text: Our cybersecurity team, which is responsible for assessing and managing our risks from cybersecurity threats, is led by the CIO/CISO, who reports to our Chief Financial Officer. The Security Steering Committee provides additional oversight for assessing and managing cybersecurity risk.

companyName: PENTAIR plc

ticker: PNR


text: As a corporation committed to maintaining the integrity, confidentiality, and availability of the Company's digital assets and sensitive information, the Company recognizes the critical importance of cybersecurity in today's interconnected business landscape. The Company's cybersecurity measures are designed to safeguard the Company's systems, networks, data, and information from unauthorized access, disruption, or misuse.

companyName: Virginia National Bankshares Corp

ticker: VABK

secItem: Item 1C


text: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management and post-incident analysis designed to safeguard the confidentiality, availability and integrity of our platform and assets. A cross-functional incident response team, comprised of representatives from our internal security committee including information technology, information security, engineering, cloud operations, compliance, privacy, legal and members of our executive leadership team, is responsible for the monitoring and disposition of potential incidents, such as data breaches, intrusions and other security events, and implementing our detailed incident response plan. Our approach includes procedures to appropriately inform management, the audit committee of the board of directors and the full board of directors, as applicable, about cybersecurity threats and incidents. In fiscal 2024, we did not identify any cybersecurity incidents that materially affected, or are reasonably likely to materially affect, our business, results of operations or financial condition. For more information about these risks, please see "Risk Factors – Risks Related to Our Business" in this Annual Report on Form 10-K.

companyName: Zscaler, Inc.

ticker: ZS


text: The Audit Committee of our Board of Directors is charged with reviewing, discussing with management and overseeing the Company's information technology and cybersecurity risk. Our CISO and Senior Vice President, Internal Audit and Risk report regularly to the Audit Committee, and at least annually, to the full Board of Directors on cybersecurity risks and management thereof.

companyName: ADVANCE AUTO PARTS INC

ticker: AAP


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board of Directors' Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.

companyName: TEJON RANCH CO

ticker: TRC


text: We use a combination of training and education, including mandatory annual cybersecurity and privacy training, phishing simulation exercises and a multitude of alerts, educational tools, videos and other ongoing awareness initiatives on a variety of topics relating to the rapidly evolving threat landscape, throughout the year that foster a culture of security awareness and responsibility among our workforce.

companyName: Kyndryl Holdings, Inc.

ticker: KD


text: We operate processes to maintain an internal culture that expressly values cybersecurity. This includes broad-based processes for cybersecurity training, internal communications, reporting concerns, and escalations. Our security awareness and skills training processes guide behaviors across our workforce to be security conscious. Consultants provide valuable services within our cybersecurity risk management.

companyName: Informatica Inc.

ticker: INFA


text: For a discussion of how risks from cybersecurity threats affect our business, and our reliance on Blackstone in managing these risks, see "Item 1A. Risk Factors – Risk Related to our Business – Cybersecurity and data protection risks could result in the loss of data, interruptions in our business, and damage to our reputation, and subject us to regulatory actions, increased costs and financial losses, each of which could have a material adverse effect on our business and results of operations."

companyName: Blackstone Secured Lending Fund

ticker: BXSL


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and confidential information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.

companyName: Airbnb, Inc.

ticker: ABNB


text: Impact of Cybersecurity Risk During the period covered by this report, we are not aware of any cyber incidents that, individually or in the aggregate, have been material to our operations or financial condition. Additionally, we do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our strategy, results of operations or financial condition over the long term. For a discussion of cybersecurity risk, see the information contained under the heading "Our business is subject to various cybersecurity risks" in Item 1A. "Risk Factors" in this Form 10-K.

companyName: Evercore Inc.

ticker: EVR


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident or cybersecurity threat that has materially affected, or is reasonably likely to materially affect, our business strategy, results of operations or financial condition. However, we understand that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks.

companyName: Core Laboratories Inc. /DE/

ticker: CLB


text: We regularly assess cybersecurity risks to our systems, applications, and infrastructure; are in the process of building our capabilities to monitor our information systems for potential vulnerabilities; and implement controls pursuant to our cybersecurity policies, processes, and practices. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner. We have also developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.

companyName: AirJoule Technologies Corp.

ticker: AIRJ


text: Cybersecurity Governance Corning's Board of Directors ("Board") plays a role in overseeing risks associated with cybersecurity threats. In particular, the IT Committee of the Board is responsible for cybersecurity governance and has information security oversight as a key component of its charter. In all meetings, the IT Committee reviews the Company's cybersecurity posture as well as significant cybersecurity events. Corning's Chief Digital and Information Officer ("CDIO"), in combination with Corning's CISO, briefs the IT Committee on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. On an annual basis, the CISO provides a cybersecurity update to the Board to review significant cybersecurity risks and their impact, if any, on internal controls. At any time, Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures. Should a cybersecurity incident rise to the level of a corporate crisis, consistent with the Company's CCRT escalation protocols, the Board would be engaged.

companyName: CORNING INC /NY

ticker: GLW


text: The steps we take to reduce vulnerability to cyber-attacks and to mitigate and remediate the impact of cybersecurity incidents in a timely and coordinated manner include, but are not limited to: establishing information security policies and standards, implementing information protection processes, tools and technologies, monitoring information technology systems for cybersecurity threats, coordinating internal reporting, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. In addition to our internal Information Security teams, we also utilize trusted third-party auditors and recognized cybersecurity consultants and certified assessors, to assess cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements. A third party evaluates our information security policies, standards and control environment at least annually. Assessments and testing protocols are performed against industry best practices and widely recognized security frameworks.

companyName: Elevance Health, Inc.

ticker: ELV


text: We have developed and continue to enhance our cybersecurity risk management program as we seek to protect the security of our information systems, software, networks and other technology assets against unauthorized attempts to access confidential information and data or to disrupt or degrade business operations. Our cybersecurity risk management program has evolved, and continues to evolve, based on the changing needs of our business, the evolving threat environment and FHFA regulatory guidance.

companyName: FEDERAL NATIONAL MORTGAGE ASSOCIATION FANNIE MAE

ticker: FNMA


text: Our cybersecurity program is run by our Chief Information Security Officer (CISO) and Chief Financial Officer (CFO), who reports to our Chief Executive Officer (CEO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from our IT Director and the Cybersecurity consultant expert.

