYNT


text: Third-Party Security Risk Management – we use a Vendor Risk Management Questionnaire to document third-party vendors' security controls and governance policies. The questionnaire allows us to systematically assess risk which may be introduced by third-party vendors and ensures alignment with our security and compliance standards.

companyName: Six Flags Entertainment Corp/OLD


text: In addition, we endeavor to apprise employees of emerging risks and require them to undergo bi-annual security awareness trainings and supplemental trainings as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the trainings and assess the need for additional training.

companyName: FGI Industries Ltd.

ticker: FGI


text: As of the date of this report, we are no t aware of any cybersecurity incidents, that have had a materially adverse effect on our operations, business, results of operations, or financial condition.

companyName: Vestand Inc.

ticker: VSTD


text: Furthermore, the Sponsor conducts regular training sessions for all employees, covering various cybersecurity topics, and disseminates real-time information on cybersecurity matters, as necessary. The information security plan undergoes periodic reviews and updates, at least annually, to adapt to evolving threats and changes in the operating environment, ensuring its continued effectiveness in safeguarding sensitive information and mitigating cybersecurity risks.

companyName: Teucrium Commodity Trust

ticker: CANE


text: The Cyber Security Watch Team ("CSWAT") is comprised of senior IT, operations, risk, legal and compliance leaders across business segments. In addition to addressing our more significant cyber incidents, CSWAT manages risks from matters related to business continuity, including risks posed by cybersecurity threats, and implements controls to mitigate such operational risks. Among other processes, this team reviews the Company's programs and processes related to information security, third party risk, vendor management, facilities, unplanned downtime, business disruption, business continuity and disaster recovery.

companyName: Level 3 Parent, LLC


text: The Board of Directors and the Audit Committee receive briefings from the Company's Chief Information Officer (" CIO "), Chief Financial Officer ("CFO") and President and Chief Executive Officer ("CEO") on a regular basis, with a minimum frequency of once per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies;

companyName: Energy Services of America CORP

ticker: ESOA


text: We train our employees through annual security training, phishing simulations, and regular communications about timely cybersecurity topics and threats. We have a documented and well-tested cybersecurity incident response plan that guides us in responding, containing, and eradicating cybersecurity threats that have breached our preventative controls. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contract with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. We regularly practice technical recovery.

companyName: TORO CO

ticker: TTC


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.

companyName: LIGHTBRIDGE Corp

ticker: LTBR


text: Refer to "Item 1A. Risk Factors— Risks Associated with Our Company — Unauthorized disclosure, destruction or modification of data, through cybersecurity breaches, computer viruses or otherwise or disruption of our services could expose us to liability, protracted and costly litigation and damage our reputation".

companyName: ADDENTAX GROUP CORP.

ticker: ATXG


text: The retiring CIO had been in his role at Williams for over 10 years and had over 30 years of combined information technology experience with a broad scope of responsibility. He provided senior leadership support of the cybersecurity and risk management programs since 2013. He holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.

companyName: WILLIAMS COMPANIES, INC.

ticker: WMB


text: Our Board of Directors is responsible for overseeing enterprise risk and has delegated the responsibility for the oversight of cybersecurity and information technology risks, and the Company's preparedness for these risks, to the Audit Committee. Our Vice President of Information Security provides periodic updates to the Audit Committee in order to assist the Audit Committee in understanding the implications of cybersecurity risks. The Audit Committee meets regularly to ensure a shared understanding of cybersecurity risks, to review new regulations or laws, and to provide guidance on complex risk issues.

companyName: SONIC AUTOMOTIVE INC

ticker: SAH


text: To preserve the availability of data and systems, we perform daily backups with some occurring multiple times a day. Additionally, to mitigate ransomware, data is stored in version-controlled file systems. When implementing systems, architectural patterns for redundancy and failover are used.

companyName: Stoke Therapeutics, Inc.