companyName: BK Technologies Corp

ticker: BKTI


text: Governance of information security risks We have also established a risk governance committee, which generally meets on a quarterly basis. This committee, which is sponsored by our VP of Information Technology, is comprised of Company leaders from information security, information technology (IT), legal, privacy, finance, operations, and other functions, who have experience in managing cybersecurity risks, who review the cybersecurity threat landscape, and who evaluate key emerging data security risks. The committee reviews certain cybersecurity-related risks facing the company; discusses open policy exceptions and key risk indicators; and manages cybersecurity risks presented by the information security team and proposed mitigation actions. Members of this committee review the key risks identified as an outcome of our cybersecurity risk management strategy described below.

companyName: Outset Medical, Inc.

ticker: OM


text: Our Cybersecurity Risk Mitigation Practices are managed on a day-to-day basis by members of our Information Security Steering Committee, or the Committee, and are overseen by our Board of Directors. The Committee is composed of senior management, including our Chief Information Officer and Chief Financial Officer, and senior vice presidents from various areas of the organization including IT, compliance, legal, operations and human resources, including the Vice President of Information Security and Compliance. The Vice President of Information Security and Compliance has over 40 years of IT experience and is a certified information systems security professional.

companyName: PC CONNECTION INC

ticker: CNXN


text: Safeguarding our information technology systems, intellectual property, and the confidential information and personal data that customers, suppliers, business partners, employees and others share with us is a critical concern for our business. As such, we have processes in place to assess, identify, and manage material cybersecurity threats and incidents. Key to these efforts is our cybersecurity risk management program (the "Cybersecurity Program"). We aim to incorporate industry best practices throughout our Cybersecurity Program. It is founded on the NIST's Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the ISO, and other applicable industry standards for protecting controlled unclassified information. The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks. The controls are tested and evaluated on a regular basis and include the following controls: network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks; evaluation and monitoring of detected security events; and documented incident response actions and procedures. In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.

companyName: ROGERS CORP

ticker: ROG


text: We strive to manage cybersecurity risks and protect sensitive information through various means, such as technical safeguards, procedural requirements, close monitoring on our corporate network. We may engage assessors, consultants, auditors, or other third parties to enhance our cyber security risk management processes. Any cybersecurity incidents are closely monitored for their potential impact on our business of the date of this annual report, we have not experienced any material cybersecurity incidents or identified any material cybersecurity threats that have affected or are reasonably likely to materially affect us, our business strategy, results of operations or financial condition.

companyName: Singularity Future Technology Ltd.

ticker: SGLY


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee and the Board of Directors, and the Company considers adjustments to its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.

companyName: EQUITY LIFESTYLE PROPERTIES INC

ticker: ELS


text: Oversight of Cybersecurity Risk Management Oversight of cybersecurity risk is the responsibility of the Board of Directors as part of its broader role in overseeing the Company's enterprise risk management framework. The Board receives periodic updates from management regarding cybersecurity matters, including the Company's information security program, risk assessments, and incident response preparedness.

companyName: DevvStream Corp.

ticker: DEVS


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments, certifications, audits and cybersecurity threat intelligence.

companyName: AMTECH SYSTEMS INC

ticker: ASYS


text: As a government contractor, GEO routinely processes, stores, and transmits large amounts of "Personally Identifiable Information". As such, we understand the criticalness of having a robust cybersecurity program that protects company assets as well as our clients' data. Our customers, suppliers, service providers, subcontractors, and joint venture partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: GEO GROUP INC

ticker: GEO


text: To date, there have been no risks identified from cybersecurity threats or previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company. However, despite all of the above aforementioned efforts, a cyberattack, if it occurred, could cause system operational problems, compromise important data or systems or result in an unintended release of confidential information. See "Item 1A. Risk Factors" for additional discussion of cybersecurity risks impacting our Company.

companyName: INTELLIGENT BIO SOLUTIONS INC.

ticker: INBS


text: CyberTeam provides our board and executive leadership team with periodic updates about our cybersecurity program and material risks. This includes updates on cybersecurity practices, programs, and the status of projects designed to strengthen internal cybersecurity and data protection.

companyName: Lucid Diagnostics Inc.

ticker: LUCD


text: Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our Company, including financial, operational, regulatory, reputational, and legal. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are integrated into the Company's ERM program and are based on recognized frameworks established by the Federal Financial Institutions Examination Council and other industry recognized standards. Our Chief Information Security Officer ("CISO"), who reports directly to the Bank's Chief Risk Officer ("CRO"), along with key members of his team, regularly collaborates with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues to identify best practices. The information security program is periodically reviewed by the Bank's CISO with the goal of addressing changing threats and conditions. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Stellar Bancorp, Inc.

ticker: STEL


text: Our executive team, including our Chief Financial Officer and Chief Information Officer, receive regular briefings on: • Cybersecurity trends and evolving threats; • Program effectiveness and risk mitigation strategies; and • Updates to regulatory and legal requirements related to data security and privacy.

companyName: MASIMO CORP

ticker: MASI


text: Related to Cybersecurity Risks The Company's cyber risk management program and related operations and processes are directed by the Senior Vice President of Information Technology (the "SVP-IT"). Currently, the SVP-IT role is held by an individual who has over twenty five years of cybersecurity, information technology and systems engineering experience. The SVP-IT meets with the Chief Financial Officer and Chief Legal Officer quarterly to monitor and review the outcomes of the Company's cybersecurity risk management processes and to discuss and decide matters related to cybersecurity risk treatment strategy (including mitigations).

companyName: MACERICH CO

ticker: MAC


text: TIAA has a comprehensive cyber attack response plan designed to inform the proper escalation (including, as appropriate, to certain of our executive officers and other representatives of our Advisor) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a Priority Incident Response Team ("PIRT") composed of individuals from several internal technical and managerial functions investigates, remediates the event, and determines the extent of external advisor support required, including from external counsel, forensic investigators, and law enforcement. The cyber attack response plan sets out ongoing monitoring or remediating actions to be taken after resolution of an incident.

companyName: Nuveen Global Cities REIT, Inc.


text: We rely on the digital technology of AB and the Adviser to conduct our business operations and engage with our clients and business partners. The technology that AB, the Adviser, clients, and business partners rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct. Information Security is an ongoing process of exercising due care that is designed to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.

companyName: AB Private Credit Investors Corp


text: Cross-Functional Collaboration Astrana Health utilizes a cross-functional governance structure that engages enterprise risk management, compliance, IT, legal, privacy, and data governance teams. Our risk management / cyber working group, which includes certain of our senior leaders, including operations, finance, internal audit, IT, cyber, legal, and communications, meets at least four times per year to discuss significant risks to the Company identified by our enterprise-wide risk management process, including cybersecurity risks identified by our cybersecurity risk management program. The group also discusses the steps management has taken to identify, monitor, assess, and control or avoid such exposures and reviews performance measures against the Company's risk appetite and tolerance and provides recommendations of corrective action where appropriate. This collaborative approach enables a holistic evaluation of cybersecurity risks and aims to ensure that identified threats are promptly addressed.