ticker: STOK


text: We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents. We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills. The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO, the Risk Committee and the Board, and a process for consideration of whether a cybersecurity incident is material and may require disclosure in SEC filings.

companyName: UNITED PARCEL SERVICE INC

ticker: UPS


text: From a framework standpoint, we primarily utilize the National Institute of Standards and Technology ("NIST") framework to assess and mitigate cybersecurity risks. This framework guides our efforts to identify, analyze and contain any security threats, and advises as to potential actions to consider if a need arose to recover from a security incident.

companyName: Portillo's Inc.

ticker: PTLO


text: We take a risk-based approach in implementing and maintaining various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and information related to our clinical trials, products in development, and proprietary technologies ("IT Systems and Data").

companyName: Pyxis Oncology, Inc.

ticker: PYXS


text: To date, we have not experienced a cybersecurity threat or incident; therefore, there has been no cybersecurity impact on our results of operations or financial condition. However, unauthorized access to our information and systems and other disruptions to our business operations could occur in the future.

companyName: BT Brands, Inc.

ticker: BTBD


text: Board considers cybersecurity risk as part of its risk oversight function and has oversight of cybersecurity, data privacy and other information technology risks. The Board oversees management's implementation of our cybersecurity risk management program and cybersecurity risk exposures, and the steps taken by management to monitor and mitigate cybersecurity risks. The Board is composed of directors with diverse expertise, which has prepared them to oversee our cybersecurity risks.

companyName: Hapi Metaverse Inc.


text: The Audit Committee is responsible for oversight of cybersecurity risk. Our Chief Executive Officer is the member of management responsible for managing and assessing our cybersecurity practices. Our Chief Executive Officer has over 20 years' experience as a C-Level technology executive for private and public companies. The plan for the future is that our Chief Executive Officer will report to the Audit Committee on cybersecurity on a quarterly basis. Should any cybersecurity threat or incident be detected, our senior management team would timely report such threat or incident to the Audit Committee and provide regular communications and updates throughout the incident and any subsequent investigation, in order that the impact, materiality, and reporting requirements of such incident are appropriately identified and assessed for further necessary or appropriate action to be taken.

companyName: Vocodia Holdings Corp

ticker: VHAI


text: We have implemented internal controls including regular risk assessments designed to address financial, operational and information technology (including cybersecurity) risks and controls across our organization. These assessments are overseen by our Director of IT and Chief Accounting Officer. We implement cybersecurity controls and procedures designed to address cyber risks and threats, supported by third-party technologies and security advisors and providers. We also provide cybersecurity awareness training to our employees during the onboarding process and periodically thereafter. In addition, we engage external third-party information security consultants to periodically conduct information security testing and assessments, and to evaluate our overarching information security program and specific incident response procedures. We also maintain a Cyber Incident Response Plan, which is overseen by our Director of IT and is designed to coordinate our response to information security incidents. Finally, we hold and maintain third-party insurance coverage for cybersecurity risks commensurate with industry standards for a company of our size and stage.

companyName: Compass Therapeutics, Inc.

ticker: CMPX


text: The Information Security Program, overseen by our Executive Project and Technology Risk Committee ("EPTRC"), plays a vital role in our overall risk management system. It encompasses administrative, technical, and physical measures aimed at safeguarding the security and confidentiality of client records and information. We also have an Incident Response Plan which is continually updated in response to an ever-changing threat landscape to provide long-term strategies for remediation, prevention of future incidents and resiliency to all types of threats. The incident response team (i) includes subject matter experts to address cyber threats and (ii) includes members of management responsible to monitor threat escalation and identify events that may warrant Board notification and a Form 8-K cybersecurity notice.

companyName: SOUTHERN FIRST BANCSHARES INC

ticker: SFST


text: Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.

companyName: American Bitcoin Corp.