companyName: Astrana Health, Inc.

ticker: ASTH


text: We have an annual assessment performed by a third-party specialist of our cyber risk management program. The annual risk assessment identifies, quantifies, and categorizes material cyber risks. In addition, in conjunction with the third-party cyber risk management specialists we develop a risk mitigation plan to address such risks, and where necessary, remediate potential vulnerabilities identified through the annual assessment process.

companyName: AIM ImmunoTech Inc.

ticker: AIM


text: We utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage outside partners to gain intelligence on threats. We take input from industry activities, third party assessments and internal simulations and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections. If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and CAO. All Pacira employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use state-of-the-art technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology and the CAO.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: In the ordinary course of our business, we collect and store certain confidential information such as information about our employees, contractors, vendors, customers, suppliers, independent sales agents and distributors. We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, and we monitor the Company's overall security score to assess performance and identify areas for improvement. In recent years, we have installed a new firewall to better protect from network intrusions, hired a Network and Security Administrator, and engaged a third-party service provider to perform an internal penetration test in order to identify and address vulnerabilities. Additionally, we introduced always-on VPN in an effort to better restrict off-campus network access in light of the increase in the number of our employees working remotely in recent years, enhanced our monitoring and control capabilities, and hardened our cloud computing cyber security footprint. Management continually re-assesses the Company's cybersecurity risk environment based on changing circumstances and new information identified by its monitoring, scanning and testing as well as third party resources.

companyName: Xtant Medical Holdings, Inc.

ticker: XTNT


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of the Data Privacy and Security Committee, which includes the Company's Head of Information Technology.

companyName: Day One Biopharmaceuticals, Inc.

ticker: DAWN


text: Should any material cybersecurity incidents occur, we will assess the situation and disclose the nature, scope, and potential impact of the incident in accordance with SEC regulations.

companyName: C & C TOURS, INC.


text: Incident and response reports and lessons learned from any cybersecurity incident(s); and Compliance report with regulatory requirements and industry standards. In addition to scheduled presentations described above, the IT Department contracted CIO, the Chief Administrative Officer and General Counsel, and the President and Chief Executive Officer maintain constant dialogue regarding emerging or potential cybersecurity risks and threats. The Chief Administrative Officer and General Counsel is in regular contact with the Audit Committee Chair related to these risks so that the oversight by the Board can be both proactive and responsive. The Audit Committee has the authority to actively participate in strategic decisions related to cybersecurity and offers guidance and approval for major initiatives. As a result, cybersecurity considerations can be integrated into the foundation of broader corporate objectives. The Audit Committee and the Board conduct an annual review of the Company's cybersecurity risk position and the effectiveness of its risk management strategies and measures. From this review at the Board level, the Company is able to identify areas where there exist improvement opportunities and can set goals for the following year.

companyName: YORK WATER CO

ticker: YORW


text: Immediate Assessment: Conducted by the incident response team to determine the incident's nature, scope, and potential impact on QHSLab, Inc.'s operations and sensitive patient data.

companyName: QHSLab, Inc.

ticker: USAQ


text: Cybersecurity Incidents When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber incident response plans, which are a supplement to our corporate incident response plan. These plans provide a framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage incidents impacting banking information, including our clients' and employees' information.

companyName: KEYCORP /NEW/

ticker: KEY


text: We have developed and implemented a comprehensive cybersecurity strategy and risk management program that is informed by the following key elements: • Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats. • Periodic Business Impact Assessments ("BIAs") of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services. • An external assessment of the cybersecurity risks associated with our operations.

companyName: ASTEC INDUSTRIES INC

ticker: ASTE


text: Our processes also aim to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB


text: We have also established a cross-functional Cybersecurity Steering Committee, led by our Chief Executive Officer serving as the chair and consisting of other executive-level leaders, that is responsible for providing leadership in the protection of information assets and technology. The committee members advise on and prioritize the development of information security initiatives, projects, and policies as advocates for our stakeholders. This committee is also charged with helping to resolve security and compliance risk issues affecting us.

companyName: Inozyme Pharma, Inc.


text: We also maintain a business continuity program designed to ensure that resources and plans are in place to protect the Bank from potential loss during a disruption, which includes the unavailability of our information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. These business continuity resources and plans include, but are not limited to, maintaining a business continuity site to ensure continued operations, regular backing up of data and systems, testing our ability to operate on disaster recovery systems, and annually reviewing department level business continuity procedures.

companyName: Federal Home Loan Bank of Boston


text: The Company's information technology systems are in some cases integrated, such that damage, disruption or shutdown to one system could result in a more widespread impact on the Company's systems as a whole. If the Company's information technology systems suffer severe damage, disruption or shutdown, and its business continuity plans do not effectively resolve the issues in a timely manner, the Company's business could be negatively affected. In addition, cyber-attacks could lead to potential unauthorized access and disclosure of confidential information, data loss and corruption, see "Item 1A. Risk Factors" under the heading "The Company relies on information technology, and if it is unable to protect against service interruptions, data corruption, cyber-based attacks or network security breaches, its operations could be disrupted and its business could be negatively affected" of this Annual Report on Form 10-K. A cybersecurity incident could materially harm the Company's reputation and financial condition and cause us to incur legal liability and increased costs to respond to such events.

companyName: SEACOR Marine Holdings Inc.

ticker: SMHI


text: Education, training and preparedness efforts. Education, training and preparedness are an important part of our information security program. In connection with our education and training efforts, we have developed and implemented a set of Company-wide policies and procedures regarding cybersecurity matters that impose responsibility on our employees through the course of their work to: (i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner. In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory additional technical training, each on an annual basis. In connection with our preparedness efforts, we periodically participate in tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur. We also maintain documented incident response policies to help ensure that our response activities are consistent and appropriate. Governance. See the disclosure under the caption "Cybersecurity Governance" below.

companyName: Angi Inc.

ticker: ANGI


text: The CISO is responsible for managing and implementing the Cybersecurity Program and reports directly to the chief information officer. The CISO oversees the Technology Risk team, which assesses and manages material risks from cybersecurity threats, sets firmwide control requirements, assesses adherence to controls, and oversees incident detection and response.

companyName: Goldman Sachs Physical Gold ETF

ticker: AAAU


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition over the long term. For additional information regarding cybersecurity-related risks we face, see "Risk Factors – Risks Related to Our Technology, Data and Intellectual Property – Cyberattacks, data incidents and breaches in the security (i) of our information systems and networks, (ii) of the products we sell and services we provide, and (iii) of the electronic and confidential information in our possession could materially adversely impact our financial condition, results of operations, reputation, and relationships with clients, partners, vendors, and teammates," in Part I, Item 1A of this report. INSIGHT ENTERPRISES, INC.

companyName: INSIGHT ENTERPRISES INC

ticker: NSIT


text: As we grow, we plan to refine our cybersecurity strategy in line with global best practices and standards. Importantly, our Board receives regular updates from our Chief Operating & Technology Officer, Christodoulos Tzoutzakis, of potential cybersecurity risks and monitors these risks closely. All potential incidents, regardless of their materiality, are required to be reported immediately to the Board. To date, our proactive risk management has allowed us to navigate cybersecurity challenges without material impairment to our operations or financial condition.

companyName: Elvictor Group, Inc.

ticker: ELVG


text: The Chief Information Officer has over 28 years of experience in cybersecurity and is responsible for designing and implementing the organization's cybersecurity strategy. The cybersecurity program and the Information Security Team are led by the Senior IT Director, who reports to the Chief Information Officer. The Senior IT Director has over 21 years of experience in cybersecurity. The Information Security Team is responsible for security operations, cybersecurity monitoring, application security audits, and responding to incidents through a structured Incident Response Plan.

companyName: HEICO CORP

ticker: HEI


text: Incident Response PTC maintains a formal Cybersecurity Incident Response Policy to address cybersecurity incidents. The Policy is tested on a regular basis, including a continuous improvement program involving periodic tabletop exercises. Cybersecurity incident handling is managed by individual organizations with cybersecurity responsibility and monitored/guided by applicable corporate functions. All Cybersecurity Incident Response Plans under the Policy are based on industry standards, such as the NIST Computer Security Incident Handling Guide – Special Publication 800-61.

companyName: PTC INC.

ticker: PTC


text: Our cybersecurity program includes monitoring for potential security threats that may lead to exploitation of vulnerabilities. We evaluate and assign severity levels to incidents, escalate and engage incident response teams based on severity, and manage and mitigate the related risks. Incidents are reported internally to members of senior management and the Board of Directors as appropriate based on severity and incident type and are also analyzed for external reporting requirements. Our incident management process is designed to coordinate functions to enable continuity of essential business operation in the event of a cyber crisis.

companyName: RTX Corp

ticker: RTX


text: Cybersecurity Program Overview TIAA has instituted an enterprise cybersecurity program designed to identify, assess, and mitigate cyber risks applicable to TIAA and its affiliates, which applies to the Company and the Advisers. Cyber risk management is integrated into TIAA's overall risk management program and involves risk assessments, implementation of security measures, and ongoing monitoring of systems and networks, including networks on which the Company relies. TIAA relies on its internal subject matter experts and external experts, as needed, including, but not limited to, cybersecurity assessors, consultants, and auditors, to evaluate cybersecurity measures and risk management processes applicable to the Advisers, the Company and other affiliates of TIAA.

companyName: Nuveen Churchill Direct Lending Corp.

ticker: NCDL


text: We also have a cybersecurity steering committee responsible for assisting with our overall day-to-day cybersecurity responsibilities and implementing our cybersecurity programs. The cybersecurity steering committee is currently comprised of members of our digital and enterprise capabilities team and is chaired by our executive director of cybersecurity. Among other things, the cybersecurity steering committee: • reviews our internal controls to help protect our information assets; • assists with developing practices, procedures, and controls designed to identify, assess, and manage critical cybersecurity programs and risks; and • works to align our risk governance structure, including policies and procedures, with our business objectives.

companyName: Sage Therapeutics, Inc.


text: Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection. Our information security efforts are designed to evolve with the changing security threat environment through ongoing assessment and measurement. In our efforts to keep our data and technology systems secure, we leverage both the International Organization for Standardization (ISO) 27002 Security Framework for the body of security control requirements and the National Institute of Standards and Technology Cybersecurity Framework to assess the strength of our processes and defenses. This integrated approach to protect data and information systems is also built into our project management, development, and operations. To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ internal resources and, regularly, external resources, to evaluate our environment, information systems, and processes.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR


text: Furthermore, the Company utilizes third-party service providers to perform a variety of functions to assist in operating the business. The cybersecurity risks associated with the use of certain providers are covered under a vendor management process. Depending on the nature of the services provided, the sensitivity and/or quantity of information processed, the vendor management process may include reviewing cybersecurity practices of these providers, contractually imposing obligations on the provider, inspecting independently audited reports, and/or conducting its own security assessments of their services.

companyName: GIBRALTAR INDUSTRIES, INC.

ticker: ROCK


text: The Audit and Finance Committee receives regular reports (at least quarterly) from our Chief Information Security Officer ("CISO") and our Senior Vice President and Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including, as applicable, our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of any ongoing cybersecurity or other enterprise security risk management initiatives, incident reports and the results of internal and external assessments of our information systems. The Audit and Finance Committee also annually reviews the adequacy and effectiveness of our information and technology security processes and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities.

companyName: Seagate Technology Holdings plc

ticker: STX


text: Our management team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.

companyName: COSTAR GROUP, INC.

ticker: CSGP


text: Our cybersecurity program is managed by our Chief Digital and Technology Officer and our Chief Security Officer. The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the effectiveness of the Company's cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies. As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and the Chief Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities. The Audit and Finance Committee has also added a leading cybersecurity incident and response firm to serve as its advisor on cybersecurity matters.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified through review by our internal information technology governance, risk and compliance policies. To defend, detect and respond to cybersecurity incidents, we, among other things: may conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.

companyName: Innovative Payment Solutions, Inc.

ticker: IPSI


text: We are a blank check company with no business operations. Since our Initial Public Offering, our sole business activity has been identifying and evaluating suitable target businesses for a business combination. Therefore, we do not consider that we face significant cybersecurity risk. Nevertheless, we employ various procedures designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats given our limited operations. These include, but are not limited to, internal reporting, monitoring and detection tools and anti-virus software. We also periodically assess risks from cybersecurity and technology threats and monitor our information systems for potential vulnerabilities, including those that could arise from internal sources and external sources such as third-party service providers we do business with.

companyName: Inflection Point Acquisition Corp. V

ticker: IPEX


text: The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels, and annually at the Board of Directors level, to validate roles and responsibilities, and response protocols respective to cybersecurity threats.

companyName: WEBSTER FINANCIAL CORP

ticker: WBS


text: Board of Directors Our Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management and monitoring of risks arising from cybersecurity threats. The Company's management regularly reviews with the Board and the Audit Committee the measures implemented by the Company designed to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Board and the Audit Committee receive reports and presentations quarterly, and on an as-needed basis, from members of our team responsible for overseeing the company's cybersecurity risk management, including the head of our IT department, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. In addition, we employ a major international accounting firm to act as our internal audit function and cybersecurity experts from the firm regularly assess the Company's data protection and cybersecurity systems and present the results of its assessments to our Audit Committee. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.