ticker: ABTC


text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: Our centrally defined cybersecurity policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We use a multi-layered approach to security with processes and tools aligned with the National Institute of Standards and Technology Cybersecurity Framework. We monitor compliance with these policies and processes through frequent internal audits and a set of robust metrics that assist in protection of our environment. As a U.S. defense contractor, we are required to comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the U.S. Department of Defense (DoD). We will also be required to achieve Cybersecurity Maturity Model Certification which will certify our compliance with the federally mandated CUI program.

companyName: TEXTRON INC

ticker: TXT


text: security controls and mitigation measures designed to manage and mitigate material risks from cybersecurity threats to our critical systems and information;

companyName: MeiraGTx Holdings plc

ticker: MGTX


text: We periodically engage third-party cybersecurity experts to assess and enhance our cybersecurity risk management program, and to ensure compliance with industry best practices and applicable standards. These partnerships enable us to stay ahead of evolving threats and implement robust strategies to protect critical systems and data in the event of cybersecurity incidents.

companyName: Karat Packaging Inc.

ticker: KRT


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and, while distinct in certain aspects described below, the program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.

companyName: Airbnb, Inc.

ticker: ABNB


text: We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.

companyName: Baker Hughes Co

ticker: BKR


text: It is the policy of the Company to ensure the internal controls and financial condition of a third-party vendor are carefully evaluated prior to the allowance of such support services to begin, and as an on-going condition of continuing support of such products or services. Vendors with access to customer information or direct access to the network are carefully reviewed to ensure that appropriate controls and mechanisms are in place to safeguard confidential information, and the Company's contracts with such vendors include obligations on the part of the vendors to maintain the confidentiality of such information in compliance with applicable legal requirements.

companyName: WILSON BANK HOLDING CO

ticker: WBHC


text: Critical cyber assets, such as data centers, power plants, transmission operations centers and business networks are protected using multiple layers of cybersecurity controls and authentication. Cyber hackers and other malicious actors have caused material disruption by successfully breaching a number of very secure facilities of entities across the spectrum of industries, including federal agencies and financial institutions. As understanding of these events develop, AEP has adopted a defense in depth approach to cybersecurity and continually assesses its cybersecurity tools and processes to determine where to strengthen its defenses. These strategies include monitoring, alerting and emergency response, forensic analysis, disaster recovery, threat sharing and criminal activity reporting. This approach has allowed AEP to deal with cyber and related threats, intrusions and attempted breaches in real-time and to limit their impact to levels that would be expected in the ordinary course of business in the absence of such malicious activity. AEP is not aware of any occurrence from cybersecurity threats, including as a result of any previous cybersecurity incidents, that has materially affected or is reasonably likely to materially affect AEP's business strategy, results of operations, cash flows or financial condition.

companyName: AEP Transmission Company, LLC


text: Cyber Risk Management and Strategy We have processes in place to assess, identify, and manage material risks from cybersecurity threats. Our business is dependent on the communications and information systems of the Adviser, AB and other third-party service providers. The Adviser manages our day-to-day operations and has implemented AB's Information Security Program ("ISP") that applies to the Fund and its operations.

companyName: AB Private Credit Investors Corp


text: We have adopted a Global Cybersecurity Incident Response Procedure that applies in the event of a cybersecurity threat or incident. These procedures include an incident response playbook that outlines the steps to be addressed in the event of a cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.

companyName: ESAB Corp

ticker: ESAB


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Information Officer (the "CIO").

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: Our information security processes are integrated into our overall enterprise risk management ("ERM") process and system. Our ERM process relies on designated risk managers to identify and assess material risks from cybersecurity threats. The risk managers form a multidisciplinary group including members of our IT security, finance, human resources and legal functions, operations and executive management, and are responsible for timely reporting of risks on an ongoing basis. Our ERM process includes an annual evaluation and ranking of the top risks captured in our ERM system against leading third party benchmark reports on global risks.

companyName: Gentherm Inc

ticker: THRM


text: Although we have been subject to breaches of our information technology systems, including breaches of the information technology systems of third-party service providers, the impact of such attacks has not been material to our business strategy, operations or results of operations, financial position, or cash flows through December 31, 2023. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect the Company. For additional information on the risks we face from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" of this Form 10-K.