companyName: Innovex International, Inc.

ticker: INVX


text: The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. We also assess and identify potential cyber and information security risks relating to third-party technology providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We may also collaborate with third-party suppliers to develop and align incident response plans. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see "Item 1A. Risk Factors" in this Annual Report for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations, or financial condition. We cannot provide assurances that we will not experience cybersecurity incidents in the future or that any future cybersecurity incidents will not materially affect us, including our business strategy, results of operations, or financial condition.

companyName: Premier, Inc.


text: Management Oversight— Management is responsible for the day-to-day handling of risks facing our Company, including cybersecurity risks. Our CISO, who reports directly to our CDTO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CDTO and other members of senior management, who, in turn, report them to our Board and Audit and Compliance Committee, as appropriate. Our CISO joined us in January 1998 with 13 years of experience in various technology and information security roles within Ardent.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our cybersecurity program follows the National Institute of Standards and Technology, as well as the Cybersecurity and Infrastructure Security Agency frameworks. Additionally, we follow federal and state statutory and regulatory guidance and have adopted internal policies and standards in alignment with these federal and state requirements. Furthermore, we collaborate with external experts, consultants and auditors in routinely evaluating and testing our information systems controls. We also perform an annual cyber table-top exercise with a regulatory agency to help us test and continue to develop our Cyber Incident Response Plan.

companyName: Green Plains Inc.

ticker: GPRE


text: The Board, through the Information Technology Steering Committee, works with senior management and other employee committees to oversee the development, implementation, maintenance, and administration of the Information Security Program, which is aligned and integrated into Ohio Valley's overall risk management system and processes. The Information Technology Steering Committee itself is comprised of diverse directors and officers of the Bank with vast knowledge and years of banking experience. The Information Security Officer of the committee has 26 years of banking experience including 25 IT related years as well as continuing education including a BA in Management Information Systems and Network+ and A+ certifications. The purpose of the Information Security Program is to: Identify and analyze cybersecurity risks; Provide the Company with direction on effectively managing such risks; Approve information security plans, policies, and programs; Assess whether the Company's current security programs are effective; and Provide recommendations for corrective action.

companyName: OHIO VALLEY BANC CORP

ticker: OVBC


text: Risk Management Expertise With over 23 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company's security infrastructure. In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats. The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan. The AVP, IT Security is a Certified Information Security Manager and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.

companyName: SERVICE CORP INTERNATIONAL

ticker: SCI


text: Management's Role Managing Risk. The vice president of support services plays a large role in informing the audit committee on cybersecurity risks. The audit committee receives presentations and reports from the vice president of support services on cybersecurity related issues which include information security, technology risks and risk mitigation programs regularly at the quarterly board meetings. In addition to scheduled meetings, the vice president of support services and audit committee maintain an ongoing dialogue regarding emerging or potential cybersecurity risks.

companyName: Knife River Corp

ticker: KNF


text: We have a Chief Information Security Officer ("CISO") and have an IT Steering Committee ("ITSC"). Our CISO is responsible for establishing the cybersecurity vision for the Company, determining and prioritizing cybersecurity initiatives, and keeping abreast of developing security threats. The ITSC reports to the Board and Audit Committee, is chaired by our Chief Risk Officer ("CRO"), and has our CISO, Chief Financial Officer ("CFO"), and GRILChief Executive Officer, and SEC Reporting Officer as some of its members. Our CISO brings over three decades of expertise in the IT Industry and is a member of ISACA, showcasing a rich portfolio of industry certifications like the Certified Information Security Manager ("CISM"), Certified Data Privacy Solutions Engineer ("CPDSE"), and Microsoft Certified Systems Engineer ("MCSE"). The CISO also holds accreditations from vendors such as CISCO and Microsoft. Our CRO has over 20 years' experience in the property and casualty reinsurance industry, and significant expertise in the field of risk management. He holds a CISM certification, as well as a B.Sc. in Mathematics and a Ph. D. in Computer Science from the University of Salford. Other members of the ITSC hold relevant qualifications and collectively, the ITSC has substantial experience and expertise in cybersecurity, risk, strategy, and management.

companyName: GREENLIGHT CAPITAL RE, LTD.

ticker: GLRE


text: Our CISO, who reports to SS&C's Chief Technology Officer, provides periodic updates to the Audit Committee or to the board of directors on cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents, industry trends and other areas of importance.

companyName: SS&C Technologies Holdings Inc

ticker: SSNC


text: When an incident is reported, Tyler assembles its incident response team and initiates its incident response process as soon as possible. Working with the incident response team, the CISO aims to take an initial measurement of qualitative and quantitative metrics, typically within 24 hours of the incident report, to help determine whether Tyler's Chief Financial Officer ("CFO") and Chief Accounting Officer ("CAO") should be engaged to do a deeper analysis of quantitative factors. The CFO and CAO are expected to engage with the Company's Chief Legal Officer ("CLO"), Chief Administrative Officer ("CAdO"), and Audit Committee Chair to evaluate, holistically, not just the quantitative factors but the qualitative factors as well. If that team determines that the incident may represent a risk of national security, the CLO may contact the US attorney general for a disclosure delay of up to 30 days, or if applicable the team may coordinate to prepare and publish a Form 8-K, if management believes the materiality threshold has been reached. Whether or not the incident is deemed material, the incident response team will monitor the incident on an ongoing basis to attempt to ensure containment, mitigation, and remediation, as well as to monitor for evolving factors that subsequently push the incident to a materiality threshold that requires disclosure and reporting.

companyName: TYLER TECHNOLOGIES INC

ticker: TYL


text: The Board of Directors implements its IT risk oversight obligations primarily through the Board's Enterprise Risk Management Committee (ERM Committee). The primary function of the ERM Committee is to advise the Board of Directors regarding the enterprise risk management framework of the Company and to provide oversight to assist the Board of Directors in supervising enterprise risk management activities. The ERM Committee reviews and defines risk exposure limits for each specified risk category, including IT risk, while taking into consideration strategic goals and objectives and current market conditions. The Board ERM Committee reviews and approves any necessary changes to risk exposure limits after careful consideration of any changes in market conditions or corporate strategy and adopts guidelines, through the input of the Management Risk Committee's analysis and discussion, regarding the maximum loss exposure the Bank is able and willing to assume.

companyName: FARMERS & MERCHANTS BANCORP INC

ticker: FMAO


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Technology Officer (CTO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.