companyName: HUMANA INC

ticker: HUM


text: With regard to cybersecurity specifically, we have a Chief Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team. Our Chief Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee. Minutes from these meetings as well as select materials are shared with the full Board of Directors, and our Chief Information Security Officer delivers an annual report to our Board of Directors.

companyName: INDEPENDENT BANK CORP /MI/

ticker: IBCP


text: The Audit Committee of the Board (the "Audit Committee") provides independent oversight of the ISP. As a component of the ISP, the Audit Committee receives a report on the health and performance of the ISP on at least an annual basis. The Audit Committee provides guidance and oversight to help ensure the ISP meets the needs of all interested parties and fulfills its core functions.

companyName: CHEGG, INC

ticker: CHGG


text: Voya Financial's Board committees include the Technology, Innovation and Operations ("TIO") Committee, which provides support to the Voya Financial Board in its oversight of information technology, including cybersecurity risks. In addition, the TIO Committee supports the Voya Financial Audit Committee in reviewing cybersecurity risks and disclosures thereof, and collaborates with both the Audit Committee and the Risk, Investment and Finance ("RIF") Committee of Voya Financial's Board to oversee material risks. Management, including the CISO, regularly updates the TIO Committee on cybersecurity-related matters.

companyName: VOYA RETIREMENT INSURANCE & ANNUITY Co


text: In addition, cybersecurity is reviewed as part of our enterprise risk management program led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit and Risk Committee of our Board of Directors.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks.

companyName: NORTECH SYSTEMS INC

ticker: NSYS


text: We are not aware of any existing cybersecurity threats that would materially affect, or that are reasonably likely to materially affect, our business strategy, results of operations, liquidity or financial conditions. Furthermore, we are not aware of having experienced any significant cybersecurity incidents during fiscal year 2024. Management periodically updates the Board of Directors regarding efforts to minimize cybersecurity risks.

companyName: OPTICAL CABLE CORP

ticker: OCC


text: Our Board of Directors holds oversight responsibility over our risk management process, including material risks related to cybersecurity threats. Our Board of Directors administers this oversight function through its committees, including the Audit Committee and the Affiliated Transactions and Risk Committee. A key part of the Audit Committee's responsibility is overseeing the cybersecurity program.

companyName: Angel Oak Mortgage REIT, Inc.

ticker: AOMR


text: The ISMS consists of a set of policies and procedures that serve as a foundation for risk identification and remediation across all company assets. ZoomInfo's ISMS implementation allows for the appropriate integration of security controls into existing or newly created business processes. ZoomInfo's risk management platform is loosely based on the ISO 31000 Risk Management Standard, and continuous risk assessment activities are conducted in partnership and coordination with risk owners in various functions.

companyName: ZoomInfo Technologies Inc.

ticker: GTM


text: All of the Company's personnel are employees of the Manager or one of its affiliates and are subject to the Manager's policies and procedures. Our Manager utilizes a third-party managed & cybersecurity services provider (the "MSSP") for cybersecurity services, including threat detection and response, vulnerability assessment and monitoring, security incident response and recovery and general cybersecurity education and awareness. Our Manager and the MSSP engage in periodic assessment and training regarding the policies, standards and practices designed to address cybersecurity threats and incidents. Our cybersecurity risk management is integrated into our overall enterprise risk management and shares common methodologies, reporting channels and governance processes that apply across our enterprise risk management.

companyName: Advanced Flower Capital Inc.

ticker: AFCG


text: Our primary business involves investments in mortgages and mortgage instruments, but we do not perform mortgage servicing, maintain customer accounts, or provide any direct mortgage lending. Nor do we receive personal information on individual mortgage borrowers as part of our regular operations. However, our business is highly dependent on the availability of information systems, and a cybersecurity incident, if one were to occur, could have the potential to disrupt our operations. Please refer to Risks Related to Our Business Operations in Item 1A. Risk Factors of this Form 10-K for a further discussion of the risks posed by cybersecurity threats.