companyName: Cipher Digital Inc.

ticker: CIFR


text: To identify and assess material risks from cybersecurity threats, members of our cybersecurity risk management function, which is led by our Chief Information Security Officer ("CISO"), consider cybersecurity threats within the context of our business environment. Cybersecurity risks are managed through technological, process, and administrative controls that are designed to target the mitigation of risk to levels acceptable to the business. Risk assessment and management include processes for managing third-party cybersecurity risk. These processes provide that third-party cybersecurity risk assessments are to be performed prior to a vendor's engagement, upon contract renewal, and as we may otherwise require. Our formal cybersecurity policy program, which includes a collection of security policies and procedures, is in place to establish requirements, standards, and security controls designed to protect Sabre's technology environment.

companyName: Sabre Corp

ticker: SABR


text: Following the conclusion of an incident, we, with the assistance of the incident response team, will generally reassess the effectiveness of the cybersecurity program and incident response plan, make adjustments as appropriate and report to our senior management and our Audit Committee on these matters.

companyName: W. P. Carey Inc.

ticker: WPC


text: We plan to incorporate a risk management team to collaborate closely with the IT department, consistently assessing and mitigating cybersecurity risks in alignment with our business goals and operational requirements.

companyName: ASIAFIN HOLDINGS CORP.

ticker: ASFH


text: We use third-party security vendors to further strengthen our cybersecurity posture. These partners provide advanced monitoring, detection, and response capabilities that complement our internal controls and staff expertise. Their services include continuous threat intelligence, vulnerability management, and incident response support, which are integrated into our cybersecurity program. A written cybersecurity incident response plan that we tabletop yearly and cybersecurity insurance are also key components of our approach to managing the risk of a cyber event. Our incident response plan contains a materiality analysis framework based on Federal Information Processing Standards Publication 199. This materiality framework allows us to identify and classify cybersecurity events based on their impact to our data or information systems. This framework will assist us in expediting review of cyber events for materiality purposes that could require disclosure to the SEC.

companyName: CLEANSPARK, INC.

ticker: CLSK


text: One of the key functions of our board of directors is informed oversight of our risk management process. Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its risk oversight function directly as a whole, as well as through the audit committee.

companyName: Precipio, Inc.

ticker: PRPO


text: Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. The Board is committed to effective governance in managing risks associated with cybersecurity threats because we recognize the significance of these threats to our operational integrity and stakeholder confidence.

companyName: Vertical Data Inc.

ticker: VDTA


text: While our management team is responsible for the day-to-day management of the risks Standard BioTools faces, our Board has the responsibility to oversee management's processes for identifying, monitoring, and addressing enterprise risks, evaluate and discuss with management its assessments of matters relating to enterprise risks, and oversee and monitor management's plans to address such risks. The Board takes an enterprise-wide approach to risk management designed to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance, and to enhance stockholder value. In order to understand the most significant risks faced by the Company and the steps being taken to manage those risks, Standard BioTools conducts quarterly enterprise risk management assessments, facilitated by the Company's executive leadership team in collaboration with the internal audit function, which are presented by management at each quarterly Board meeting. The Board's review of our business is an integral aspect of its assessment of management's tolerance for risk and its determination as to the appropriate level of risk for our Company.

companyName: STANDARD BIOTOOLS INC.

ticker: LAB


text: Our cybersecurity management strategy consists of utilizing a combination of employee education, preventative controls, detective controls, and periodic third-party cybersecurity testing.

companyName: CNS Pharmaceuticals, Inc.

ticker: CNSP


text: The Information Security and Information Technology teams support the business through early engagement in the Project Management Office routines and the Vendor Management Office's requirements, to ensure that new products, projects, and third -party vendors are onboarded with appropriate oversight.

companyName: CATHAY GENERAL BANCORP

ticker: CATY


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Under the direction of our Senior Vice President, Information Technology and our Senior Director, Information Security & Infrastructure (together, the "Cybersecurity Leadership Team") our Information Technology department regularly monitors cybersecurity threats and leads the prevention, detection, mitigation and remediation of cybersecurity incidents, with regular reporting to senior management and to the Board on these topics.

companyName: CubeSmart

ticker: CUBE


text: Our Cybersecurity Risk Management Strategy includes a myriad of tools and resources that are designed to ensure the integrity of our information systems. We place particular emphasis on protecting the privacy of our patient data pursuant to the HIPAA Security Rule. Our cybersecurity risk management process is integrated with our larger risk management system and is considered a core function of our overall risk management strategy.

companyName: FONAR CORP

ticker: FONR


text: Our implementation of strong access controls includes multi-factor authentication, least privilege access, role-based access control, and network segmentation to ensure information assets are protected from unauthorized access and/or exposure.

companyName: DYCOM INDUSTRIES INC

ticker: DY


text: The SISO meets regularly with and works collectively with the Bank's Chief Information Officer ("CIO") and various members of the Information Technology Department as well as third-parties we may employ to assist in this area. The CIO has over 30 years of experience in Information Technology.

companyName: Hanover Bancorp, Inc. /MD

ticker: HNVR


text: Risk Management and Strategy General. The Company's information security program, including its processes with respect to cybersecurity, is focused on protecting our systems, networks and data from unauthorized access by a third party. Concerns about cybersecurity risks impact, at some level, every facet of the Company's operations, from the way we structure the services we offer, to how we communicate with our customers, to our interactions with and training of employees, and to the expenditures we make when expanding and enhancing our technological infrastructure. We expect this continue to be the case as cybersecurity threats, and the means to respond to those threats, continue to evolve.

companyName: RENASANT CORP

ticker: RNST


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer. Such individuals have significant prior work experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.

companyName: PEPSICO INC

ticker: PEP


text: Board of Directors, the Audit Committee and the Cyber Committee, which is chaired by the Chief Executive Officer and staffed by the IT Director, Chief Financial Officer, Corporate Controller and other management employees, are responsible for overseeing cybersecurity risks and risk management. The Board has assigned oversight responsibility for cybersecurity to the Audit Committee, which is in regular communication with management concerning cybersecurity threats and incidents. The Audit Committee reviews management assessment of cyber controls, control testing and outcomes. The Audit Committee is responsible for keeping the Board informed of significant cybersecurity developments including incidents which might potentially have a material effect on the Company. The Cyber Committee is responsible for evaluating cyber threats, the potential effect on operations and scope of the threat. Threats or incidents which the Cyber Committee has judged to have potentially material consequences will be communicated to the Audit Committee. A meeting of the full Board of Directors, including the Audit Committee, will be convened within 48 hours of the Cyber Committee assessment. If the Board determines that the threat or incident is material, Form 8-K will be finalized and filed within four days following the determination, as required under SEC rules.

companyName: NeuroMetrix, Inc.


text: Our Head of IT, twice a year, provides reports to the audit committee on the status of our cybersecurity program, including measures implemented to monitor and address risks from cybersecurity threats, as appropriate. He also reports on a quarterly basis to the executive committee on cybersecurity and information technology matters. The chair of the audit committee provides periodic reports on cybersecurity risk management to the full board of directors. Our Chief Legal Officer, on an annual basis, discusses the results of our enterprise risk assessment processes, including risks related to cybersecurity, with the full board of directors.

companyName: Disc Medicine, Inc.

ticker: IRON


text: We have adopted an Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company. The IRP is practiced through walkthroughs and tabletop exercises on at least an annual basis.

companyName: MARRIOTT VACATIONS WORLDWIDE Corp

ticker: VAC


text: Management Oversight Our IT infrastructure and the assessment and management of associated risks are primarily the responsibility of our Chief Information Security Officer ("CISO"). Our CISO's additional responsibilities include hiring appropriate personnel, helping to integrate cybersecurity risks into the Company's overall risk management strategy, and communicating updates regarding IT/Information security key priorities to relevant personnel including management and the board.

companyName: POWER INTEGRATIONS INC

ticker: POWI


text: Imperial recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the company integrates cybersecurity risks into its overall enterprise risk management system. The board of directors oversees the company's risk management approach and structure, which includes an annual review of the company's cybersecurity program.

companyName: IMPERIAL OIL LTD

ticker: IMO


text: We have adopted and implemented an approach to identify and mitigate cybersecurity risks within our overall enterprise risk management program that is based on a recognized framework established by the National Institute of Standards and Technology. The board of directors is responsible for overseeing management's enterprise risk management program, and receives regular reports on cybersecurity risk identification, monitoring and mitigation from our Chief Financial Officer as part of its review of that program, in addition to the regular reports received from the CIO as part of the board's overall cybersecurity program review.

companyName: HEXCEL CORP /DE/

ticker: HXL


text: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer. This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems. We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company's overall enterprise risk management program.

companyName: UNITEDHEALTH GROUP INC

ticker: UNH


text: Company (or third parties it relies on) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only mitigate and not fully eliminate risks. And events, when detected by security tools or third parties, may not always be immediately understood or acted upon.

companyName: Crypto Co

ticker: CRCW


text: Recognizing that human factors play a critical role in cybersecurity, our workforce and compliance training includes comprehensive security awareness program. All employees undergo quarterly security training, covering data protection, insider threat mitigation, phishing awareness, and compliance best practices. Additionally, we implement strict enforcement of multi-factor authentication, just-in-time access controls, and continuous user behavior monitoring.

companyName: INTELLIGENT PROTECTION MANAGEMENT CORP.

ticker: IPM


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: We established an interdisciplinary team to monitor and assess cybersecurity risks on an ongoing basis, which is led by our Chief Financial Officer ("CFO"). It is a cross-departmental team that consists of finance and operations personnel, as well as third party legal and information technology ("IT") consultants, with all significant implementation efforts executed by our IT consultant, who has extensive experience in IT, enterprise security and cyber risk management. This team oversees developing, maintaining and measuring compliance with the cyber risk management program, and dedicates significant resources to cybersecurity and risk management processes to adapt to the ever-changing cybersecurity landscape and to respond to emerging threats in a timely and effective manner.

companyName: ZeroStack Corp.

ticker: ZSTK


text: The Committee reports to the Board regarding its activities, including those related to cybersecurity. The Board also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Chief Executive Officer and EVP, Chief Legal Officer, internal security consultants and external experts as part of the Board's continuing education on topics that impact public companies.

companyName: AEON Biopharma, Inc.

ticker: AEON


text: See Item 1A. Risk Factors under the heading of "The Company employs information technology systems to support its business, and any material breach, interruption or failure may adversely impact the Company's business." for additional information on cybersecurity threats that could have a material impact on the Company. The Risk Factors section should be read in conjunction with this Item 1C.

companyName: PREFORMED LINE PRODUCTS CO

ticker: PLPC


text: The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments. A member of our Board of Trustees and the Audit and Cyber Risk Committee of our Board of Trustees is a recognized cybersecurity expert as a member of the Tech & Cybersecurity Advisory Committee for U.S. Senator Mark Warner and having been an investor in and director of private and public technology-focused companies.

companyName: LXP Industrial Trust

ticker: LXP


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Breaches of security and viruses in our systems could result in client claims against us and harm to our reputation causing us to incur expenses and/or lose clients" included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K,which disclosure is incorporated by reference herein. Although we maintain cybersecurity insurance to reduce potential financial losses that may stem from cybersecurity incidents, the costs related to cybersecurity threats or disruptions may not be full insured.

companyName: TruBridge, Inc.

ticker: TBRG


text: The Cybersecurity Program includes, but is not limited to, the following processes that collectively help management to stay informed about and monitor the prevention, detection, mitigation and remediation of risks and incidents: • Risk assessment program to assess, track and address security risks. • Incident Response Plan to identify, evaluate, remediate and report incidents, as appropriate. • Security testing by external third-party providers to identify potential threats and vulnerabilities. • Reviews of critical third-party connections, including a security assessment and restrictions based on the third-party's risk profile. • Security training for employees and contractors, including alerts for new security developments, as warranted.

companyName: Spok Holdings, Inc

ticker: SPOK


text: Key elements of this program include: • Oversight and Governance. Uber's Board oversees the Cybersecurity Program, and Uber's risk profile with respect to cybersecurity matters, through regular reports and reviews. These include presentations by the CISO to the Board and Audit Committee on an alternating quarterly basis, quarterly reports of certain cybersecurity incidents to the Board, and annual reports by the CPO to the Board.

companyName: Uber Technologies, Inc

ticker: UBER


text: We maintain security policies, standards, and processes that apply across our operations and that are approved by management, communicated to our personnel, and reviewed on an annual basis. We provide a global security awareness education program that includes mandatory security and privacy awareness training for all personnel, regular phishing identification exercises, focused training opportunities for particular roles, and incident response training for key individuals.

companyName: OneSpan Inc.

ticker: OSPN


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our IT department works with senior management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to our board of directors, which evaluates our overall enterprise risk.

companyName: Cytek Biosciences, Inc.

ticker: CTKB


text: The CISO and the cybersecurity team are committed to ongoing education and professional development, regularly participating in training programs and industry conferences to stay abreast of the latest cybersecurity trends, threats, and mitigation strategies.