companyName: AGNC Investment Corp.

ticker: AGNC


text: As of the date of this Annual Report on Form 10-K we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition. However, despite our best efforts, we cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced undetected cybersecurity incidents. See "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion.

companyName: FLEXSTEEL INDUSTRIES INC

ticker: FLXS


text: We have engaged a third-party service provider periodically to review and improve our cybersecurity risk management framework, including by identifying third-parties information systems that could cause cybersecurity incidents to our business.

companyName: SemiLEDs Corp

ticker: LEDS


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Corporation. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit and IT Committees, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts. Management provides benchmarking information and updates on key operational and compliance metrics to the Board. In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks.

companyName: CNB FINANCIAL CORP/PA

ticker: CCNE


text: Our board of directors oversees our overall risk management strategy. The Audit Committee has general oversight with respect to cybersecurity risk. The Audit Committee has established a cybersecurity subcommittee to discuss issues and risks related to cybersecurity, and it includes one of our board members with cybersecurity experience, and holds regular meetings. This subcommittee has a dedicated agenda during such meetings that are designed to assist the Audit Committee with its cybersecurity oversight and allow it to report to the full Board if necessary. The meetings involve presentations and reports from our management, security leadership and information security team, including updates on relevant cybersecurity threats faced by the company and steps we are taking to address them.

companyName: Enphase Energy, Inc.

ticker: ENPH


text: Our Audit Committee assists the Board in overseeing cybersecurity risks, including discussing with management and the information security team if cybersecurity threats are identified, and recommends cybersecurity framework improvements to the Board.


text: Our CISO, who reports to our Chief Financial Officer ("CFO"), leads our cybersecurity program and has more than 20 years of cybersecurity experience. The cybersecurity teams reporting to our CISO are staffed by highly skilled cybersecurity professionals, including both internal staff and external partners, with broad knowledge of cybersecurity issues from experience and through training and certifications. Our cybersecurity teams are responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. Our CISO, in coordination with our cybersecurity teams, and members of our senior leadership team such as our Chief Executive Officer ("CEO"), CFO and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and respond to any cybersecurity incidents in accordance with our incident response and recovery plans in real time.

companyName: Crane NXT, Co.

ticker: CXT


text: Although we have designed our cybersecurity program and governance procedures discussed above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks. To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future. See the section entitled " Risk Factors " included elsewhere in this Annual Report for further information. We continuously work to enhance our cybersecurity risk management program.

companyName: Meridian Holdings Inc./NV

ticker: MRDN


text: For third-party service vendors that perform a variety of important functions for our business, we seek to engage reliable, reputable service vendors that maintain cybersecurity programs. Depending on the nature and risk profile of the services provided and the sensitivity of information processed, we may from time to time conduct a review of the cybersecurity practices of such vendor, contractually imposing obligations on the vendor and conducting periodic reassessments during their engagement. We are currently not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or, to our knowledge, are reasonably likely to materially affect our business, financial condition and results of operations. See to Item 1A. "Risk Factors" in this annual report on Form 10-K, including "We face cybersecurity risks and risks associated with security breaches", for additional discussion about cybersecurity-related risks.

companyName: Postal Realty Trust, Inc.

ticker: PSTL


text: Privacy and Security We are entrusted with highly personal data and are committed to protecting the privacy and security of our customers and organization. Protection and access to company data is the keystone of the cybersecurity strategy and is considered the utmost of business requirements. We use the GDPR as our guidepost for data protection practices and continue to monitor emerging U.S. laws.

companyName: FOXO TECHNOLOGIES INC.

ticker: FOXO


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: We have designed and maintain a cybersecurity risk management program that is integrated into our overall enterprise risk management program and with other related functions, such as information technology, or IT, system architecture and vendor management; that leverages best practices and standards and that is designed to assess, identify and manage risks from cybersecurity and other information security threats. As part of this program, we periodically evaluate risks from cybersecurity threats as part of our broader risk management activities and as a component of our internal control system. In the course of our evaluation, we consider risks that may be associated both with our internally managed IT systems and key business functions and with sensitive data operated or managed by third-party service providers, vendors and collaborators with whom we engage.

companyName: Mersana Therapeutics, Inc.


text: Despite the Company's implementation and maintenance of the cybersecurity program and its components as identified above and elsewhere herein that includes a variety of best practice security measures, our information technology systems, networks, and data are subject to cyber-attacks or physical break-ins, unauthorized tampering or other security breaches. Notwithstanding these protections, attacks may result in a failure to maintain the security, confidentiality or privacy of sensitive information. To date, the Company has not had any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, its business strategy, results of operations, or its financial condition. There can be no assurance that a future cybersecurity incident would not result in a loss and/or have a material adverse effect on our reputation, business, results of operations, or financial condition.

companyName: MBIA INC

ticker: MBI


text: Management and Strategy have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats and integrated these processes into our overall risk management systems and processes. We assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: Peraso Inc.

ticker: PRSO


text: As previously stated, the ISGC, appointed by the Board, bears the responsibility for cybersecurity risk management and strategy. The vCISO oversees the ISP and coordinate with the ISGC. The ISGC includes key personnel including the vCISO, Chief Operating Officer, Technology Services Director, Information Technology Manager, Internal Audit Manager, Compliance Manager, and Information Security Specialists. The ISGC members bring diverse qualifications, certifications, and extensive experience to the table. This collective expertise ensures a comprehensive and well-rounded approach to our information security initiatives.

companyName: Sound Financial Bancorp, Inc.

ticker: SFBC


text: Our IT personnel oversees information technology ("IT") strategy, operations, cybersecurity, compliance, and business applications. They are dedicated to accelerating and scaling our company by implementing innovative technology across the company. Additionally, they are an accomplished IT expert with over 15 years of experience driving transformative change across diverse industries, including manufacturing, financial services, and software as a service.

companyName: Velo3D, Inc.

ticker: VELO


text: 4. Regulatory and Legal Compliance: Cybersecurity incidents may subject us to regulatory investigations, legal claims, and penalties, affecting our compliance with applicable laws and regulations.

companyName: ONE STOP SYSTEMS, INC.

ticker: OSS


text: We conduct annual risk assessments and perform as needed updates to our risk register to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.

companyName: IGM Biosciences, Inc.


text: Our Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks from cybersecurity threats. The Board and the Audit Committee receive regular presentations and reports on cybersecurity risks from our CISO, which can include a wide range of topics such as recent developments, evolving standards, security effectiveness, vulnerability assessments, third-party and independent reviews, the current and evolving threat environment, incident response planning, remediation efforts, employee training and awareness (such as the results of our annual cybersecurity training), technological trends and information security considerations arising with respect to our peers and third parties. On a quarterly basis, our Audit Committee discusses our approach to cybersecurity risk management with our CISO and other members of management, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. One of our independent directors, Ms. Hammoud, a seasoned software executive, is a member of the Audit Committee and also provides direct guidance on cybersecurity matters to our CISO outside of regularly scheduled Audit Committee and Board meetings.

companyName: PROS Holdings, Inc.


text: While some of our third-party service providers have experienced cybersecurity incidents and have experienced threats to their data and systems, as of the date of this report, we are not aware of any cybersecurity threats or incidents that have materially affected our business strategy, results of operations, or financial condition. This does not guarantee that future incidents or threats will not have a material impact by interrupting operations, causing reputational harm, increasing operating costs, or exposing the Company to litigation. For additional commentary on cybersecurity risks, see Part 1, Item 1A. Risk Factors.

companyName: FULLER H B CO

ticker: FUL


text: cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.

companyName: Fold Holdings, Inc.

ticker: FLD