companyName: APi Group Corp

ticker: APG


text: Safeguarding our critical networks and the information that platform users share with us is vital to our business. One key way that Uber addresses this need is through its cybersecurity program, which includes a cybersecurity risk management program.


text: Our policies and procedures define an overall, enterprise-wide approach for managing cybersecurity and technology risk. They establish the following process to identify, assess and manage such risks across our three lines of defense:

companyName: CAPITAL ONE FINANCIAL CORP

ticker: COF


text: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. We did not experience any material IT security incidents during the fiscal year. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our IT Systems, or those of our CROs, CMOs, other contractors, vendors, consultants or collaborators, may fail or suffer system failures, security breaches or deficiencies in cybersecurity, which could results in a material disruption of our product development programs, compromise sensitive information related to our business or trigger contractual and legal obligations.

companyName: Connect Biopharma Holdings Ltd

ticker: CNTB


text: Our CIO and GHIS provide regular updates on cybersecurity risk and our information security program to the Risk Committee. These reports typically occur on a quarterly basis and include updates on current cyber risks, cybersecurity strategies and initiatives, event preparedness, the status of projects to strengthen our information security program, and the emerging cybersecurity threat landscape.

companyName: Enstar Group LTD


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a master's degree in computer science with a concentration in information security as well as multiple information security certifications.

companyName: BRINKS CO

ticker: BCO


text: As part of these processes, and to ensure confidentiality, integrity and availability of critical data and systems, we have implemented various technologies that aid in the prevention, detection, investigation, response and remediation of vulnerabilities, cybersecurity incidents and risks. These technologies and processes include, but are not limited to, mobile device management, virtual private network security services, attack surface management services, cloud threat detection and response systems, cloud security posture management solutions, cloud-native security scanners and source code analysis tooling, continuous compliance monitoring and security awareness training solutions.

companyName: Serve Robotics Inc. /DE/

ticker: SERV


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part 1, Item 1A. "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.

companyName: Cigna Group

ticker: CI


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President and General Counsel, Chief Financial Officer, and Vice President, Finance and Controller. Our Senior Vice President and General Counsel has expertise as a Life Sciences executive, has had a key role in information technology and cybersecurity oversight for several years and has completed several cybersecurity trainings. Our Chief Financial Officer has several years of expertise performing audits as a public accountant, including audits over information technology controls, and has also completed several cybersecurity trainings. Our Vice President, Finance and Controller has expertise playing a key role with information technology general controls and control testing for the Company for many years, and has several years of expertise leading and performing audits as a public accountant, including audits over information technology controls. He has also completed several cybersecurity trainings.

companyName: Regulus Therapeutics Inc.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan, incident response policy and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors to assess for cyber risks and to assist the business in making risk-informed technology product and services decisions. We perform due diligence, including risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.

companyName: SolarWinds Corp


text: Trimble's incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology ("NIST"). Our framework includes steps to identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.

companyName: TRIMBLE INC.

ticker: TRMB


text: As discussed above, our information security program and approach is based on the NIST Framework, and we have implemented cybersecurity policies, processes and practices designed to monitor and address cybersecurity threats and incidents. Our Chief Security Officer, in coordination with the Head of Risk, Chief Information Officer, Head of Operations, and General Counsel, is responsible for leading the assessment and management of cybersecurity risks. Our Chief Security Officer has extensive experience in information security, data protection and privacy, and regularly receives reports from our threat intelligence resources, in concert with enterprise risk, and legal departments, on cybersecurity threats and incidents.

companyName: Argo Group International Holdings, Inc.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including accountants, independent assessors, external legal counsel, and other consultants.

companyName: Ingram Micro Holding Corp

ticker: INGM


text: In addition, we have processes in place for assessing and managing risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information they access. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider. We monitor third-party risks through due diligence questionnaires and periodic assessments, and we track the status of reported risks within our centralized risk governance framework.

companyName: ONITY GROUP INC.

ticker: ONIT


text: The CISO, in coordination with the information security managers, is responsible for leading the assessment and management of cybersecurity risks. The Company's information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services. The CISO reports to the board of directors, the audit committee, and senior management on cybersecurity threats.

companyName: CREDIT ACCEPTANCE CORP

ticker: CACC


text: The Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below, the Board's oversight of cybersecurity risk management is supported by the Audit Committee, which regularly engages with the Company's risk management function, the Company's Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO") and other members of management. • Collaborative Approach: The Company has implemented a wide-ranging approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains an incident response and recovery plan that addresses the Company's response to a cybersecurity incident, and such plan is tested and evaluated on a regular basis. • Third-Party Risk Management: The Company employs a risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company's methods for managing third-party cybersecurity risk include reliance on contractual clauses, periodic due diligence, audits by third parties, and vulnerability testing. • Education and Awareness: The Company provides biannual training for personnel regarding information security, privacy, and compliance.

companyName: AGILITI, INC. \DE


text: Dow also utilizes internal and external audits and assessments, vulnerability testing, governance processes over outsourced service providers, active risk management and benchmarking against peers in the industry to validate Dow's security posture. Dow also engages external firms to measure Dow's NIST CSF maturity level.

companyName: UNION CARBIDE CORP /NEW/


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis. Management's efforts include establishing processes designed to ensure that potential cybersecurity risks are monitored, putting in place mitigation and remedial measures and implementing and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Information Security Officer (CISO), who reports to our Chief Information Officer (CIO). Our CIO has significant expertise and over a decade of experience working in technology. Our CISO has over twenty years of experience working in cybersecurity and maintains a Certified Information Systems Security Professional certification. Our CISO and CIO receive reports from our cybersecurity team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity team is comprised of experienced information systems security professionals and information security managers with many years of experience and various security certifications.

companyName: MARSH & MCLENNAN COMPANIES, INC.

ticker: MRSH


text: Risk Assessment. On a periodic basis, but not less than annually, the Chief Information Officer, in conjunction with the Board of Directors, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Company's Cybersecurity Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Board of Directors changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

companyName: Generations Bancorp NY, Inc.

ticker: GBNY


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also periodically receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our management team as part of the Board's continuing education on topics that impact public companies.

companyName: Q32 Bio Inc.

ticker: QTTB


text: Like other technology companies, we have faced and expect to face cybersecurity threats on an ongoing basis. As of the date of this Annual Report on Form 10-K, however, we do not believe that any prior cybersecurity-related threats or incidents have materially affected our company. In addition, we require other third-party service providers with access to our systems or processing sensitive data for us to certify that they have the ability to implement and maintain reasonable and appropriate security measures, consistent with all applicable laws, in connection with providing services to us, and to promptly report any suspected breach of their security measures that may affect our company.

companyName: Samsara Inc.

ticker: IOT